Privacy Policy

1. Information We Collect

When you use QR Mesa to pay your restaurant bill, we may collect:

• Payment information: Transaction amounts, tip amounts, and payment status. Card details are entered directly into Clover's PCI-compliant payment fields and are never stored on our servers.
• Email address: If you choose to receive a receipt, we collect the email address you provide.
• Session data: Temporary session tokens to link your device to your table and bill during your visit.

2. How We Use Your Information

• To process your payment through the restaurant's POS system
• To send you a receipt if you provide your email address
• To provide restaurant administrators with payment reports
• To maintain and improve the service

3. Information Sharing

We share information with:

• The restaurant whose bill you are paying
• Our payment processor (Clover) to complete your transaction
• Resend, our email delivery service, for receipts, alerts, and contact-form messages
• Service providers that help us run QR Mesa: PostHog (product analytics), Sentry (error monitoring), Vercel (website hosting), and DigitalOcean (backend hosting)

We do not sell or share your personal information to third parties for their own advertising purposes.

4. Merchant Data

When a restaurant connects its Clover account to QR Mesa, we read order and line-item data from Clover to display the live bill to guests and to record payments back on the table's order. The restaurant's Clover OAuth access tokens are stored encrypted. A restaurant can disconnect Clover at any time, after which we stop accessing its Clover data.

5. Analytics & Cookies

We use PostHog, a product analytics tool, to understand how guests and restaurant staff use QR Mesa, including on the guest bill-payment page. PostHog collects information such as pages viewed and product events (for example, scanning a QR code, viewing a bill, or completing a payment); it never collects card numbers, and guest activity is not linked to your name unless you provide your email for a receipt. To opt out, block cookies and site data for qr-mesa.com in your browser or use a tracker-blocking extension, or contact privacy@qr-mesa.com to request deletion of your analytics data.

6. Data Retention

Payment records are retained for the duration required by applicable financial regulations. Session data is automatically expired within 1 hour. Contact-form messages are kept as ordinary email correspondence. Receipt email addresses are stored alongside the payment record.

7. Data Security

We protect your data using industry-standard security measures including HTTPS encryption, encrypted token storage, and PCI-compliant payment processing. We do not store credit card numbers on our servers.

8. Your Rights

You may request access to, correction of, or deletion of your personal data by contacting us at privacy@qr-mesa.com.

9. Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to know what personal information we have collected about you, to request its deletion, and to request correction of inaccurate information. We do not sell or share your personal information, so there is no sale or sharing to opt out of. To make a request, contact privacy@qr-mesa.com.

10. Children

QR Mesa is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact privacy@qr-mesa.com and we will delete it.

11. Contact

For privacy-related questions, contact us at privacy@qr-mesa.com.