Last updated and in force from 18 October 2026 · Version 1.1
This Privacy Policy explains how KuKA collects, uses, shares and protects personal data when you visit our websites, try the demo, run a restaurant on KuKA, work as restaurant staff, or sit at a table where a restaurant uses KuKA to take orders.
We process personal data under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Portuguese Law no. 58/2019. Cookies and similar technologies are also governed by Portuguese Law no. 41/2004 (ePrivacy).
1. Who is responsible for your data
KuKA is operated by Vírgula Majestosa Unipessoal, Lda, taxpayer no. (NIPC) 519131410, with registered office at Largo República da Turquia 6, Lumiar, Lisboa, Portugal ("KuKA", "we", "us").
Contact for any privacy matter: support@getkuka.com.
Our role depends on the situation:
- Controller for data about visitors to our websites, people who request the demo, business customers and their administrators, billing and invoicing data, security and operational logs, and landing-page statistics.
- Processor for data that a restaurant or franchise (our business customer) puts into KuKA or generates through KuKA about its diners, orders and staff. In that case the restaurant is the controller and we act on its documented instructions, as set out in the Data Processing terms in section 10 of the Partner Terms of Service.
If you are a diner and have a question about your order or your tab, please ask the restaurant first.
2. Scope of this policy
This policy covers the KuKA websites (getkuka.com, www.getkuka.com) and the KuKA application (app.getkuka.com), including the sign-up and demo pages, the backoffice, the staff screens and the guest pages opened from a QR code at a table. KuKA is available in English, European Portuguese and Brazilian Portuguese. The versions are intended to have the same meaning.
It does not cover websites or services run by others that we link to or that you reach from KuKA, such as Stripe Checkout. Their own policies apply there.
3. What data we collect
Visitors to our websites
- Technical data sent by your browser when a page loads: IP address, browser and device type (user agent), requested address, date and time. Our servers and network components record this in operational logs.
- Landing-page statistics: a random visitor identifier (stored in a cookie), the test variant shown to you (A or B), the page path, the referring site, campaign tags (utm_source, utm_medium, utm_campaign), clicks on our main call-to-action buttons, and whether a demo request was submitted or a demo was created. Requests that identify themselves as bots or link previews are not recorded as visits.
- Your language preference, and an approximate country indication supplied by our network edge (header CF-IPCountry) used only to choose a default language.
People who request a demo
- Full name, email address, venue name and a password (stored only as a hash).
- The date and version of the Partner Terms you accepted, and your optional tick-box "I want to follow KuKA's growth".
- Data about the demo itself: when it was created and expires, its status, sample-data events and your progress in the guided product tour.
Business customers and their administrators
- Account data: name, email address, password hash, time zone, role and access to franchises and restaurants, account status, date of acceptance of the Partner Terms, and email-confirmation status.
- Business data: franchise and restaurant names, menus, prices, images, tables, shifts and settings that you enter. An optional Portuguese tax number (NIF) may be provided at sign-up.
- Billing data: Stripe customer and subscription references, subscription status and dates, billing name, address, tax identification number and email as entered in Stripe Checkout, invoice number, amounts, VAT lines, and the status of fiscal invoice issuing and delivery.
- Communications: transactional emails (see section 6) and messages you send to support.
Restaurant staff
- Account data created by your employer or franchise administrator: name, email address, password hash, role and the restaurants you can access.
- Operational records: actions you take in the app that are recorded against your user, for example who closed a table tab.
- Security records: an access audit log of administrative events (such as access granted or revoked, SuperAdmin creation, recovery tokens and opening the observability console), including the acting and target user ids and emails, the franchise or restaurant concerned, and the time.
Diners at a table
- No name, email, telephone number or payment card details are requested by KuKA.
- A random guest identifier (cookie), the table you checked in to and when, items in your cart, your orders (items, quantities, status, time, paid or unpaid) and the resulting tab, and the menu or fixed-price option that applies.
- Browser and network data described under "Visitors".
4. Why we use data and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Operate and secure the websites and the app; detect abuse; keep operational logs | Technical data, account identifiers | Legitimate interests, Art. 6(1)(f): running a secure and reliable service |
| Handle demo requests, sign-up, email confirmation, sign-in and password reset | Name, email, password hash, venue name, tokens | Contract or pre-contractual steps, Art. 6(1)(b) |
| Provide the service to business customers (menus, tables, roles, staff screens) | Account and business data | Contract, Art. 6(1)(b) |
| Take and manage diners' orders and tabs for a restaurant | Guest identifier, table, cart, orders | Performed for the restaurant, which relies on the contract with its diner, Art. 6(1)(b). We act as its processor |
| Subscription billing, VAT, fiscal invoicing and accounting | Billing data, invoice data | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) (tax and accounting law) |
| Transactional emails: confirmation links, password reset, demo sign-in link, trial reminders, invoice delivery | Email address, name, links | Contract, Art. 6(1)(b) |
| Landing-page statistics and A/B testing, in aggregate | Visitor identifier, variant, page, referrer, campaign tags, clicks | Legitimate interests, Art. 6(1)(f): improving our public pages. Cookies are described in section 10 |
| Updates about KuKA's progress, only if you ticked the optional box | Name, email | Consent, Art. 6(1)(a). You can withdraw it at any time |
| Access audit log and platform administration | Actor and target user data, events | Legitimate interests, Art. 6(1)(f): protecting accounts and accountability |
| Monitoring and troubleshooting (logs, metrics, traces) | Technical data | Legitimate interests, Art. 6(1)(f) |
| Comply with law, respond to authorities, establish or defend legal claims | As needed | Legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests we have weighed them against your rights. You may object (see section 11).
We do not take decisions about you based solely on automated processing that produce legal or similarly significant effects. The A/B test only changes which version of our landing page you see.
5. Where the data comes from
- From you, when you fill in a form, use the app or contact us.
- From your employer or franchise administrator, who creates or invites staff accounts.
- From your device and browser, automatically, through cookies and server requests.
- From Stripe, which tells us about the status of a subscription, payments and the billing details entered at checkout.
- From the restaurant, for operational data such as menus, prices and table set-up that relate to guests.
6. Who receives data
We do not sell personal data. We share it only as needed, with the following recipients.
| Recipient | Role | Purpose | Location |
|---|---|---|---|
| Restaurant or franchise using KuKA | Controller (for diner and staff data) | Receives the orders and data created at its venue; its administrators see its staff accounts | Venue's choice |
| Stripe | Independent controller and our processor | Subscription checkout, card payment, billing portal, invoices and tax calculation. We do not receive or store full card numbers | EU/EEA and United States |
| Moloni, or another invoicing provider we configure | Processor | Issuing certified fiscal invoices for subscriptions and sending them by email, when invoicing is enabled | Portugal (Moloni) |
| Resend | Processor | Delivery of transactional emails | United States |
| Hostinger International Ltd. | Processor | Servers, database (PostgreSQL), storage of uploaded images, backups and our self-hosted monitoring tools | EU (Germany) |
| Google Fonts, jsDelivr and cdnjs (Cloudflare) | Independent controllers | Your browser loads fonts, icon sets and the SignalR script directly from them, so they see your IP address and user agent | Global / United States |
| Professional advisers, authorities | Controllers or processors | Legal, accounting and audit support; compliance with legal requests | Portugal / EU |
Our own platform administrators (SuperAdmins) can access the platform to provide support and security. Such access is limited by role and administrative actions are logged.
7. International transfers
Some of the recipients above, namely Stripe, Resend, Google and Cloudflare, are or may be located in, or may access data from, the United States. Where personal data leaves the European Economic Area we rely on an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified recipients) or on the Standard Contractual Clauses adopted by the Commission, together with supplementary measures where needed. Our hosting location is stated in section 6.
You may request a copy of the safeguards that apply by writing to us (section 14).
8. How long we keep data
We keep personal data only as long as necessary for the purpose it was collected for. The periods we can state precisely are below. For the others we state the criteria we apply.
| Data | Retention |
|---|---|
| Sign-in session cookie | Up to 8 hours, renewed while you are active |
| Password reset link | Valid for 1 hour |
| Administrator recovery token | Valid for 30 days unless used or revoked earlier |
| Demo session | Lasts 24 hours by default; when it expires the demo user is disabled automatically |
| Demo request records (name, email, venue, consent) | 12 months |
| Unconfirmed email on a new business account | Access allowed for a 30-day grace period after sign-up |
| Business customer account data | While the account is active and for 24 months after closure, unless the law requires longer |
| Invoices and accounting records | For the period required by Portuguese tax and commercial law (currently ten years) |
| Orders, tabs and guest data held for a restaurant | As instructed by the restaurant and until the agreement with the restaurant ends, then deleted or returned as described in the Partner Terms |
| Landing-page statistics | Visitor cookie: up to 365 days. Event records: 13 months |
| Access audit log | 12 months |
| Operational logs, metrics and traces | In our standard monitoring set-up: logs 7 days, traces 48 hours, metrics 30 days |
After the retention period data is deleted or irreversibly anonymised. Data needed to establish, exercise or defend legal claims may be kept until the claim is settled.
9. How we protect data
We apply technical and organisational measures appropriate to the risk. Measures that exist in the product today include:
- Encrypted transport: the production site is served over HTTPS and sends an HTTP Strict Transport Security header.
- Passwords are hashed with the ASP.NET Core Identity password hasher and are never stored or sent back in clear text. Demo sign-in tokens are stored only as hashes. Password reset links expire after 1 hour.
- The sign-in cookie is HttpOnly and SameSite=Lax. Forms are protected against cross-site request forgery with anti-forgery tokens.
- The keys used to protect cookies and tokens (ASP.NET Core Data Protection) are stored separately from the database on the server.
- Access is role-based and limited to the franchises and restaurants a user has been granted. Administrative access changes are written to an audit log.
- Our tracing configuration removes database statements from trace data. The monitoring console is available only to authenticated platform administrators.
- Card data is entered on Stripe's hosted pages, not on KuKA.
No system is completely secure. If a personal data breach is likely to put your rights at risk we will notify the CNPD within 72 hours of becoming aware, and tell affected individuals where the law requires it (GDPR Arts. 33 and 34).
10. Cookies and similar technologies
Cookies are small files stored in your browser. We use cookies and browser storage only as listed below. We use no advertising cookies and no third-party tracking cookies.
Cookies
| Name | Purpose | Duration | Type |
|---|---|---|---|
| KuKA.Auth | Keeps you signed in to the app | Up to 8 hours, renewed on activity | Strictly necessary |
| .AspNetCore.Antiforgery.* | Protects forms against cross-site request forgery | Browser session | Strictly necessary |
| .AspNetCore.Culture | Remembers your language | 1 year | Strictly necessary (preference you requested) |
| KuKA.Demo | Links your browser to your demo session | 24 hours by default | Strictly necessary |
| KuKA.CustomerId | Random guest identifier that links your cart, orders and tab at the table | 30 days | Strictly necessary for ordering |
| KuKA.Cart | Keeps the items in your cart | 7 days | Strictly necessary for ordering |
| KuKA.MenuExperience | Remembers the menu option (ordering style, fixed-price menu and drinks) chosen at the table | 7 days | Strictly necessary for ordering |
| KuKA.TablesSection | Remembers whether the Tables section on the restaurant page is open or closed | 1 year | Strictly necessary (preference you requested) |
| tt_landing_visitor | Random visitor identifier for anonymous landing-page statistics | 365 days | Analytics, first-party, not essential |
| tt_exp_welcome | Remembers which version (A or B) of the landing page you saw | 30 days | A/B test, first-party, not essential |
Browser storage
| Name | Purpose | Duration |
|---|---|---|
| localStorage "theme" | Remembers light or dark display | Until you clear it |
| sessionStorage "kuka-tour-step" | Remembers your place in the guided product tour | Until the tab closes |
| sessionStorage "staff-dashboard-tab" | Remembers the staff dashboard tab you last opened | Until the tab closes |
Third-party resources
Our pages load fonts and icon styles from Google Fonts and jsDelivr, and the SignalR script from cdnjs. These providers receive your IP address and user agent when your browser requests the files. They are not used by us for advertising or tracking.
Your choices
Strictly necessary cookies cannot be switched off without breaking the service. You can block or delete cookies in your browser settings; if you do, the two non-essential cookies will not be used for statistics, and the app may ask you to sign in again or lose your cart. The non-essential cookies listed above are limited to anonymous, first-party statistics and A/B testing.
11. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectification of inaccurate or incomplete data.
- Erasure ("right to be forgotten") where there is no longer a reason to keep the data.
- Restriction of processing in certain cases.
- Portability: receive the data you gave us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.
- Object to processing based on legitimate interests, on grounds relating to your situation.
- Withdraw consent at any time, without affecting earlier processing (for example the optional updates tick-box).
- Not to be subject to a decision based solely on automated processing with legal or similarly significant effects. We do not make such decisions.
To exercise a right, write to support@getkuka.com. We may ask you to confirm your identity. We answer within one month; in complex cases the period can be extended by up to two further months and we will tell you why. Exercising your rights is free unless a request is manifestly unfounded or excessive.
If you are a diner or a staff member, your request about data we process for a restaurant may be passed to that restaurant, which is the controller.
Complaints. You have the right to lodge a complaint with the supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt. You may also complain to the authority of the EU country where you live or work. If you are in Brazil, rights under Law no. 13.709/2018 (LGPD) may also apply and can be exercised through the same contact.
12. Children
KuKA is a business tool and is not directed at children under 16. We do not knowingly collect personal data from children. Guests are not asked for their age or identity; if a minor is at the table, the restaurant is responsible for who places the order. If you believe a child has provided data to us, contact us and we will delete it.
13. Changes to this policy
We may update this policy to reflect changes to the product, our providers or the law. The version number and date are at the top of this page. Where a change is material we will give a prominent notice in the product or on our website before it takes effect. Earlier versions are available on request.
14. Contact
Vírgula Majestosa Unipessoal, Lda, Largo República da Turquia 6, Lumiar, Lisboa, Portugal. NIPC 519131410.
Email: support@getkuka.com.
Related documents: Partner Terms of Service, Guest Terms of Service.