Privacy Policy

Spevdo operates as the data processor on behalf of the restaurant (the data controller) you are ordering from. For questions about how a specific restaurant handles your data, please contact them directly.

When you place an order, we collect:

• Full name — to identify your order
• Phone number — for order verification (OTP) and delivery communication
• Email address (optional) — for order confirmation
• Delivery address and GPS coordinates — to verify delivery zone and dispatch your order
• Order history — items ordered, amounts, dates
• Preferences — saved channel preference (delivery/takeaway/dine-in), theme

We process your data based on:

• Contract performance — processing your food order requires your contact and delivery details
• Consent — saving your details for future orders (optional, you can decline)
• Legitimate interest — fraud prevention and service improvement

We use browser local storage (similar to cookies) to:

• Essential (always active): language preference, theme preference, authentication session
• Functional (with your consent): saved customer details (name, phone, address), channel preference, phone verification token

You can choose to allow only essential storage. If you do, you'll need to re-enter your details for each order.

We share data with the following service providers:

• Infobip — for SMS phone verification (phone number only)
• Viva Wallet — for secure payment processing (card details handled directly by Viva Wallet)
• Cloudflare — content delivery and image hosting
• Mapbox — the delivery address you provide at checkout is sent to Mapbox for geocoding (temporary storage only), and the delivery coordinates of your order are sent to the Mapbox Directions API for delivery-ETA routing
• Google Maps — the delivery address you type when you check whether the restaurant delivers to you, or at checkout, is sent to Google for address suggestions; if you tap “Use my location”, your device’s current location is sent to Google to find its address; and the coordinates of the delivery location you choose are sent to Google to show it on a map
• Google, Apple, Facebook — if you choose to sign in with one of these accounts: your account id at that provider, your email (with Apple this can be a private relay address that forwards to you) and your name. For Apple we may also keep an encrypted Apple refresh token, used only to revoke Spevdo's access when you delete your account

With your consent to non-essential cookies, we share certain identifiers with Meta Platforms Ireland Ltd. to measure and improve advertising effectiveness, via the Meta Pixel (in your browser) and the Meta Conversions API (server-to-server). Personal identifiers — email, phone, name, and, for delivery orders, your approximate location (city and postal code) — are irreversibly hashed (SHA-256) before they are sent to Meta (in your browser by the pixel, and on our servers for the Conversions API); we also share technical identifiers (Meta's _fbp/_fbc cookies, IP address, and user-agent). If you use a restaurant's own mobile app and that restaurant has set up Meta, the Meta SDK in the app also sends Meta the events that the app was installed, that it was opened, and the amount of each completed order, together with your device's advertising identifier (the Google advertising ID on Android, or the IDFA on iPhone), an app-specific identifier that the Meta SDK stores in the app, and basic device information. On iPhone, this happens only if you also allow tracking when the app asks. We do not share any of this data if you have not accepted non-essential cookies, and you can withdraw your consent at any time from the cookie settings, which stops all further sharing. For collecting this data and sending it to Meta, the restaurant and Meta Platforms Ireland Ltd. are joint controllers; after Meta receives the data, Meta is an independent controller and processes it under its own privacy policy (https://www.facebook.com/privacy/policy). Meta publishes the main points of the joint-controller arrangement at https://www.facebook.com/legal/controller_addendum, and you can exercise your rights for Meta's processing directly with Meta.

When a restaurant has enabled Google Analytics or Google Ads, we use Google Consent Mode v2. Before you accept non-essential cookies, Google's tag runs in a restricted mode: it stores and reads no cookies on your device, does not use your data for advertising personalisation, and strips advertising click identifiers. It sends only limited, cookieless measurement signals that Google uses in aggregate to estimate overall traffic and conversions without identifying you; your IP address is shared with Google's servers as a technical requirement of any internet request and is not used to identify you. When you accept non-essential cookies, full analytics and advertising measurement, including cookies, is enabled. You can withdraw your consent at any time from the cookie settings, which turns Google's cookies and tracking back off.

We retain your data for the following periods:

• Order data: 5 years (Greek tax law requirement)
• Customer profile: until 24 months after your last order at this restaurant, or earlier if you request deletion. If the restaurant has blocked your number, the profile is kept while the block applies
• Local storage data: until you clear your browser data or withdraw consent
• SMS verification code: valid for 5 minutes
• Phone verification token (issued after you enter the code): valid for 2 hours
• Verified phone record: until 24 months after the phone's last SMS verification, or until you delete your Spevdo account. Once you verify your phone by SMS, every Spevdo restaurant trusts it, so you are not asked for a new code. We keep this record if you ask one restaurant to delete your data.

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Receive your data in a portable format
• Restrict processing of your data
• Object to processing of your data
• Withdraw consent at any time

You can exercise your rights using the "Manage Your Data" section below, or by contacting us at hello@spevdo.eu.

We implement appropriate technical and organizational measures to protect your personal data, including encrypted connections (TLS), access controls, and regular security reviews.

For any privacy-related questions or to exercise your data rights, contact us at:

hello@spevdo.eu