Who processes your data
Mesa Clara, the developer and published app name, with a contact address in Madrid, Spain, is responsible for data collected directly by the app, this website, commercial enquiries and platform administration. Contact us at hola@mesaclara.es.
When a diner books, places an order or interacts with a restaurant through Mesa Clara, the restaurant shown on that page is the data controller. Mesa Clara provides the technical infrastructure and processes that data on the restaurant’s instructions.
Data the app may collect
- Account and authentication data: name, email address, user ID, restaurant, role and session tokens. Tokens are encrypted on the device with Android Keystore.
- Restaurant operations data entered or viewed in the app, including orders, menu items, tables, reservations, diner names and phone numbers, notes and staff accounts.
- Dish images that an authorised user explicitly selects from the device to publish on the menu.
- Billing details and payment metadata. Full payment card details are processed by the payment provider and are not stored by Mesa Clara.
- Technical and security data such as IP address, app version, API requests, access logs and error information.
- A Firebase Cloud Messaging device token linked to the account, restaurant and role so operational alerts reach the correct device.
The app does not request location, contacts, camera, microphone, SMS, call logs, advertising identifiers or an inventory of installed apps. It contains no third-party advertising or analytics SDK.
Purposes and legal bases
Authenticate users and synchronise orders, kitchen, tables, menus, reservations and staff according to each user’s role. The legal basis is performance of a contract or pre-contractual steps.
Respond to support, commercial and account requests. The basis is your request and, where applicable, consent.
Prevent fraud, diagnose incidents and protect the service. The basis is our legitimate interest in operating a secure and reliable service.
With permission, we use Firebase Cloud Messaging to send alerts for new kitchen orders or dishes ready to serve. We do not use this permission for advertising.
We do not use app data for automated decisions that produce legal or similarly significant effects.
How long data is retained
We retain data while the account or contractual relationship remains active and for any additional period required to meet legal obligations or handle claims. Security logs are retained only as long as needed to detect and investigate incidents. Data is then securely deleted or anonymised.
Your privacy rights
You may request access, correction, deletion, restriction, objection or portability, and withdraw consent at any time. Email hola@mesaclara.es with “Data protection” and the right you wish to exercise. We may request reasonable information to verify your identity.
You may also lodge a complaint with the Spanish Data Protection Agency ↗ or your local supervisory authority.
Delete your account and data
A restaurant owner can delete staff accounts from the app’s “Equipo” section. You may also request deletion of your account and associated data by emailing hola@mesaclara.es. If your account belongs to a restaurant, you may contact its owner or administrator. We delete the data unless temporary retention is required by law, fraud prevention or legal claims.
Device permissions and local storage
The app uses Internet access to synchronise restaurant operations with Mesa Clara servers and may request permission to display notifications. It stores encrypted session tokens and essential technical preferences locally. It does not use local storage for advertising or cross-app tracking.
Security, children and changes
We use technical and organisational safeguards, HTTPS in transit and encrypted token storage. The professional app is not directed to children. We may update this policy when the app, providers or law changes; the current version and update date will remain available here.