hellozlou is a table-service system for restaurants, beach clubs and mountain venues. This policy explains how we handle information in our role as a data processor on behalf of the venues that use our service.
1. Who we are
hellozlou operates the hellozlou platform. For any privacy questions, please contact us at info@hellozlou.com.
2. What we collect and why
We process only the minimum information needed to run an order:
- Order details — items ordered, quantities, notes, price snapshots, table or session identifiers, and the time the order was placed, and whether it has been entered into the venue's register.
- Session identifiers — the table QR code or session number a guest is using, so staff can deliver to the right place.
- Contact form submissions — name, venue name, phone number and message when a prospective venue writes to us through the website.
- Service requests — the type of request, such as water or the bill, the table, and when it was made, claimed and completed.
- Guest feedback — the star rating, an optional comment, and the table and time it relates to.
- Tips — the percentage a guest chooses and the amount a waiter records.
- Staff accounts — the name, email and role of each team member the venue adds, and their name next to the requests, orders and tips they handle.
- Notification records — the Telegram messages sent to the venue's groups for each order and request, kept so they can be updated when the order or request changes.
- Error reports — when something goes wrong in the app, a technical report with the page and the venue it happened on. Order contents, prices, names and email addresses are not included.
Guests never create accounts, log in, or provide an email address to place an order.
3. Our role as a processor
The venue is the data controller for guest order data. hellozlou processes that data on the venue's instructions and under a data-processing relationship. We delete guest data whenever the venue asks us to.
4. How long we keep data
Guest data is kept while the venue uses hellozlou and is deleted whenever the venue asks us to. Contact form data is kept for as long as needed to respond and follow up, then removed.
5. Sharing and security
We do not sell guest data. Order data is shared only with the venue's own staff and the notification channels (such as Telegram groups) the venue has configured. We use a small number of service providers to run hellozlou: Supabase (database), Lovable (website hosting), Telegram (staff notifications), Sentry (error reports, stored in the EU) and Whop (licence payments by venues). Each receives only what it needs for its part. We use encryption in transit, access controls, and row-level security in the database to protect information.
6. Your rights
Under GDPR, data subjects may ask the venue in question to access, correct, delete, or restrict their data. If you need our help with a request, or if you have questions about how we process data, please write to info@hellozlou.com.
7. Cookies
The marketing site and ordering flow do not set non-essential cookies. We may use a single functional cookie or localStorage value to remember a guest's language preference, but this is not used for tracking or advertising. The video on our homepage is hosted on YouTube and only loads when you press play; from then on YouTube's own privacy policy applies.
8. Changes
We may update this policy as the service evolves. If the changes are material, we will note the update date at the top of this page.