Skip to content

Privacy Policy

Last updated: October 7, 2026

In this policy we explain what personal data we process at BuenaCarta, for what purpose, on what legal basis, for how long, who we share it with and how you can exercise your rights. It applies to the management dashboard (app.buenacarta.com), the mobile apps, the digital menus published by our customers and this website.

1. Data controller

  • Owner: Gormaz Informática, S.L. (BuenaCarta; NiceMenu in some countries)
  • Tax ID (NIF): B42194142
  • Address: C/ Soria, 2, Bajo, 42300 El Burgo de Osma (Soria), España
  • Email: correo@gormatica.com
  • Phone: +34 910 053 838

2. Customers: account holders and dashboard users

Account and provision of the service

We process your name, your email address, your password (stored encrypted, never in plain text), your language, the details of your establishments (name, address, phone number, WhatsApp, email, social media and links), the content of your menus, login data (connection dates, IP address and device) and the proof of your acceptance of the Terms of use (version, date, IP address and device).

Purpose: to create and maintain your account, publish your menus, provide you with support, keep the service secure (for example, by limiting login attempts) and send you the necessary notices about the service. Legal basis: performance of the contract (art. 6.1.b GDPR) and, for security, our legitimate interest (art. 6.1.f). Retention: for as long as your account exists. If you delete it, we immediately remove it from public view and permanently erase the data after 14 days; we keep the proof of acceptance of the terms blocked for the limitation period of any actions arising from the contract.

Billing and payments

If you subscribe to a paid plan, we process your tax details (company name, tax ID, address), your invoices and your payment history. Your card details are processed directly by our payment provider (Stripe); we only store the card brand, the last digits and the expiry date. Legal basis: performance of the contract and compliance with legal obligations (art. 6.1.c). Retention: the periods required by commercial and tax regulations (six years for accounting records), even if you delete your account.

Your menu and your establishment are public

What you publish on your menu (venue name, address, phone number, links, dishes, prices, photos) is accessible to anyone with the link or the QR code, and may be indexed by search engines. If you are self-employed and use your name or your personal phone number as business details, bear in mind that they will be public. Legal basis: performance of the contract.

Recommendations and listings on buenacarta.com

Unless you turn it off (when creating the establishment or in Settings → Establishment), your establishment may appear on the recommendation and listing pages of buenacarta.com, for example by town, by daily set menu or by dietary options. We show the trade name, the town, the location, the link to your menu and details from it; never the personal data of your account (your name, your email or your password). Legal basis: performance of the contract (clause 6.4 of the Terms of use) and our legitimate interest in promoting the service and the establishments that use it. You can object at any time by turning off the option or by writing to us.

Establishment location

To place your establishment on the map, we calculate its coordinates from the venue address you give us, using geolocation services: CartoCiudad, from Spain's National Geographic Institute, for venues in Spain, and OpenStreetMap's service (Nominatim, from the OpenStreetMap Foundation). Only the business address is sent. You can review and correct it in the dashboard; the dashboard map is loaded from OpenStreetMap's servers, which receive your device's IP address, as with any website. Legal basis: performance of the contract and our legitimate interest.

Aggregate and anonymous statistics

From the data on menus and their usage we compile aggregate statistics (for example, the average price of the daily set menu in a province) to show them in the dashboard or publish them. We only use groupings large enough that no establishment or person can be identified, so the result contains no personal data. Legal basis: our legitimate interest.

Commercial communications

As a customer, we may send you emails with information about our own products and services similar to the ones you use (art. 21.2 of Law 34/2002, LSSI). You can object when signing up (by ticking the corresponding box), via the link included in every email or by writing to us. Necessary notices about the service (security, billing, changes to the terms) are not commercial communications and you will keep receiving them as long as you have an account.

Mobile app

  • Fingerprint or face recognition login: if you enable this option, your email and password are stored encrypted only on your device. The biometric check is performed by the phone's operating system; the application does not access your biometric data, does not store it and does not send it to our servers. You can disable this option at any time.
  • Notifications: if you grant permission to receive them, a device notification identifier is generated and linked to your account, together with the operating system (Android or iOS) and the app version. It is used exclusively to send you notices about your menu, your reservations and your subscription. You can withdraw the permission from your phone settings.

The app contains no advertising, does not use the device's advertising identifier, does not access your location, contacts or files, and does not share your data with third parties for commercial purposes.

3. Diners: people who view a menu or make a reservation

  • Menu visits: when a menu is opened, we record the IP address, the date and time and the establishment, in order to compile the venue's visit statistics and for security purposes. The record containing the IP address is deleted after 7 days; after that, only counters with no personal data are kept. Legal basis: legitimate interest.
  • Preferences on the menu: your answer to the age question (on menus with alcoholic drinks) and the dishes in “My selection” are stored in your own browser. More information in the Cookie policy.
  • Advertising: menus on the free plan may show ads from third-party advertising networks (Google), which may use cookies as described in the Cookie policy.
  • Reservations: if you book a table through a menu, the controller of your data (name, phone number, email, party size, notes and IP address) is the establishment; BuenaCarta processes it on the establishment's behalf as a data processor. The data is anonymized 12 months after the reservation date. To exercise your rights, contact the establishment or us, and we will pass your request on.
  • Content reports: if you report inappropriate content from a menu, we process the reason, the text you write and your IP address in order to handle the report and prevent abuse. Legal basis: legitimate interest and compliance with legal obligations. This data is kept for as long as needed to handle the report and for one year afterwards.

4. Visitors to this website and people who contact us

  • Contact forms and “We'll call you”: we process your name, email address, phone number and message in order to reply to you and, if you request it, to send you commercial information. Legal basis: your consent and the taking of pre-contractual steps. This data is kept for as long as the request is being handled and for one year afterwards, unless you become a customer.
  • WhatsApp and phone: if you message us on WhatsApp or call us, we process your number and the conversation in order to assist you. WhatsApp is a Meta service, with its own privacy policy.
  • Cookies and analytics: this website uses its own and third-party cookies (Google Analytics, Google Ads, Meta) only if you accept them. More information in the Cookie policy.

5. Recipients and data processors

We do not sell your data or disclose it to third parties, except where required by law (for example, to the tax authorities or to the courts). To provide the service we rely on providers that process data on our behalf (data processors), under a contract and with the safeguards of art. 28 GDPR:

  • Hosting, infrastructure and backups: our servers are located in Spain.
  • Email delivery: Amazon Web Services (Amazon SES).
  • Payments: Stripe.
  • Automatic translation of menu texts: Anthropic (it only receives the dish texts, not account data).
  • Mobile app notifications: Expo, Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service).
  • Protection against automated use of the forms: Google reCAPTCHA.
  • Sales agents who work with us, when they sign you up or assist you, bound by a duty of confidentiality.

6. International transfers

Our servers, where your account and your menus are stored, are located in Spain. Some of these providers (Stripe, Anthropic, Expo, Google, Apple, Amazon and Meta) may process data outside the European Economic Area, mainly in the United States. This is done with the safeguards of Chapter V of the GDPR: the provider's certification under the EU-U.S. Data Privacy Framework or the standard contractual clauses approved by the European Commission.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, by writing to correo@gormatica.com and stating which right you are exercising. If necessary to identify you, we will ask you for additional information. You can change a lot of your data yourself from the dashboard, and you can delete your account from My account (see Delete your BuenaCarta account).

If you believe we have not processed your data correctly, you can file a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).

8. Security

We apply technical and organizational measures appropriate to the risk: encrypted communications (HTTPS), passwords stored with irreversible encryption, access control per establishment, limits on login attempts, backups and restricted staff access to the data.

9. Minors

The service is intended for professionals of legal age. We do not knowingly process data of minors in the dashboard.

10. Changes to this policy

We may update this policy when our processing or the regulations change. We will indicate the date of the last update and, if the change is significant, we will notify you by email or in the dashboard.