How to delete your data

This page explains how to request deletion of the data Fustesia stores about you and about your restaurant, and exactly what happens when you do. No sign-in is required, either to read this page or to exercise the right — below there is a route that works even if you have lost access to your account.

This is the right to erasure under Article 17 of the General Data Protection Regulation (GDPR, EU 2016/679). You can exercise it at any time, without giving a reason and at no cost.

1. What gets deleted

Deleting your account permanently and irreversibly removes:

• Your login account and its credentials.
• Every restaurant you own, along with its settings, branding and QR codes.
• Your entire menu: dishes, categories, descriptions, translations, prices and allergens.
• The operational data attached to those restaurants: orders, payment records, reservations, waiting list, loyalty, ratings, stock and push notification subscriptions.
• Every file you uploaded — dish photos, menu PDFs and images, logo — erased from our storage, not merely hidden.

This is not a soft delete. We do not flag the account as inactive and we do not keep anything “just in case”: the records are removed and the files disappear from storage. Afterwards there is no way to recover them, for you or for us.

2. How to request it

Three routes. The third exists precisely for people who can no longer sign in.

• Delete a single photo or dish. In your dashboard go to Menu → the dish → delete the photo or the dish. The image is removed from storage.
• Delete your whole account and all your data. In your dashboard go to Settings → Delete account. This performs exactly what section 1 describes.
• If you cannot sign in. Email us at fustesia.director@gmail.com from the address you signed up with, stating the name of your restaurant. We run the same deletion described in section 1 and confirm it to you in writing. We use the sending address solely to verify that the request is yours.

If you are a diner, not a restaurant owner

To read a menu and order at a table we ask for no name, no email and no phone number: the session is identified by a pseudonymous code held in your own browser. You can delete your data yourself from the menu, in the notifications panel (the bell icon), using the option to delete your data. That erases your ratings and your notification subscriptions, and removes the code from your browser.

Your orders are not deleted; they are unlinked from you (the association with your session is removed). An order is the record of a transaction for which the restaurant — not Fustesia — is the controller and which it needs for its accounts. After erasure that order can no longer identify you.

3. How long it takes

• From the dashboard: immediately. The deletion runs inside the request itself; once it finishes, the data is gone. You receive a confirmation email stating how many restaurants and files were removed.
• By email: without undue delay and in any event within one month of the request (Art. 12(3) GDPR). If the request is unusually complex that period may be extended by up to two further months, and we would tell you why within the first month.
• Backups: data disappears from production systems immediately, but may persist for up to 30 days in technical backups before automatic rotation. Those backups are kept solely for disaster recovery and are not read for any other purpose.

4. What is kept, and why

The right to erasure is not absolute: Article 17(3)(b) GDPR itself carves out processing that is necessary to comply with a legal obligation. At Fustesia that affects two things, and only two:

• Tax and accounting records, where invoicing has taken place. The law requires invoices and accounting entries to be retained for the statutory periods applicable at the main establishment — Germany: up to 10 years (§ 147 AO), and 4 to 6 years for operations under Spanish law — even after the account is deleted. Those documents are blocked: they are kept to satisfy that obligation and used for nothing else. Fustesia currently runs a free pilot phase and issues no invoices, so there is no invoice to retain and deletion is complete. This exception will start to apply once billing is switched on.
• Minimal audit records. We keep a record that an erasure request was received and executed, for the minimum period required to demonstrate that we handled it. That is a record of the event, not a copy of your data.

Payment data is processed entirely by Stripe Payments Europe, Ltd.; Fustesia never stores card numbers. Records Stripe must retain under its own legal obligations are governed by its policy, linked from our privacy policy.

5. Before deleting: take your data with you

Deletion is irreversible, so export anything you want to keep first. From your account you can download all of your data in a machine-readable format, exercising the rights of access and portability (Arts. 15 and 20 GDPR), at /api/account/export.

6. Contact and complaints

For any question about this page, or to exercise any other right (access, rectification, objection or restriction), write to fustesia.director@gmail.com. If you believe we have not handled your request properly, you may lodge a complaint with the supervisory authority of your country of residence. The competent authority and the rest of the processing detail are set out in our privacy policy.