In this document
Privacy Policy
Effective date: 19 October 2026
This Privacy Policy explains how Chequo OĆ, a private limited company registered in
Estonia (registry code 17560275), with its registered office at
Narva mnt 5, 10117 Tallinn, Harju maakond, Estonia ("Chequo", "we", "us", or "our"),
collects, uses, and protects personal data in connection with the Chequo
point-of-sale, QR menu, reservations, and related services (the "Service").
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Estonian law.
1. Our two roles
Chequo handles personal data in two distinct capacities:
- As a controller ā for the personal data of our business customers and their staff (for example, the restaurant owner or manager who signs up, and the staff members who log in). We decide how and why this data is processed.
- As a processor ā for the personal data that our business customers ("Customers") collect from their own guests and customers ("End Customers") using the Service (for example, reservation details). Here, the Customer is the controller and Chequo processes the data on their behalf and under their instructions, as set out in our Data Processing Agreement ("DPA").
If you are an End Customer (for example, you made a reservation at a restaurant that uses Chequo), the restaurant ā not Chequo ā is responsible for your data as controller. Please direct privacy requests to that restaurant. We will assist them as their processor.
2. Personal data we collect
As controller (Customer and staff data):
- Account and contact data ā name, email address, phone number, business name, and login credentials of the account owner and managers.
- Staff data ā staff names, roles, and PINs used to access the Service.
- Billing data ā subscription and payment information. We do not store full card numbers.
- Usage and device data ā log data, device identifiers, app version, IP address, and diagnostic information generated when you use the Service.
- Country from your IP address ā when you visit our public website (chequo.com), we look up which country your IP address belongs to, so we can show you the home page and pricing for your country. The lookup runs against a database on our own servers: your IP address is not sent to any third party for it, and we do not store it for this purpose. We keep only the country, in a session cookie. The country database is GeoLite2 data created by MaxMind, available from maxmind.com.
- Support communications ā information you provide when you contact us.
- Launch notification data ā if you ask to hear when Chequo launches: your email
address, optionally your restaurant name and city, and when you gave consent and the
wording you agreed to. If you reached our website through one of our ads or a tagged
link, we also keep which campaign brought you: the campaign parameters in that link
(such as
utm_campaign), the ad platform's click identifier (such as Google'sgclid), and the first page you landed on.
As processor (data we process on behalf of Customers):
- End Customer data ā for example, reservation details such as a guest's name, phone number, email address, party size, and notes; and order and transaction data that Customers generate through the Service. QR menu viewing is designed not to require End Customers to provide personal data.
3. Why we use personal data and our legal bases
When we act as controller, we rely on the following legal bases under the GDPR:
| Purpose | Legal basis |
|---|---|
| Provide, operate, and maintain the Service and your account | Performance of a contract |
| Process payments and manage subscriptions | Performance of a contract |
| Provide support and respond to enquiries | Performance of a contract; legitimate interests |
| Secure the Service, prevent fraud and abuse, and debug | Legitimate interests |
| Improve the Service and develop features | Legitimate interests |
| Send service and administrative messages | Performance of a contract; legitimate interests |
| Show you the website home page and pricing for your country | Legitimate interests |
| Comply with legal, accounting, and tax obligations | Legal obligation |
| Email you when Chequo launches, if you asked us to | Consent, which you can withdraw at any time |
| Learn which of our ads and links lead to sign-ups, from the link you arrived through | Legitimate interests |
| Measure how our ads perform with Google Ads cookies on our public website | Consent, which you can withdraw at any time |
When we act as processor, we process End Customer data only to provide the Service to the Customer and on the Customer's documented instructions, as described in the DPA.
4. Sub-processors and third parties
We use a small number of trusted service providers ("sub-processors") to deliver the Service. They process personal data only as needed to provide their services to us and under appropriate data-protection terms:
| Sub-processor | Purpose | Location |
|---|---|---|
| DigitalOcean | Cloud hosting and data storage | Frankfurt, Germany (EU) |
| OpenAI | AI translation of interface and menu text; AI-generated menu photos | United States |
| Google Cloud (Vertex AI) | The AI assistant in the back office (Gemini models) | EU |
| Anthropic | The AI assistant: reading documents and images you upload, such as supplier delivery notes | United States |
| Fiskaly | Fiscalisation and tax-compliance services | EU |
| Google Ireland Limited | Website analytics and ad measurement on our public website (Google Analytics, Google Ads) | EU / United States |
We do not sell personal data, and we do not share it with third parties for their own marketing.
5. Where your data is stored and international transfers
Our primary hosting and data storage is located in Frankfurt, Germany, within the European Union.
Some sub-processors (for example, OpenAI, Anthropic, and Google) may process limited data outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs), to protect it.
6. How long we keep personal data
We keep personal data for as long as your account is active and as needed to provide the Service. After your account is closed, we delete or anonymise personal data within approximately 90 days, except where we are required to retain certain records (for example, invoices and accounting records) to comply with legal obligations, or where data must be retained to establish, exercise, or defend legal claims.
If you asked to hear when Chequo launches, we keep your sign-up until we have sent that email, or until you withdraw your consent if that comes first, and then delete it.
When we act as processor, we retain and delete End Customer data in accordance with the Customer's instructions and the DPA.
7. How we protect personal data
We use technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls, network isolation, and restricted administrative access. No system is completely secure, but we work to protect personal data against unauthorised access, loss, or misuse.
8. Your rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you;
- request rectification of inaccurate data;
- request erasure of your data ("right to be forgotten");
- request restriction of processing;
- object to processing based on legitimate interests;
- receive your data in a portable format (data portability); and
- withdraw consent at any time where processing is based on consent (without affecting prior processing).
To exercise these rights, contact us at privacy@chequo.com. You also have the right to lodge a complaint with a supervisory authority ā in Estonia, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or the authority in your country of residence.
End Customers: if your data was collected by a restaurant using Chequo, please contact that restaurant to exercise your rights; as processor, we will assist the restaurant in responding.
9. Cookies and similar technologies
Cookies we use without asking. Some cookies and similar technologies are strictly necessary to provide a service you asked for, and are used without consent: keeping you signed in, remembering your language and the country we detected from your IP address, holding the contents of an order you are placing from a QR menu, and recording the cookie choice described below.
Which ad brought you. If you arrive on our public website through a link that carries campaign parameters or an ad click identifier, the website remembers them in the page's memory while you browse in that tab; nothing is stored on your device, and they are gone when you close or reload the tab. They leave your browser only if you sign up for the launch notification, as described in section 2.
Analytics and ad measurement, only with your consent. On our public website
(chequo.com and docs.chequo.com) we use Google Analytics to understand which pages people
find useful, and Google Ads to measure how our ads perform: whether a visit that started
with one of our ads led to a sign-up. These cookies (_ga and _ga_* for analytics,
_gcl_* for ad measurement) are set only after you accept them. If you decline, none
of them are set and Google's tag is not loaded. If you withdraw your consent later, we
stop the tag and delete these cookies. If you accepted before
19 October 2026, when our cookie notice did not yet mention ads, we use analytics only
until you accept again.
What we do not do. We do not use your visit to show you personalised ads or for remarketing, we do not use analytics or advertising cookies in the tools restaurants and their guests use ā the POS, the kitchen display, the back office, QR menus, and the restaurant websites we host ā and we do not share analytics data with third parties for their own marketing.
Changing your mind. Your choice is remembered for six months, after which we ask again. You can change it at any time from the Cookies link in the footer of our website, or by clearing the cookies your browser has stored for our site.
10. Children
The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children.
11. Changes to this Policy
We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (for example, by email or through the Service). The "Effective date" above indicates when this Policy was last updated.
12. Contact us
For any questions about this Privacy Policy or our handling of personal data, contact:
Chequo OĆ
Narva mnt 5, 10117 Tallinn, Harju maakond, Estonia
Email: privacy@chequo.com
The original of this document is written in English. Where Chequo provides translations of this Privacy Policy, the English version governs and prevails in the event of any conflict.