Privacy policy

Spindl is restaurant software: point of sale, kitchen display, self-service kiosks, online ordering, delivery-app connections, loyalty, inventory, card payments, and an assistant you can ask questions in plain language. It runs on iOS, Android, and the web, including at pos.spindl.app and spindl.app.

The company is Spindl OÜ, an Estonian private limited company, registry code 14946962, Lõõtsa tn 8, 11415 Tallinn, Estonia. In this policy, “Spindl”, “we”, and “us” mean Spindl OÜ.

• People who visit this website, including when they book a demo.
• Restaurant owners, managers, and staff who use the Spindl app.
• Guests who order, pay, or join a loyalty programme at a restaurant that runs on Spindl.

We act in two different roles, and the difference matters for who you should contact.

We are the controller for this website, demo requests, Spindl accounts, billing between us and a restaurant, and support conversations with us. We decide why that data is used.

We are the processor for guest and operational data a restaurant puts into Spindl: orders, loyalty profiles, and the sales history of that venue. The restaurant decides why that data is collected. We process it to provide the service, on the restaurant’s instructions. If you are a guest asking about an order or a loyalty profile, start with the restaurant. We will help them respond.

This website

If you book a demo, the form asks for your name, phone number, email address, restaurant name, number of locations, approximate monthly revenue, delivery versus eat-in split, and which delivery platforms you use. We email that request to our team so we can call you back.

When you browse the site, our servers log technical data such as IP address, browser type, pages viewed, and the time of the visit. If analytics is enabled, Google Analytics also receives a usage measurement. See Cookies below.

Restaurant accounts and staff

• Name, email, phone number, role, and login credentials for the people a venue invites.
• Company and venue details the account owner enters, such as the restaurant name and locations.
• Billing details for the Spindl plan: fees, invoices, and the business information needed to pay us or to pay the venue out.
• Product activity needed to run the service: orders taken, menu edits, devices used, and changes a person at the venue approves in the dashboard or through the assistant.

Guests of a restaurant

When a venue uses Spindl, the service stores what that venue needs to take and fulfil an order:

• Items, prices, time, and whether the order is dine-in, pickup, or delivery.
• Contact details the guest provides for that order, such as name, phone, email, or delivery address, when the channel asks for them. A kiosk or counter order does not require an account.
• A loyalty profile, if the venue runs loyalty in Spindl: typically a name, phone or email, and visit or reward history.

Card payments

Card payments in person, online, and at the kiosk are processed by Adyen. Adyen collects the card details. Spindl receives the outcome of the payment, the amount, and a reference so the venue can reconcile the sale. We do not store the full card number.

The assistant

If someone at a venue asks a question in the Spindl dashboard, or connects Claude, ChatGPT, Slack, or Telegram, we process the prompt and the restaurant data needed to answer it. A change to menus, prices, or orders is applied only after someone at the venue approves it. Do not put card numbers or identity documents into a prompt.

Support

If you email info@spindl.app or talk to support, we keep the message and any attachment you send, so we can answer and fix the issue.

• To provide, secure, and bill for Spindl.
• To answer demo requests and support messages.
• To take orders, run menus, loyalty, inventory, and payments for the venue.
• To sync menus and orders with delivery apps the venue connects, such as Wolt, Uber Eats, Deliveroo, Bolt Food, Foodora, and DoorDash.
• To send service messages about the account, payouts, and product changes.
• To detect fraud and abuse.
• To understand which parts of the product and the website are used, in aggregate where we can.

We do not sell personal data, and we do not use guest order data to advertise to those guests.

Where the GDPR applies, we rely on:

• Contract (Article 6(1)(b)) — providing Spindl to a restaurant, and handling an account or a demo you asked for.
• Legitimate interests (Article 6(1)(f)) — keeping the service secure, understanding how the website is used, improving the product, and following up with people who asked to hear from us. Guest data inside a venue account is processed so we can perform our contract with that restaurant.
• Legal obligation (Article 6(1)(c)) — tax, accounting, and payment records we have to keep.
• Consent (Article 6(1)(a)) — where a cookie or a marketing message requires it. You can withdraw consent at any time. That does not affect processing that already happened.

We share personal data with companies that help us run Spindl, and with services a restaurant chooses to connect. They use it only for that purpose.

• Adyen — card payments.
• Delivery platforms the venue turns on — the order and menu data that channel needs.
• Tools the venue connects — accounting, loyalty, inventory, or workforce products such as Xero, MarketMan, Fourth, or Como Sense, limited to what that connection is for.
• AI providers the venue uses — OpenAI or Anthropic, limited to the content of that request.
• Resend — delivery of demo-request and service email.
• Google — website analytics, when it is enabled.
• Hosting providers — the infrastructure that runs the app and this website.

A restaurant can see its own guest and sales data. That is the service. We also share data if the law requires it, or if the business is sold or reorganised, in which case this policy keeps applying or we tell account owners about the new one.

Spindl is established in Estonia. Some providers, including payments, delivery platforms, email, analytics, and AI, process data outside the European Economic Area. Where they do, the transfer rests on an adequacy decision, Standard Contractual Clauses, or the provider’s equivalent safeguard.

The website and the app use cookies and similar storage to:

• Keep a person signed in.
• Remember preferences.
• Measure visits to this website, when analytics is on.

You can block cookies in your browser. The marketing site still loads. Signing in to the app needs a cookie to work.

• Demo requests are kept long enough to follow up, then deleted or reduced to a business contact.
• Account data is kept while the account is open. After it closes, we delete or anonymise it, except records the law tells us to keep.
• Guest orders and payment records stay for as long as the restaurant’s account needs them, and for as long as tax and accounting law requires.
• Support messages are kept while the issue is open and for a short period after.
• Server logs are kept for a short rolling period.

Account holders can ask us to delete their data at info@spindl.app. Guest data held for a restaurant is deleted or exported when that restaurant asks, aside from records we must keep by law.

Access to production systems is limited to people who need it to run the service. Connections to Spindl are encrypted in transit. Card details are handled by Adyen, so the full card number is not stored in Spindl.

If you are in the EEA or the United Kingdom, you can ask to access, correct, delete, or export your personal data, and you can restrict or object to processing. Where we rely on consent, you can withdraw it.

Email info@spindl.app. We reply within one month. If the data is a guest profile held for a restaurant, we will direct you to that restaurant and assist them where we are the processor.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at aki.ee, or to your local authority.

Spindl is business software for restaurants. We do not knowingly open accounts for children. A venue should not use Spindl to build marketing profiles of children.

We post updates on this page and change the effective date above. If a change materially affects how restaurant accounts are handled, we also tell the account owner.

Spindl OÜ
Lõõtsa tn 8, 11415 Tallinn, Estonia
Registry code 14946962
info@spindl.app