Privacy Policy

FLATERZ LTD, company number 16355392, Registered in England and Wales. Privacy contact: hello@qarta.online.

For restaurant account data we act as controller. For menu content a restaurant uploads and for diner questions asked inside its menu, we act as processor on that restaurant's instructions.

• Restaurant accounts: name, email address and sign-in records, used to create and secure the account.
• Menu content: dish names, descriptions, prices, allergen and dietary labels, photographs of printed menus, dish photos, logo and dining room reference photos.
• Diner use of a menu: the language your browser requests and the questions you type into the table assistant. Opening a menu does not require an account and we do not ask diners for their name, email or payment details.
• Technical records: server and security logs such as IP address, timestamp and requested page, kept to run and protect the service.

We ask restaurants not to upload photographs in which staff or guests are identifiable. We do not use facial recognition and we do not build profiles of diners.

• Contract (Art. 6(1)(b)): creating accounts, publishing menus, transcribing and translating menu content, generating polished dish photos, answering diner questions about the menu.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, fixing faults and improving reliability.
• Legal obligation (Art. 6(1)(c)): accounting and tax records, and responding to lawful requests.
• Consent (Art. 6(1)(a)): optional marketing emails, which you can withdraw at any time.

Qarta sends menu photographs, dish text and dish photos to AI providers to transcribe menus, translate text and adjust photo lighting, white balance, exposure and background. Image processing only adjusts these presentation qualities; it does not add, remove or change food or ingredients.

Diner questions typed into the table assistant are sent to an AI provider together with the published menu so an answer can be produced. Do not type personal or health details into the assistant; ask the restaurant staff directly for allergy advice.

We instruct our AI providers to process this content only to return a result to us. Our current providers are listed on the subprocessors page.

We share data only with the service providers listed on our subprocessors page, and with advisers or authorities where the law requires it. We do not sell personal data.

Some providers are located outside the EEA. Where that is the case we rely on the European Commission's Standard Contractual Clauses together with additional technical and organisational safeguards.

• Account and menu content: for as long as the account is active.
• After an account is closed: deleted or anonymised within 90 days, except records we must keep for accounting or legal reasons.
• Security and server logs: a short rolling period, normally up to 12 months.
• Table assistant messages: kept only as long as needed to produce the answer.

You may request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Where processing rests on consent you may withdraw it at any time. Write to hello@qarta.online and we will respond within one month.

If a restaurant published content about you, we will pass your request on to that restaurant as the controller of the menu content.

You may also complain to the Information Commissioner's Office (ICO), UK - ico.org.uk.

Access to menu data is restricted per restaurant account by database access rules, traffic is encrypted in transit, and dish media is served through controlled links. No online service can be guaranteed to be free of risk; report a suspected issue to hello@qarta.online.

Qarta accounts are for businesses. We do not knowingly create accounts for people under 16 and diner menus do not require an account.

We will update this page when our processing changes and will move the date at the top. Material changes affecting restaurant accounts will also be sent by email.