Privacy Policy

How TechVerdi SA collects, uses, and protects personal data across the Kappino restaurant management platform, in line with Swiss and EU data protection law.

Last updated: 16 October 2026

Summary at a glance

• Who we are: Kappino is a restaurant management platform operated by TechVerdi SA, based in Pully, Switzerland.
• What we collect: account and contact details, the operational data you enter, technical and usage data, and limited payment metadata.
• What we do not store: full card numbers and CVV codes — payments are handled by specialised payment providers.
• Why: to provide and secure the Service, perform our contract with you, comply with the law, and improve the product.
• Who we share with: vetted service providers under contract. We never sell your data.
• Where it is stored: the core platform is hosted in Switzerland; some AI and integration features process data abroad with safeguards in place.
• Your rights: access, correct, delete, export, restrict, object, withdraw consent, and complain to a regulator.
• Contact: office@techverdi.ch

About this Policy

Kappino is a restaurant management platform owned and operated by TechVerdi SA. This Privacy Policy explains how TechVerdi SA collects, uses, discloses, stores, and protects personal data in connection with the Kappino platform — including the website at kappino.com, the web application at app.kappino.com, and our mobile applications.

We process personal data in accordance with the Swiss Federal Act on Data Protection of 25 September 2020 (FADP, in force since 1 September 2023) and its Ordinance on Data Protection and, where they apply, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

The Swiss supervisory authority is the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern, Switzerland.

Definitions

To make this Policy easier to read:

• Personal data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on personal data, such as collecting, storing, using, disclosing, or deleting it.
• Controller — the party that decides why and how personal data is processed.
• Processor — a party that processes personal data on behalf of, and under the instructions of, a controller.
• Business Client — a restaurant, café, chain, franchise, or other business that subscribes to and uses the Service.
• End Customer — a diner or guest of a Business Client whose data is processed through the Service.
• You — the individual whose personal data is processed, whether an account holder, staff member, End Customer, or website visitor.

Who is responsible

3.1 Controller details

TechVerdi SA
Av. Charles-Ferdinand Ramuz 60, 1009 Pully, Switzerland
Email: office@techverdi.ch
VAT / UID: CHE-110-027.685

3.2 Controller vs. processor

Our role depends on the data in question. TechVerdi acts as the controller for website and account registration data, billing data, login and security data, support communications, and aggregate analytics about how the Service is used.

TechVerdi acts as a processor for the operational data a Business Client enters or generates within the platform about its own End Customers, staff, orders, and reservations. In that case, the Business Client is the controller and our processing is governed by a separate Data Processing Agreement.

3.3 Data Protection Contact

Data Protection Contact — TechVerdi SA
Email: office@techverdi.ch
Post: TechVerdi SA, Attn. Data Protection, Av. Charles-Ferdinand Ramuz 60, 1009 Pully, Switzerland

3.4 Requests from the EU and the UK

If you are in the EU/EEA or the UK, you can send any data-protection request directly to TechVerdi SA using the contact details above. We have not appointed a separate representative in the EU or the UK; TechVerdi SA handles requests from every country.

Whose data we process and how we obtain it

We process personal data that:

• you provide directly — when you register, configure your account, contact support, or enter data into the platform;
• is generated automatically — log, device, and usage data created when you interact with the Service;
• comes from a Business Client — where a restaurant enters or uploads data about its staff or End Customers; and
• comes from third parties — for example, confirmation of payment status from a payment provider, or integrations you connect.

Categories of data we collect

5.1 Personal / account information

5.2 Account, login, and technical data

5.3 Restaurant operational data

Data you create or upload while using the Service, which may include personal data of staff and End Customers: branches and locations; staff records; customer records; orders; reservations; tables and floor plans; inventory; sales reports and analytics; and menu items.

5.4 Payment data

• We do not store full credit/debit card numbers or CVV / security codes.
• Payments are securely processed by third-party payment providers responsible for handling card data.
• We retain limited transaction metadata for billing, accounting, tax, dispute-handling, and fraud-prevention purposes.

5.5 Mobile device data

You can revoke any of these permissions in your device settings; some features may then be limited.

5.6 Rider location data

Where a Business Client uses delivery features, the rider mobile app periodically transmits the rider’s GPS coordinates to the platform. The tracking is real-time only — we store only the rider’s most recent location, not a continuous location history.

5.7 Uploaded documents

The Service includes a document-scanning feature. When you upload a document, such as an invoice or menu, it is processed using OCR and text parsing to extract structured data, after which the result is presented for human review and approval.

5.8 Visiting kappino.com and contacting us

• Server logs. When you open kappino.com, our web hosting provider processes your IP address, the date and time, the page requested, the referring page and your browser type. We use this to deliver the website, keep it secure and apply regional access restrictions. Logs are deleted after [number of days — to be confirmed by TechVerdi SA].
• Language and currency. So that kappino.com opens in your language and shows prices in the right currency, our server looks up your IP address in a country database (“IP to City Lite” by DB-IP). The database is stored on our own server and the lookup takes place there when the page is delivered: no third party receives your IP address for this and we do not store it (the hosting provider’s server logs described above are separate). The lookup gives us your country and, for visitors in Switzerland, the canton; we also read the language settings your browser sends. The result is kept in the two functional cookies described under “Cookies and consent”. The language you choose in the language menu always takes priority.
• Prices in Swiss francs and Polish złoty. For visitors in Switzerland, Liechtenstein and Poland we show our prices in CHF or PLN. They are converted from the euro price at the euro reference rate of the European Central Bank and rounded to whole units, and are for information only: the euro price applies, and we invoice in euros.
• Contact, demo and quote forms. When you send a form, we receive the details you enter (name, email, phone, job title, restaurant name, city, country, type of restaurant, number of locations, reason and message, and for quotes the product and quantity). We use them only to answer your request and to arrange a demo or quote. Your form is sent to our team by email (hello@kappino.com) through Google’s Gmail service. We do not add you to any newsletter.
• The Pino assistant on our website. Quick questions are answered with prepared text in your browser. When you type a question, it is sent, with the earlier messages of the conversation and the page language, to our server and to OpenAI, which generates the answer. We do not store chat messages. Please do not enter personal or payment details in the chat.
• Browser storage. We keep your cookie choice (for 12 months) and, once you choose one, your preferred language in your browser’s local storage. The language you choose, and the country, language and currency we selected for you, are also kept in two functional cookies (see “Cookies and consent”). A service worker keeps a copy of website files on your device so pages load faster and work offline. These are strictly necessary for the features you use and do not identify you.
• Advertising measurement (Meta Pixel). Only if you accept “Marketing” in the cookie banner, we load the Meta Pixel from Meta Platforms Ireland Ltd. It tells Meta which pages you view and what you do on kappino.com, together with your IP address, browser details and a Meta cookie ID, so that we can measure our ads and Meta can show relevant ads on its platforms. Before you accept, nothing is loaded from Meta and nothing is sent. You can withdraw your choice at any time under “Cookie settings”. Details: “Cookies and consent”.
• No other tracking. Apart from the Meta Pixel, which runs only with your consent, we currently use no other analytics tools, advertising cookies, tracking pixels, or third-party embedded videos or maps on kappino.com, and our fonts are hosted on our own server. If we add such tools, we will ask for your consent first and update this Policy.

Why we process data

We process personal data to create and manage accounts; process orders and reservations; plan staff schedules; manage inventory; provide analytics and reporting; provide AI features such as recommendations and forecasting; provide customer support; answer enquiries sent through our website; handle billing; maintain security; detect and prevent fraud and abuse; communicate with you; and comply with legal obligations.

Legal basis for processing

7.1 Under Swiss law

As a Swiss controller, we process personal data in line with the FADP’s core principles. Where a justification is required, we rely on consent, overriding private or public interest, performance of contract, security of the Service, fraud prevention, legal claims, or a basis provided by law.

7.2 Under the GDPR

Automated processing, AI, and profiling

Kappino uses artificial intelligence and statistical methods to provide features including the Pino AI copilot, OCR document parsing (AI Inventory and expense scans), sales and demand forecasting, the AI staff shift planner, recommendations, AI-suggested replies to social media comments, the WhatsApp AI order taker, the AI Poster Generator and AI menu translation.

Some AI features rely on third-party AI providers. Documents submitted to the OCR / AI Scanner may be processed by Google Cloud Vision and OpenAI for text extraction and parsing. Other AI features, such as the Pino AI copilot and AI-generated text and images, use the third-party AI providers listed in the table in the next section.

AI outputs are designed to support — not replace — business decisions. AI processing can be disabled for a specific Business Client on request, although some core platform features may be limited.

How we share data

We do not sell personal data. We share it only where necessary to operate the Service, with appropriate contractual and technical safeguards.

Cookies and consent

We use the following categories of cookies and similar technologies:

• Strictly necessary — needed for the website and the Service to work. On kappino.com: your cookie choice and, once you choose one, your language (both kept in your browser’s local storage), the two functional cookies listed below, and the service worker cache. In the web app: authentication, security and session management. These do not require consent.
• Analytics — would help us understand how the website is used. Used only with your consent. We do not use any analytics tools on kappino.com at the moment.
• Marketing — measure our advertising. Used only with your consent. On kappino.com this is the Meta Pixel, described below; it is not loaded unless you accept “Marketing”.

On your first visit, a cookie banner lets you accept all, reject all or choose by category; nothing optional is switched on in advance. Your choice is kept in your browser for 12 months. You can change or withdraw it at any time with the “Cookie settings” link at the bottom of every page; withdrawing consent does not affect processing that took place before.

Functional cookies on kappino.com. We set two small cookies, only to show the website in the right language and currency. They contain no name, email address or IP address, are not used for tracking or advertising and are not passed to anyone. As they are strictly functional, they are set without consent; we list them here for transparency.

You can change the language at any time in the language menu. You can delete or block these cookies in your browser settings; the website keeps working, but your choices are not remembered and prices are shown in euros.

Marketing cookies on kappino.com (Meta Pixel). If you accept “Marketing” in the cookie banner, we load the Meta Pixel from Meta Platforms Ireland Ltd. Before that, nothing is loaded from Meta and no data is sent to Meta. The pixel stores the cookies below on your device and sends Meta the pages you view and the actions you take on kappino.com, together with your IP address and browser details, so that we can measure our advertising and Meta can show relevant ads on its platforms. If you reject “Marketing”, or withdraw your choice under “Cookie settings”, the pixel is not loaded on your next visit and sends nothing.

Meta Platforms Ireland Ltd. (4 Grand Canal Square, Dublin 2, Ireland) and TechVerdi SA are jointly responsible for collecting the pixel data and sending it to Meta; Meta is responsible for everything it does with the data afterwards, as described in Meta’s Privacy Policy and Cookie Policy. Meta may transfer the data to the USA (see the section on international transfers). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time under “Cookie settings” without affecting processing that took place before. When the pixel contacts facebook.com, Meta may also set its own cookies (for example “fr”).

Where your data is stored and international transfers

The Service is hosted with a Swiss hosting provider, Infomaniak Network SA, and the core platform infrastructure and database are physically located in Switzerland. The European Commission recognises Switzerland as providing an adequate level of data protection, so personal data can be transferred from the EU/EEA to us without additional safeguards.

Some features rely on providers that process data outside Switzerland and the EU/EEA, mainly in the United States (OpenAI, Google and Meta). For these transfers we rely on one of the following safeguards:

• the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. Data Privacy Framework), where the recipient is certified under it; or
• the European Commission’s Standard Contractual Clauses, with the amendments required for transfers from Switzerland and the United Kingdom, supplemented by additional measures where necessary.

You can ask us for more information about the safeguards used for a specific provider at office@techverdi.ch.

Your rights

Subject to the conditions and exceptions of the FADP and, where they apply, the GDPR and the UK GDPR, you have the right to: access your personal data; have it corrected; have it erased; restrict its processing; object to processing based on legitimate interests, and to direct marketing at any time; receive your data in a portable format; withdraw your consent at any time, without affecting processing before the withdrawal; and obtain human review of significant automated decisions.

To exercise your rights, contact our Data Protection Contact. We respond within the timeframes required by applicable law and may need to verify your identity.

Right to lodge a complaint. You can complain to a data protection supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch); in the EU/EEA, the authority of the country where you live, work or where the alleged infringement took place; in the United Kingdom, the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to deal with your concern first.

Data retention

We keep personal data only as long as necessary for the purposes set out in this Policy or as required by law.

How the 30-day rule interacts with statutory retention. When you delete your account, operational and profile data is deleted within 30 days. Where a specific record is subject to mandatory legal retention, we block or archive that record.

Children’s privacy

The Service is a business tool intended for professional users and is not directed at, marketed to, or intended for use by children.

We do not knowingly collect, process, or store personal data from children under the age of 16.

Security measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, disclosure, or alteration.

• Encryption in transit via HTTPS/TLS, HSTS, and Content Security Policy.
• Encryption of sensitive credentials and tokens at rest using AES-256-GCM.
• Password hashing with bcrypt.
• Token-based authentication, session management, and role-based access control.
• Tenant isolation in our multi-tenant environment.
• Daily backups and disaster-recovery planning.
• Audit logging and selected system activity logs.
• Vulnerability assessments, penetration testing, and internal security audits.

Data breaches

We maintain an incident-response procedure to detect, respond to, and mitigate security incidents and data breaches, including escalation workflows and post-incident reviews.

If a data security breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected individuals.

Third-party links and services

The Service may link to or integrate with third-party websites and services. This Policy does not cover those third parties, and we are not responsible for their privacy practices.

Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated version with a revised “Last updated” date.

Contact us

Privacy Officer / Data Protection Contact
TechVerdi SA
Av. Charles-Ferdinand Ramuz 60, 1009 Pully, Switzerland
Email: office@techverdi.ch
VAT / UID: CHE-110-027.685