Integritetspolicy | Platra

Platra AB, organisation number 559587-1863, Klarinettgränd 7, 175 48 Järfälla, Sweden is responsible for personal data processed to operate the Platra platform. Contact us at support@platra.se.

A restaurant is responsible for its own use of customer information for food fulfilment, restaurant support, legal records and its customer relationship. The restaurant’s details are shown in the service. Depending on the processing, Platra may act for its own purposes or process data on a restaurant’s instructions.

This policy covers visitors, guest customers, account customers, restaurant owners and staff, prospective restaurant customers, and people who contact support. It applies to Platra websites, customer and kitchen apps, restaurant administration, communications and related platform services.

Restaurant employment records or data a restaurant handles outside Platra are not covered by this policy.

• Identity and contact: name, email, phone number, account identifiers, authentication methods and verification status.
• Orders and fulfilment: restaurant, items, prices, discounts, tax, payment and refund status, timestamps, instructions, pickup details and encrypted delivery address or access information.
• Customer relationship: restaurant-specific order history, loyalty, cashback, favourites, saved items, reviews, support communications and marketing preferences.
• Restaurant operations: business identity, administrators and staff, roles, menu and website content, subscription and billing records, payout/refund evidence, device and printer status, and audit events.
• Location: a location or address you choose to provide for nearby discovery or delivery eligibility. Browser-side discovery location may remain on your device.
• Technical and security: IP address, user agent, session and CSRF identifiers, device/push tokens, logs, rate-limit and anti-abuse results.
• AI interactions: prompts, messages, generated content and limited operational context when you deliberately use an AI-assisted feature.

We receive data directly from you; from the restaurant and its authorized staff; from your device or browser; from payment, authentication, messaging and security providers; and from actions performed in Platra. We may derive operational information such as order status, eligibility, popularity signals, fraud indicators and service-health events from those records.

Information marked as required at sign-up or checkout is needed to create or secure an account, calculate and process an order, take payment, deliver or make the order available for pickup, and provide legally required records. Without it, the relevant account, order, payment or delivery cannot be completed. Optional profile, preference, marketing and AI inputs are identified separately and can be left blank unless a selected feature needs them.

Where we rely on legitimate interests, those interests are preventing fraud and misuse; protecting accounts, customers, restaurants and the platform; diagnosing incidents and maintaining reliable service; handling support, complaints and legal claims; improving relevant ordering and restaurant operations; and operating proportionate customer features. We balance those interests against the nature of the data, reasonable expectations and effects on people, and provide objection rights where GDPR applies.

We share only the information reasonably needed for the relevant purpose. A restaurant receives its own orders and the customer, delivery, support, loyalty and refund information needed to fulfil and manage them. It cannot use Platra to access orders at another restaurant.

Providers can include Stripe for payments; Brevo for transactional email and SMS; Firebase Cloud Messaging for push notifications; Google for optional sign-in and maps; OpenAI for enabled AI features; Cloudflare Turnstile for web anti-abuse checks; and infrastructure, hosting, storage, monitoring and content-delivery providers used to run the service. Cloudflare describes the technical signals it processes for this protection in its Turnstile Privacy Addendum.

We may also disclose data to professional advisers, authorities or other parties when required by law, needed to establish or defend legal claims, or necessary to protect people and the service. We do not sell personal data.

Some providers may process data outside Sweden or the European Economic Area. Before relying on such processing, Platra must verify the provider’s actual locations and put in place the transfer mechanism required for that arrangement, such as an adequacy decision or approved standard contractual clauses, plus supplementary measures where required. Contact us for information about the mechanism that applies to a particular provider or transfer.

Platra uses software rules and, in selected features, AI to assist with support, menu content, operational insights, growth suggestions and customer recommendations. Recommendations can use order history, saved items, restaurant affinity, category interests, popularity, rating, promotion and featured-item signals.

AI output can be incorrect and is presented as assistance, not as legal, tax, safety or financial advice. Platra does not allow an AI model to become the authority for payment totals, order ownership, refunds or restaurant access. We do not currently make decisions producing legal or similarly significant effects about customers solely through automated processing.

We retain data only for as long as needed for the purpose, security, legal obligations and legal claims. Current operational periods include:

• Customer account data until deletion, subject to records we must retain or anonymize.
• Order, payment, refund, settlement, invoice and tax evidence for the period required by Swedish accounting, tax and claims rules; identifying fulfilment data may be minimized earlier.
• Sensitive delivery details are scheduled for minimization or anonymization after 90 days unless a live dispute or legal need requires longer.
• Menu-view and QR-scan activity: normally 90 days.
• AI interaction logs: scheduled for anonymization after 30 days and deletion after 90 days.
• Expired checkout sessions and expired destination-verification proof: normally removed about one day after expiry.
• Operational application logs: normally 14 days; failed background-job records: normally 30 days.

Encrypted backups and immutable recovery copies expire on separate, protected retention cycles. Deletion from active systems may therefore take time to propagate through backups, which are not used for ordinary business access.

Depending on the circumstances, you may request access, correction, deletion, restriction, portability or objection, and you may withdraw consent without affecting earlier lawful processing. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY).

Signed-in customers can use Privacy & Data settings for an export or account-deletion request. Anyone may contact support@platra.se. We may need to verify identity and clarify which restaurant or order is involved. Some records cannot be deleted immediately where retention is legally required or needed for claims and fraud prevention.

Platra currently uses cookies or equivalent storage needed for authentication, session security, CSRF protection, cart/order continuity, preferences and fraud prevention. Local device storage may hold cart, discovery location, support or order-state information.

We do not currently deploy optional advertising or cross-site tracking cookies on the main Platra service. If that changes, we will provide required information and choices before using non-essential cookies. Third-party functions such as maps, sign-in or Turnstile may receive technical data when they are loaded or used.

We use role and tenant access controls, encryption for selected sensitive fields, password hashing, transport security, audit records, backups, monitoring, rate limits and verification controls. No internet service can guarantee absolute security.

If a personal-data breach creates a risk requiring notification, we will notify the competent authority and affected people within the periods and in the manner required by law.

Platra is a general restaurant-ordering service and is not directed to young children. If you believe a child has provided personal data without valid authority, contact us so we can investigate. Payment and contractual capacity rules may restrict whether a minor can place an order.

We may update this policy when the product, providers or law changes. We will publish the new date and provide additional notice where a change materially affects people or consent is required.

Privacy questions and rights requests: Platra AB, Klarinettgränd 7, 175 48 Järfälla, Sweden; support@platra.se. Complaints may be submitted to IMY.