Privacy Policy

TapKio provides restaurant kiosk software and related services. Where Restaurants use TapKio to take customer orders, the Restaurant is the controller of customer personal information and TapKio acts as a processor on the Restaurant's behalf. TapKio is the controller of Restaurant account information and limited operational telemetry.

Order content: items selected, modifiers, totals, taxes, tips, order references, timestamps, kiosk identifier, and staff confirmation status.

Optional customer contact: name, phone number, and/or email if the customer provides it for order updates, receipts, or loyalty.

Device and usage data: IP address, device identifiers, browser or kiosk app type and version, language, time zone, referring URLs, and basic analytics about kiosk and dashboard usage (page views, button taps, error reports).

Restaurant account data: business name, address, contact information, billing details, menu and configuration data, staff accounts, and support correspondence.

Cookies and similar technologies: session and preference cookies, and limited first- or third-party analytics cookies on the TapKio marketing website.

To process and display orders on the kiosk and the staff confirmation dashboard.

To send optional order status updates or receipts to a customer who has provided contact information and consented.

To operate, secure, troubleshoot, and improve the Services, including fraud and abuse prevention.

To provide customer support and to communicate with Restaurants about the Services.

To comply with legal obligations, respond to lawful requests, and enforce our Terms.

To produce aggregated or de-identified analytics that do not identify any individual.

Where the GDPR or UK GDPR applies, we process personal information on the bases of contract performance, our legitimate interests in operating and improving the Services and securing them against abuse, consent (for optional contact and marketing communications), and compliance with legal obligations.

TapKio does not collect, transmit, or store credit card numbers, PINs, CVVs, or bank credentials in direct-payment configurations. Payments are made through third-party payment apps (such as Zelle, Cash App, Venmo, Apple Pay, Google Pay, or local payment apps) directly between the customer and the Restaurant. Those providers have their own privacy policies, which we encourage you to review.

We share information with: (a) the Restaurant operating the kiosk; (b) service providers under contract who help us run TapKio (hosting, error monitoring, analytics, SMS/email delivery, support tools); (c) professional advisors and auditors; (d) authorities or other parties when required by law or to protect rights, property, or safety; and (e) a successor in interest in connection with a merger, acquisition, financing, or sale of assets. We do not sell personal information.

TapKio is operated from the United States and may use service providers in other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to transfer personal information across borders.

We retain order and analytics data for as long as needed to provide the Services, support reconciliation and reporting for the Restaurant, meet legal and tax requirements, and resolve disputes. Restaurant account data is retained for the life of the account and for a reasonable period after closure for backups, accounting, and legal recordkeeping. De-identified or aggregated data may be retained indefinitely.

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, including TLS in transit, encryption of credentials at rest, role-based access, and access logging. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Customers may decline to provide optional contact information and may opt out of optional SMS or email notifications.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information, to object to certain processing, and to withdraw consent. For customer data captured at a Restaurant's kiosk, please contact that Restaurant first; we will support the Restaurant in honoring valid requests. For Restaurant account data, contact TapKio at the address listed on our website.

California residents (CCPA/CPRA) have rights to know, delete, correct, and limit the use of sensitive personal information, and to be free from discrimination for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

Our marketing website uses a limited set of cookies for site operation and basic analytics. You can control cookies through your browser. We currently do not respond to Do Not Track signals because no industry standard has been finalized. Kiosk software does not use third-party advertising cookies.

If a Restaurant enables SMS or email order updates, customers must opt in before receiving them. Message and data rates may apply. Customers may opt out at any time by replying STOP to SMS or using the unsubscribe link in email. Marketing messages, where offered, follow applicable consent and opt-out laws including the U.S. TCPA and CAN-SPAM Act, and CASL where applicable.

The Services are built for restaurant ordering and are not directed to children under 13 (or the applicable age in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have, please contact us so we can delete it.

Our website and kiosks may link to third-party sites or apps (e.g., app de pago providers). We are not responsible for those parties' privacy practices.

We may update this Privacy Policy. Material changes will be reflected on this page with a revised "last updated" date and, where appropriate, additional notice.

Privacy requests and questions can be sent to the email hello@tapkio.com.