Privacy Policy

Last updated: 4 October 2026

This privacy policy explains how we process personal data when you visit our website tap2.menu, use our application at app.tap2.menu (together the "Services"), or contact us. It is designed to meet the requirements of the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Controller and contact

The controller responsible for processing your personal data is:

tap2.menu by Lightforged One
Speerstrasse 7
8305 Dietlikon
Switzerland
Email: privacy@tap2.menu

For all questions about data protection and to exercise your rights, please contact us at the address above. We have not appointed a data protection officer, as we are not legally required to do so.

2. Restaurants and their guests

tap2.menu is used by restaurants to let their guests view menus, order and pay. When guests order at a restaurant, we process the related data (e.g. order contents, table, payment status) on behalf of that restaurant. For this processing, the restaurant is the controller and we act as its processor. Guests can contact the restaurant directly about their data; we support restaurants in responding to such requests. Restaurants can request a data processing agreement from us.

This privacy policy covers the processing for which we ourselves are responsible, in particular the website, restaurant accounts and our own communication.

3. What data we process

• Website visits: when you visit our website, our servers and our content delivery network automatically record technical data such as your IP address, date and time of access, the page requested, referrer, browser type and operating system (server log files).
• Account and restaurant data: when you register, we process your name, email address, password (in encrypted form), phone number if provided, and information about your restaurant such as name, address, menus, prices, images and tables.
• Order and payment data: orders, amounts, tips and fees, and payment status. Card details are entered directly with our payment provider Stripe; we do not see or store full card numbers.
• Communication data: when you contact us by email, we process your email address, your message and any information you choose to include.
• Usage data: information about how the Services are used (e.g. pages and features used, interactions, errors), insofar as you have consented to analytics.

4. Purposes and legal bases

We process personal data for the following purposes:

• To provide, operate and secure the Services, including your account, orders and payments (Art. 6(1)(b) GDPR, contract; Art. 6(1)(f) GDPR, legitimate interest in secure and stable operation).
• To communicate with you, answer enquiries and provide support (Art. 6(1)(b) and (f) GDPR).
• To send transactional emails such as account confirmations, password resets and receipts (Art. 6(1)(b) GDPR).
• To analyse and improve the Services, only with your consent (Art. 6(1)(a) GDPR).
• To send newsletters or marketing information, only with your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time.
• To comply with legal obligations, in particular accounting and tax retention requirements (Art. 6(1)(c) GDPR).
• To protect against fraud and abuse and to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR).

Under Swiss law, we process personal data in accordance with the principles of the FADP; where required, we rely on the justifications above (performance of a contract, overriding interests, consent or legal obligation).

5. AI-assisted features

Some features of the app use artificial intelligence, for example to help create or translate menu texts. When you use such a feature, the content you submit for it (e.g. texts or images) is transmitted to the AI providers listed in section 7 to generate the result. Only the content needed for the feature is transmitted. Please do not enter personal data of other people into AI features unless necessary. AI output can be inaccurate; please review it before publishing. We do not use AI to make decisions that have legal or similarly significant effects on you.

6. Cookies and analytics

We use cookies and similar technologies that are strictly necessary for the Services to work, such as cookies that keep you signed in or store your language preference. These do not require consent.

With your consent, we use Google Analytics and PostHog to understand how the Services are used and to find errors. These tools may set cookies and process information such as pseudonymised identifiers, device and browser information, approximate location derived from your IP address, and your interactions. You can withdraw your consent at any time with effect for the future, for example via the cookie settings or by deleting cookies in your browser.

Our marketing website itself loads its fonts and icons from our own servers and does not use analytics.

7. Service providers and other recipients

We use carefully selected service providers who process personal data on our behalf and only according to our instructions:

In addition, we may disclose personal data to authorities, courts or advisers (e.g. lawyers, accountants) where we are legally required to do so or where it is necessary to protect our rights. We do not sell personal data.

8. Transfers abroad

We are based in Switzerland, and some of our service providers process data in the European Union, the United States or other countries. Where data is transferred to a country without an adequate level of data protection as recognised by the Swiss Federal Council or the European Commission, we ensure appropriate safeguards. These are, in particular, the certification of the recipient under the EU-U.S. Data Privacy Framework and its Swiss-U.S. extension, or the EU Standard Contractual Clauses (with the adaptations required under Swiss law). You can request a copy of the relevant safeguards from us.

9. Retention

We keep personal data only as long as necessary for the purposes described above. Account and restaurant data are kept for as long as your account exists and are deleted or anonymised after it is closed, unless we are legally required to keep them. Server log files are kept only for a short period for security purposes. Accounting records and business correspondence are kept for the statutory retention period of up to ten years. Data processed on the basis of consent is deleted when you withdraw your consent, unless another legal basis applies.

10. Data security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. This includes encrypted transmission (HTTPS), access controls and encrypted storage of passwords. No method of transmission over the internet is completely secure, but we work continuously to protect your data.

11. Your rights

Subject to the applicable law, you have the right to:

• request access to the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict the processing of your data;
• receive your data in a structured, commonly used and machine-readable format, or have it transferred to another controller (data portability);
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, please contact us at privacy@tap2.menu. We may ask you to verify your identity. You also have the right to lodge a complaint with a data protection supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch). In the EU/EEA, you can contact the supervisory authority in your country of residence or place of work.

12. Obligation to provide data

You are not obliged to provide personal data. However, some data is required to create an account and to use the Services; without it, we cannot provide them.

13. Children

Our Services are directed at restaurants and businesses and are not intended for children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so that we can delete it.

14. Changes to this privacy policy

We may update this privacy policy to reflect changes to our Services or to legal requirements. The version published on this page applies. Where changes significantly affect you, we will inform you in an appropriate way.