Privacy policy
Last updated: October 18, 2026 · Version 2.3
This policy explains how we process personal data when you visit kwibli.com, when a business uses Kwibli, and when you, as a customer, scan a QR code to leave a tip, book, give feedback or use a loyalty card. It follows Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). The Spanish version prevails in case of discrepancy.
Contents
1. Data controller
- Trade name
- Kwibli
- Owner
- [NOMBRE Y APELLIDOS DEL TITULAR PENDIENTE]
- Tax ID (NIF)
- [NIF PENDIENTE]
- Address
- [DOMICILIO FISCAL PENDIENTE — calle, número, código postal, ciudad, España]
- Contact email
- hello@kwibli.com
- Privacy email
- privacy@kwibli.com
- Website
- kwibli.com
We are not required to appoint a Data Protection Officer (art. 37 GDPR and art. 34 LOPDGDD). For any privacy question, email privacy@kwibli.com.
2. Who this applies to and our role
Businesses (Partners). If you create a Kwibli account for your business, we are the controller of your account, billing and platform usage data.
Customers of businesses. When you book, leave feedback or join a business’s loyalty programme (and for the staff data the business publishes), that business is the controller of your data and Kwibli acts as its processor (art. 28 GDPR), processing the data only on its instructions. You can exercise your rights with the business or with us: if you contact us, we will pass your request on and help the business respond.
We are always the controller of the data we process for our own purposes: security and fraud prevention, calculating and invoicing our commission, keeping evidence of card-guarantee consent, service statistics, handling contact requests and meeting legal obligations.
Visitors to kwibli.com: we are the controller of browsing data and of contact or demo request forms.
Payments are processed by Stripe, which acts as an independent controller for certain payment data under its own privacy policy.
3. What data we process and where it comes from
| Category | Data | Source |
|---|---|---|
| Business account | Name, email, password (handled by Firebase Authentication; we never see it) or your Google profile if you sign in with Google; business name, address, phone and branding; menus, photos and content; date and version of Terms acceptance. | You |
| Business payouts | Stripe Connect account ID and status. Identity and bank details needed to verify the account are collected directly by Stripe. | You and Stripe |
| Commission invoicing | Legal name, tax ID, registered address and commission amounts. | You and the platform |
| Bookings | Name, email, phone, date, time, party size, table, special requests, booking status and source (web or QR). | You or the business |
| Card guarantee (no-show) | Card details are collected by Stripe; we only store Stripe identifiers, the amount, the date/time and IP address of your consent and the exact policy text you accepted. | You and Stripe |
| Tips | Amount, currency, recipient (business or staff member name), optional note and name, email if you ask for a receipt, and Stripe payment identifiers. | You and Stripe |
| Loyalty | Email (optional, to recover your card on another device), stamps, redeemed rewards and an identifier stored in a cookie. | You and the business |
| Wallet passes | Pass serial number, points or balance, usage history and, if you add it to Apple Wallet, the device identifier and push token registered by Apple; Google Wallet pass ID; email if you ask us to send you the link. | You, Apple and Google |
| Feedback | Rating, comment and improvement areas, anonymously (we do not ask for or store your name). | You |
| Business staff | Name, photo, bio, specialties and schedules of staff the business publishes for bookings and tips (for minors, with guardian authorisation). | The business |
| Contact and demo | The data you include in the form (name, email, business, message). | You |
| Technical data | IP address, browser, device, server logs and error reports. Aggregated event counts (QR scans, menu views) that do not identify you. | Your device |
| Analytics (with consent) | Google Analytics for Firebase identifiers, page views and interactions. | Your device |
Fields marked as required are needed to provide the service (for example, to confirm a booking). Please do not include unnecessary health information in special requests; if you tell us about an allergy or intolerance, it will be processed with your explicit consent and only so the business can cater for you.
4. Purposes and legal bases
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Creating and managing business accounts, providing the platform and support. | Performance of a contract (6.1.b). |
| Calculating, invoicing and accounting for our commission; tax and accounting obligations. | Legal obligation (6.1.c). |
| Processing the tip you choose to leave and sending you a receipt if requested. | Performance of the contract or transaction you request (6.1.b). |
| Managing bookings on behalf of the business: confirmations, changes, cancellations and reminders. | Performance of the contract between you and the business (6.1.b), as processor. |
| Saving your card as a guarantee and charging it if you do not show up or cancel late, under the policy you accepted. | Performance of a contract (6.1.b). |
| Keeping evidence of that consent (date, IP and accepted text) to handle complaints and chargebacks. | Legitimate interest in defending claims (6.1.f). |
| Managing your loyalty card or wallet pass and its updates. | Performance of the contract for the programme you join (6.1.b). |
| Saving your email so you can recover your loyalty card on another device (never for advertising). | Consent (6.1.a), which you can withdraw. |
| Collecting your anonymous feedback so the business can improve its service and show it, without identifying you, on its public page. | Legitimate interest of the business (6.1.f). |
| Digitising and translating menus with artificial intelligence (Google Gemini) at the business’s request. | Performance of the contract with the business (6.1.b). |
| Security, fraud prevention, error monitoring and aggregated service statistics. | Legitimate interest (6.1.f) in protecting and improving the platform. |
| Measuring website usage with Google Analytics for Firebase. | Consent (6.1.a and art. 22.2 LSSI-CE). |
| Sending customer businesses news and information about Kwibli services. | Legitimate interest and art. 21.2 LSSI-CE; you can object at any time. |
| Replying to contact messages and demo requests. | Pre-contractual steps (6.1.b) or legitimate interest (6.1.f). |
| Handling rights requests and requests from authorities. | Legal obligation (6.1.c). |
We do not sell personal data or send our own advertising to businesses’ customers. We do not make decisions based solely on automated processing that produce legal effects on you (art. 22 GDPR). No-show charges are decided by the business.
Where we rely on legitimate interest, we have assessed that your rights do not override it; you can ask us for more information or object.
5. Recipients and processors
The business you interact with receives your booking, tip, feedback and loyalty data.
We use the following providers, with whom we have (or have accepted) data processing agreements:
| Provider | Service |
|---|---|
| Stripe | Processing tips, card guarantees and no-show charges; businesses’ payout accounts. PCI DSS Level 1 certified. |
| Google (Firebase) | Sign-in, image and file storage and, with your consent, analytics (Google Analytics for Firebase). |
| Google (Gemini API) | Automatic extraction and translation of menus uploaded by businesses. |
| Google (Wallet) | Issuing and updating Google Wallet passes. |
| Google (Maps and Fonts) | Maps and fonts loaded from Google servers on some business pages; Google receives your IP address. |
| Supabase | Database and file storage. |
| Vercel | Web hosting and content delivery network. |
| Sentry | Server error monitoring. |
| Resend | Sending transactional emails (confirmations, receipts, links). |
| Apple | Updating Apple Wallet passes through push notifications. |
We may also disclose data to the Spanish Tax Agency, courts or other authorities where legally required, and to professional advisers bound by confidentiality. We only respond to requests from authorities made in writing, through an official channel and with a sufficient legal basis; we may refuse requests that do not meet these conditions.
If the Kwibli business is transferred to a company, sold or reorganised, data may be transferred to the new owner, which will follow this policy or one that protects your data at least as well (legitimate interest, art. 6.1.f GDPR). We will announce it in this policy and by email to Partners before the transfer.
6. International transfers
Some of these providers (or their sub-processors) are located in the United States or other countries outside the European Economic Area. Such transfers rely on the EU-US Data Privacy Framework adequacy decision (for certified companies) or on the Standard Contractual Clauses approved by the European Commission, with supplementary measures where needed.
You can ask for information about these safeguards at privacy@kwibli.com.
7. How long we keep data
| Data | Period |
|---|---|
| Business account | While the account is active. If you delete it, it stays deactivated for 30 days in case you want to restore it; then it is erased. Fiscal records are kept anonymised for the legal periods. |
| Invoices, commissions and payment records | 6 years (art. 30 of the Spanish Commercial Code) and in any case for as long as tax law requires. |
| Bookings, feedback and loyalty | As decided by the business as controller; at most while its account is active, unless you ask for deletion earlier. |
| Evidence of card-guarantee consent | Until any potential claims or chargebacks relating to that booking are time-barred. |
| Wallet passes | While the pass exists; the device registration is deleted when you remove the pass from your wallet. |
| Loyalty cookie | 2 years from your last visit. |
| Contact and demo messages | Up to 12 months from the last contact, unless a contract follows. |
| Technical logs and error reports | Short periods set by each provider and at most 12 months, only for security and diagnostics. If a record is needed to investigate fraud or defend a claim, it is kept until that is resolved. |
| Analytics data | According to the Google Analytics retention setting (maximum 14 months). |
When data is no longer needed it is blocked (art. 32 LOPDGDD) and kept only for authorities and courts during the legal periods; it is then deleted or anonymised.
8. Your rights
You can exercise the following rights at any time, free of charge:
- Access: find out what data we process about you and get a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data when it is no longer needed or there is no obligation to keep it.
- Restriction: ask us to pause processing in certain cases.
- Portability: receive your data in a structured, commonly used format.
- Objection: object to processing based on legitimate interest, including commercial communications.
- Withdraw consent at any time, without affecting the lawfulness of earlier processing.
How: use our privacy requests page or email privacy@kwibli.com. We may ask for information to verify your identity. We will reply within one month, extendable by two further months for complex requests (we would let you know). If a business is the controller, we will forward your request without delay.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es) or with the supervisory authority where you live.
9. Children
Our services are not aimed at children under 14, who must not give us personal data without the consent of their parents or guardians (art. 7 LOPDGDD). You must be an adult to create a business account. If we find data from a child under 14 without the required authorisation, we will delete it.
10. Security
We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), access control, signed booking management links, activity logging and providers with security guarantees. We never store card numbers: Stripe handles them.
No system is completely secure. Protect your passwords and devices: we cannot prevent access made with your credentials or devices if they have been compromised.
12. Changes to this policy
We may update this policy to reflect legal or service changes. We will always show the last updated date and, for significant changes, notify businesses by email or in their dashboard.