Privacy Policy

This privacy policy describes how Couverty (“we”, “our”, “us”) collects, uses, stores and protects your personal data when you use our restaurant booking platform.

We are committed to complying with the European Union's General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP, also known as the revFADP since its revision).

This policy also covers your requests for information or for a demonstration of Couverty, in particular via Facebook and Instagram ad forms.

The data controller is:

3.1 Guest data (bookings)

When you make a booking, we collect:

• Identification data: first name, last name
• Contact details: email address, phone number
• Booking details: date, time, number of people, any comments
• Technical data: IP address (for security purposes)

3.2 Professional user data

When a professional account (restaurant owner) is created, we collect:

• Identification data: first name, last name, email address
• Authentication data: password (stored securely and encrypted)
• Venue data: name, address, phone number, logo, images
• Billing data: information required for payment via Stripe
• Data related to the use of the mobile app: push notification tokens, technical device identifiers, notification preferences and information required for the app to work properly

3.3 Automatically collected data

• Session cookies: necessary for the application to work
• Technical logs: IP addresses, browser or device type, operating system, security events
• Diagnostic data: errors, crashes, performance and technical context useful for resolving incidents
• Usage and audience measurement data, only where the corresponding tools are configured and accepted via the consent banner

3.4 Payment data (no-show protection)

When the restaurant owner activates no-show protection, the Guest's payment method (payment card) is collected and stored exclusively with Stripe Inc., on the restaurant owner's Stripe Connect account. Couverty only keeps technical identifiers in its database (SetupIntent, PaymentIntent, PaymentMethod identifiers) together with time-stamped proof of the Guest's consent (date and exact text displayed at the time of booking). No card data (number, security code, expiry date) is ever stored by Couverty.

The restaurant alone decides whether to activate this protection, the amount applied, the conditions displayed to the Guest and whether to charge a penalty in the event of a no-show. Couverty provides the technical tool and does not decide on the charge, subject to its own legal and contractual obligations.

3.5 Sales enquiries via Facebook and Instagram

When you submit a Couverty ad form on Facebook or Instagram, we receive your name, your email address, the name and municipality of your restaurant, your role and the need you selected. The phone number is optional. We may also receive the date of the request and the identifiers of the form or ad, which show where it came from.

This information is used to understand your request, reply to you and, if you wish, arrange a presentation of Couverty. Submitting the form does not subscribe you to a newsletter. Our automated advertising performance reports use statistics per campaign or ad, without including your contact details or your individual answers.

Your data is used for the following purposes:

We keep your data for the following periods:

• Booking data: 3 years after the last booking
• User accounts: lifetime of the account + 30 days after deletion
• Billing data: 10 years (statutory accounting obligations)
• No-show consent records and transaction identifiers: as long as necessary to manage the booking, disputes and the applicable legal obligations
• Push notification tokens: until notifications are disabled, the account is deleted or the token is invalidated
• Security logs: 12 months
• Sales enquiries: as long as necessary to respond to your request and follow up on ongoing exchanges. Once these are closed, data that is no longer needed is deleted or anonymised, subject to legal obligations or the need to keep evidence in the event of a dispute. If you become a customer, the periods applicable to the account and to billing then apply.

Your data may be shared with the following recipients:

6.1 The restaurant concerned

When you make a booking, your data is passed on to the restaurant with which you are booking so that it can manage your booking.

6.2 Technical processors

We use the following services for the proper operation of our platform:

• Stripe (USA): payment processing (stripe.com/privacy)
• Infomaniak (Switzerland): sending emails
• Google / Firebase (USA/EU): OAuth authentication, calendar synchronisation and push notifications (optional)
• Sentry (USA/EU): tracking of errors, crashes and technical diagnostics
• Vercel (USA/EU): hosting, delivery and technical logs of the application
• Cloudinary (USA/EU): image hosting and optimisation when this feature is used

These processors are bound by standard contractual clauses (SCCs) guaranteeing an adequate level of protection for transfers outside Switzerland/the EU.

6.3 Meta ad forms

Facebook and Instagram forms are hosted by Meta, which collects your answers and passes them on to us. At Qodex, only the people authorised to follow up on requests have access to them. Meta also processes data for its own services, in accordance with its privacy policy: https://www.facebook.com/privacy/policy/.

Using these services may involve processing outside Switzerland, in particular in Ireland and the United States. Meta's policy sets out the destinations, purposes and safeguards applicable to its processing and transfers. A request sent to Qodex concerns the data held by Qodex; rights relating to Meta's own processing are exercised with Meta.

Some of your data may be transferred to third countries (in particular the United States) via our processors. These transfers are governed by:

• The European Commission's standard contractual clauses
• Adequacy decisions (for recognised countries)
• The specific safeguards provided for by the Swiss FADP

Our platform uses cookies and local storage that are strictly necessary for its operation:

• Session cookie: keeps you logged in (duration: 7 days)
• Language, display and consent preferences
• Local storage required for offline operation or for the stability of the mobile app

Audience measurement, personalisation or marketing cookies or tools are only used if they are configured on the platform and, where required by law, after your consent via the banner provided for this purpose. You can change your preferences at any time from this banner or the available settings.

In accordance with the GDPR and the FADP, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct your inaccurate data
• Right to erasure: request the deletion of your data
• Right to data portability: receive your data in a structured format
• Right to object: object to the processing of your data
• Right to restriction: restrict the processing of your data
• Right to withdraw consent: withdraw your consent at any time

To exercise these rights, contact us at: info@qodex.ch

Deletion of your account and app data

Users with an account may request the deletion of their account and the associated data by writing to info@qodex.ch. We delete or anonymise the data concerned, except where retaining it remains necessary to comply with a legal obligation, handle a dispute, secure the service or perform an ongoing contract.

Right to unsubscribe

You can unsubscribe from marketing emails (weekly menu) at any time by clicking the unsubscribe link included in each email, or by contacting us directly.

To stop sales communications or to request access to, correction or deletion of the data in your request, write to info@qodex.ch. You do not need to create a Couverty account.

We implement the following security measures:

• Password encryption (bcrypt)
• Secure connections (HTTPS/TLS)
• Protection against brute-force attacks (rate limiting)
• Single-use security tokens for sensitive actions
• Role-based restricted access to data

Our service is not intended for persons under the age of 16. We do not knowingly collect personal data concerning minors.

We reserve the right to amend this privacy policy. In the event of a material change, we will inform you by email or via a notification on our platform.

If you consider that the processing of your data infringes your rights, you may lodge a complaint with:

• In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch
• In the EU: the supervisory authority of your country of residence

For any questions about this policy or your personal data: