Stellar Kiosk Privacy Policy

1. What Stellar Kiosk is and who processes your data

Stellar Kiosk is the app behind the self-ordering screens that some restaurants have on their own premises: you choose from the menu, pay by card on the reader and take a ticket with your order number. It is used by restaurants that subscribe to Stellar Store. Three different parties are involved:

• The restaurant where the kiosk is located is the data controller. It sells you the food and decides what the data of your order is used for. Its name, tax ID and address are printed on your ticket.
• Stellar Digital S.L. is the data processor (Article 28 GDPR): it provides the app and the servers and processes the data on behalf of the restaurant and on its instructions. It does not use the data for its own purposes, sell it or share it.
• Stripe processes the card payment: on behalf of the restaurant, to charge you, and also as an independent controller for its own purposes (fraud prevention and legal obligations), under its policy (section 4).

If you link your account with the kiosk's QR code (section 2), your account and your stamps are also governed by the privacy policy of that same restaurant's online shop, which is also their controller.

About Stellar, the developer of the app:
Stellar Digital S.L. (trading as Stellar Technology)
Tax ID (CIF): B-93774057
Address: Avd. Juan Gómez Juanito 16, 29640 Fuengirola, Málaga (Spain)
Email: hello@stellartech.app · Website: stellartech.app

2. What data is processed

You do not need to give any personal data to order at the kiosk. It does not ask for your phone number, email, address or a user account. If you do not scan the restaurant app's QR code (below), the order is anonymous: it is not linked to any customer record, loyalty scheme, stamps or coupon.

Data	Purpose
Order content: products, chosen options, quantities, amount, eat in or take away, language, date and time, order number and order code	Preparing and handing over your order, charging for it, printing your ticket and keeping the restaurant's till and accounts
A name to call you (only if the restaurant asks for it, and then it is needed to order; up to 40 characters; it does not have to be your real name. If it does not ask, you are called by the turn number on your ticket)	Letting you know when your order is ready. It appears on your ticket, on the kitchen ticket and on the restaurant's point-of-sale terminal
Notes for the kitchen that you add to a product (optional, for example "no onion")	Preparing the dish the way you asked
Payment details returned by Stripe: card brand, its last 4 digits, how the card was read and the technical receipt data required by the card schemes (for example, the authorisation code)	Printing them on your ticket. Stellar's servers only keep the Stripe payment reference and its amount, not the card brand or digits

Please do not write health data or other personal data in the notes. If you have an allergy or intolerance, check the allergens on the menu and tell the staff before ordering.

If you scan the QR code with the restaurant's app (optional)

At restaurants that have it switched on, the kiosk's start screen shows a QR code. If you choose to scan it with the restaurant's customer app (at Lettus, the "Lettus" app), signed in to your account, the kiosk is linked to your account in that restaurant's online shop while you place the order:

• The order is linked to your account and adds a stamp to your stamp card for that restaurant, just like your orders on its website: once you complete 10 orders, the next one is free up to the average food amount of those 10. The kiosk order does not appear in your order list in "My account", but it counts towards your stamps.
• If you have a free order, you can use it at the kiosk if you wish: it is only applied if you choose it on the screen.
• The screen only shows your first name, your stamps and, if you have one, your free order with its amount. Never your surname, phone number or email.
• If you do not type another name to be called by, the kiosk uses your first name, which appears on your ticket, on the kitchen ticket and on the restaurant's point-of-sale terminal, like any name you give at the kiosk.
• The link ends when you pay, if you do not touch the greeting screen within 10 seconds, if the order is cancelled or cleared for inactivity, or when you tap "Sign out". If it were left open, the server ends it after 30 minutes at the most.

Data (only if you scan the QR code)	Purpose
The internal identifier of your account, stored with the order	Adding your stamp and, if you choose it, applying your free order
Link record: kiosk and restaurant, the internal identifier of your account, the start time, the time of the link and the end time, how it ended and which order came from it	Knowing which account goes with which order, making sure nobody else can use the link and being able to check any issue with a stamp or a free order later
Failed scans: the IP address of your connection and the identifier of your account, only when you scan a code that is not valid	Stopping anyone who tries codes blindly

If you do not scan the QR code, none of this is processed and the order is anonymous.

Device data (not customer data)

For the kiosk to work, data about the device itself, which belongs to the restaurant, is also processed: the name the restaurant gives it, its manufacturer and model, the app version, its connection IP address and the time of its last connection, and an access credential (Stellar's servers only keep its cryptographic hash and its last 4 characters so it can be recognised, never the full credential). The device itself also stores the serial number of the connected card reader and the PIN of the staff technical screen, the latter hashed irreversibly.

3. Permissions used by the app

• Location. Stripe's payment system (Stripe Terminal) only works with the device's location turned on, and uses it to know where payments take place, to prevent fraud and reduce disputes. It is the location of the kiosk, which is fixed on the premises, not that of your phone. The Stellar app does not read the location itself, does not store it and does not send it to Stellar's servers: it is processed by Stripe.
• Bluetooth and USB, only to find and connect the card reader. Bluetooth is not used to work out location.
• Internet, to receive the menu and send orders, always over an encrypted connection (HTTPS).

When the restaurant installs the app as a dedicated device (kiosk mode), the app grants itself these permissions and turns on the device's location, so that payments work without anyone having to do it by hand. The app does not access contacts, photos, camera or microphone (the QR code in section 2 is read by your phone, not by the kiosk), and contains no advertising, analytics or tracking tools. The Stripe Terminal component built into it does send Stripe the technical data it needs for the reader and the payment to work (for example, the device model and operating system, the reader's serial number, connection and payment events, and the location), under Stripe's privacy policy.

4. Card payment

Payment is taken on a Stripe card reader (for example, the WisePad 3) connected to the kiosk. The card data is read and encrypted by the reader itself and goes straight to Stripe: neither the app nor Stellar's servers see the full card number, its expiry date or its security code. The money goes to the restaurant's Stripe account.

The amount is first authorised and is only charged once the order has been recorded correctly; if anything fails before that, the authorisation is cancelled and you are not charged. If the failure happened just after charging, the full amount is refunded to the same card.

The payment is processed by Stripe Payments Europe, Ltd. (Ireland) in two roles: as a processor, charging on behalf of the restaurant under Stripe's data processing agreement (stripe.com/legal/dpa), and as an independent controller for its own purposes, such as fraud prevention and its legal obligations, under its privacy policy (stripe.com/privacy).

5. Legal basis

• Performance of the contract of purchase you enter into when ordering: preparing, charging for and handing over the order, and giving you your ticket.
• Legal obligation of the restaurant to keep the accounting and tax records of its sales.
• If you scan the QR code, performance of the contract of the stamp scheme you take part in with your account in the restaurant's online shop: linking the order to your account, adding the stamp and applying your free order if you choose it. Scanning is voluntary and is not needed to order.
• Legitimate interest of the restaurant in the security of the service and in preventing payment fraud (device data and failed QR scans). The kiosk's location is processed by Stripe for its own fraud-prevention purposes, under its policy.

No automated decisions are made about you, no profiles are built, and the data is not used to send you advertising.

6. Who receives the data

• The restaurant: its staff see the order on the point-of-sale terminal and in the kitchen, where the kitchen ticket is printed.
• Stellar Digital S.L., as data processor.
• Hetzner Online GmbH, which hosts the servers and backups in data centres in the European Union, as sub-processor.
• Stripe, for the payment, as described in section 4.

Kiosk orders are not sent to delivery platforms or to third parties for marketing purposes. The data is hosted in the European Union. Outside the European Economic Area:

• Stripe may transfer data to Stripe, Inc. (USA), which participates in the EU-U.S. Data Privacy Framework, and also under the European Commission's standard contractual clauses included in its data processing agreement (link in section 4).

When something goes wrong (an order that does not reach the kitchen, a payment that is not completed), the system alerts Stellar's technical team through a messaging service (Telegram, outside the EEA). That alert is purely operational: the type of incident and the restaurant, with no customer data at all (no names, order codes, amounts or identifiers). The details stay in the server's internal logs, in the European Union.

You can ask for more information about these safeguards at hello@stellartech.app.

The app is downloaded and updated through Google Play, which processes its own data as a controller under its privacy policy.

7. How long data is kept

• On the kiosk. What you select is deleted when you finish or cancel the order, or after about 80 seconds without touching the screen (with a warning first). While a payment is being resolved, the order in progress is stored encrypted on the device so it is not lost if the device restarts. The kiosk also keeps, in its private internal storage, a copy of the latest printed tickets (at most 100 files; older ones are deleted automatically), with their content, the name if you gave one and the card brand and last 4 digits, so staff can sort out any issue. None of this is backed up to the cloud.
• On the servers. The order is kept for the restaurant's till and accounts. The name, if you gave one, is only used to call you: a monthly automatic process removes it once the order is 30 days old (in that month's run or the next one), including from the copy sent to the restaurant's terminal and its print queue. After 36 months the same process also removes the notes you wrote on the products. The rest of the order (products, options and amounts) is kept without that data for as long as the restaurant keeps the service. If it leaves, the monthly automatic process sends an internal notice from the cancellation and deletes its customers' data in a later run, never earlier than 30 days after the cancellation or 7 days after the notice: usually between one and two months after the cancellation. It is not deleted while the restaurant keeps using the kiosk or receiving orders, if it asks to keep it, or where it must be kept by law (4 years for tax records and 6 years for accounting records under Spanish law). An order that is never paid is cancelled and kept for the same periods.
• If you scanned the QR code. The order stays linked to your account for as long as the account exists, like your website orders, and counts towards your stamps; the periods for your account and your stamps are in the privacy policy of the restaurant's online shop. The first name the kiosk uses to call you is deleted after 30 days, like any kiosk name. The link record is deleted 30 days after it ends. Failed scans are deleted after one day. These clean-ups are automatic: if they have not been done earlier, they are done in the next monthly run.
• Device data: while the restaurant keeps the kiosk registered and, after it is removed, as a record of the removal for as long as the service lasts (without the last IP address if the restaurant leaves the service).
• Web server access logs (IP address, date and page requested): 14 days. Application technical logs (errors and warnings, which may contain those same references): 30 days.
• Backups: database backups are encrypted and renewed automatically; the oldest is at most about three months old. The hosting provider also keeps full server images for the last 7 days. Deleted data remains in backups until they are renewed and is only used to restore the service after a failure.
• Stripe keeps payment data under its own policy.

8. Security

All communications are encrypted (HTTPS). Each device is identified by its own credential, stored encrypted on the device, which can be revoked at any time at the restaurant's request. Each restaurant can only see its own data, and each kiosk only the orders it placed itself. The kiosk runs in dedicated mode, with no way out to other apps, and its technical screen is PIN-protected. The kiosk's QR code changes every 10 seconds, each code expires after 30 seconds and each link only admits one person.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability. As the restaurant is the controller, please contact it first (its details are on your ticket). If you cannot, write to hello@stellartech.app: we will pass your request on to the restaurant and help it respond. If you did not scan the QR code, the order is anonymous: to find it we will need the restaurant, the date and time and the order number or code printed on your ticket. If you scanned it, we can also find it from your account.

You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country of residence.

10. Children

The app is not specifically aimed at children and does not ask them for any data: you can order without giving any.

11. Changes to this policy

If this policy changes, the new version will be published at this same address with a new update date. This is a translation of the Spanish version, which prevails in case of discrepancy. It is also available in Swedish.