Draft — needs review by a lawyer before publication. Fields in brackets, e.g. [Company name], must be filled in.
Cookie policy
Last updated:
We only use what the Service needs to work: keeping you logged in, letting the menu remember your language, not losing the cart. We have no analytics, advertising or social media cookies. Visits to the public pages are counted without cookies.
Language. This is an English translation of the Greek original, provided for convenience. If the two versions differ or conflict, the Greek version prevails.
Contents
1. In short
- Only strictly necessary cookies, all of them our own (first-party).
- Local storage on the device for the cart, the anonymous identifier and working without signal.
- Visit statistics on the public pages only, with Umami: no cookies, and nothing that recognises you. No Google Analytics, no advertising pixels.
- That’s why we don’t ask for your consent. On the pages of this website we only show a small information message, once.
2. What cookies and local storage are
Cookies are small files that the browser stores for a website. Local storage (localStorage) and the app’s cache (Cache Storage) are similar spaces on your device that a website uses to remember things or to open without a connection. The law treats them in the same way.
3. The cookies we use
| Cookie | Why | Duration | For whom |
|---|---|---|---|
authjs.session-token (on HTTPS: __Secure-authjs.session-token) | Keeps the owner and staff logged in to the dashboard. | Until logout, up to 30 days | Owners and staff |
authjs.csrf-token (on HTTPS: __Host-authjs.csrf-token) | Protects login against forged requests (CSRF). | Until the browser is closed | Owners and staff |
authjs.callback-url (on HTTPS: __Secure-authjs.callback-url) | Remembers which page to take you back to after you log in. | Until the browser is closed | Owners and staff |
bo_locale | Remembers the language the guest chose in the menu. | 1 year | Guests |
bo_ref | When someone opens a referral link (/r/…), it keeps the code so that both businesses get the reward when they sign up. | 30 days | New businesses from a referral |
bo_view | Only for authorised Ombrelo staff during support access: sets which account is being accessed and that the access is read-only. | 2 hours | Ombrelo support staff |
All of them are necessary for a feature that you ask for. None is used for advertising or for tracking you on other websites.
4. Local storage on the device
On the guest’s phone (menu from the QR code)
bo:guest: an anonymous, random identifier, so that the guest can see their orders and the bill for their spot.bo:cart:…: the cart, so it is not lost if the page closes or the signal drops.bo:allergens: the allergen filters the guest chose.- Recent questions to the AI waiter, the phone country for notifications, and whether the guest has already left a rating, so we don’t ask again.
- Orders waiting to be sent while there is no signal, and the app’s files so that the menu opens quickly.
The anonymous identifier also accompanies anonymous menu usage events (e.g. which dish was opened), which give the business aggregate statistics. These are not shared with third parties, not combined with other websites and not used for advertising. [A lawyer to confirm that this use is covered without consent]
On staff devices
- The orders on the kitchen and bar screens and the printer settings, so they keep showing if the connection drops.
- Whether you closed a message (e.g. about the subscription or installing the app), so that it does not appear again.
On this website
bo:cookie-info: that you closed the cookie information message.
5. Third-party cookies at payment
When the guest pays by card, Apple Pay or Google Pay, Stripe’s payment form may store its own necessary cookies for fraud prevention. These are set by Stripe and governed by Stripe’s policy. We do not use them.
6. Visit statistics without cookies
To know how many people visit the website and where they come from, we count visits with Umami. Umami sets no cookies, stores nothing on your device and does not recognise you from one visit to the next or across websites.
- Where: only on the public pages (home, pricing, partners, legal texts, sign-up). Never on a venue’s menu, in a venue’s account or in the admin.
- What we count: the page, where you came from (e.g. a search), the type of browser and device, the language and the country. The IP address is not stored.
- What we don’t do: we build no profiles, give nothing out for advertising and never combine it with your account.
- If your browser sends “Do Not Track”, we count nothing at all.
7. Why we don’t ask for consent
Under Article 4(5) of Greek Law 3471/2006 (which transposes Article 5(3) of Directive 2002/58/EC), consent is not needed for storage that is strictly necessary to provide a service you have explicitly asked for: to log in, to see the menu in your language, to order and to pay. This is also confirmed by the guidelines of the ΑΠΔΠΧ (the Hellenic Data Protection Authority) and of the European Data Protection Board.
Because we use nothing else, there is nothing to consent to or refuse, and a consent pop-up would just be an obstacle. The visit statistics store and read nothing on your device beyond what the browser sends with every page. [A lawyer to confirm that counting visits without cookies needs no consent (EDPB Guidelines 2/2023 on Article 5(3))] If we ever add a tool that stores something on the device for analytics or advertising, we will ask for your consent first and update this page.
8. How to control or delete them
You can view and delete cookies and local storage in your browser’s settings (usually under “Privacy” or “Site data”). If you delete them, you will need to log in again, and the cart and your preferences in the menu will be lost. For questions: [email]. See also the Privacy policy.
9. Changes
If we change anything, we will update this page and the date at the top.