Privacy policy

When a guest opens a table or takeout menu, the app stores a random session token in the browser's local storage. It identifies that ordering session so the guest can see their own cart and order status. It is not linked to a name, email, or phone number unless the guest optionally types a name for a takeout order.

Order contents (items, quantities, notes) are stored so staff can prepare and track the order.

No analytics or advertising tools run on these screens. Google Analytics, described below, is loaded only on the public marketing site — it does not load at all when a guest scans a table QR code, browses a menu, or places an order. Nothing about a guest's order is used for advertising, sold, or shared with anyone outside the restaurant they ordered from.

Staff sign in with an email and password managed by our authentication provider (Supabase Auth). Staff actions (confirming, serving, editing the menu) are associated with their account for operational history.

The public pages at deskaxes.com — the homepage, pricing, blog, and pages like this one — use Google Analytics (GA4) to understand how visitors find the site and which pages they read, including visits that arrive from an ad. GA4 sets its own cookies/local storage and may use an IP address and device information to generate aggregate, de-identified usage statistics; we don't use it to build advertising profiles of individual visitors. You can opt out of Google Analytics tracking generally using Google's browser add-on.

When we run ads on Facebook or Instagram, these same public pages also load the Meta Pixel, so we can tell which ads bring people who actually sign up rather than just clicks. It sets its own cookies and reports page views and form submissions to Meta, which may match them to a Facebook or Instagram account. It records that a signup happened and which page it came from — not what you typed in the form. You can limit this in your Meta ad preferences.

Both tools are limited to the marketing pages. Neither loads on the QR ordering screens a guest sees in a restaurant, or anywhere inside the staff app — see the section above.

If you submit your email on the marketing site's signup or "book a call" form, we store that address — and, if you're inquiring about the product, the fact that you asked — to reply to what you asked for. If you also tick "Send me occasional product updates," we'll use it for that too; if you don't, we won't. It's write-only from the site — there's no account, and you can ask to be removed at any time by contacting us (see below). It is never sold and never shared outside Desk Axes. Marketing emails may include standard open and click measurement so we can tell whether what we send is worth reading; every marketing email carries a one-click unsubscribe, honored immediately and permanently.

Data is stored in a Supabase (PostgreSQL) database with row-level security, so a guest can only ever access their own session's data and staff only their restaurant's data. Uploaded photos and logos are kept in object storage served over HTTPS.

Orders and session records are retained for operational and reporting purposes and may be periodically cleared. A restaurant can request deletion of its data; a closed restaurant's data is purged automatically after a fixed retention window.

You can ask what data we hold about you, ask us to correct it, or ask us to delete it (subject to what a restaurant needs to keep for its own order records). Philippine residents have these rights under the Data Privacy Act of 2012, and can also lodge a complaint with the National Privacy Commission if a concern isn't resolved directly with us.

Questions about this policy, or requests about your data, can be directed to the restaurant operating the service, or to the Desk Axes administrator.