Privacy Policy

1. General Information

mesalink.app is a digital menu and order management platform for restaurants. This policy describes how we collect, use, and protect your personal information, in compliance with Chilean Data Protection Laws (Ley 19.628 and Ley 21.719).

2. Data We Collect

We collect the following data depending on the type of user:

3. Use of Data

We use your data exclusively to:

• Provide and improve the digital menu and order management service
• Process subscriptions and payments through Flow.cl
• Send operational notifications related to your account
• Sales chatbot visitors: conversation messages, name, email and phone (only if you provide them voluntarily), business type and commercial interest. Legal basis: implied consent when starting the conversation (Art. 13 letter a).
• Technical data: IP address (for rate limiting, not stored permanently), session cookies, language preference, push notification tokens.

4. Storage and Security

Your data is stored on secure servers (Neon PostgreSQL, Vercel). We implement encryption in transit (HTTPS/TLS), secure authentication, and role-based access controls. We do not sell or share your data with third parties except those necessary to operate the service (Flow.cl for payments, Telegram for operational notifications).

• Provide the digital menu, order and table management service
• Process and deliver delivery orders
• Manage subscriptions and process payments through Flow.cl
• Send operational notifications (new orders, table alerts) via Telegram and push notifications
• Answer commercial enquiries through the sales chatbot
• Comply with legal and tax obligations

5. Cookies

We use strictly necessary cookies for service operation (user session, language preferences). We do not use tracking or advertising cookies.

• Neon (PostgreSQL): database storage — United States
• Vercel: hosting and application runtime — United States
• Flow.cl: payment processing — Chile. We do not store card details; Flow.cl processes them directly
• Telegram: operational notifications to restaurants — International
• Upstash (Redis): rate limiting and cache — United States
• Groq / Anthropic: natural language processing for the chatbot — United States. Messages are sent without identifying data whenever possible

International data transfers go to providers that meet equivalent protection standards, in accordance with Art. 28 of Law 21.719.

6. User Rights

Under Chilean law, you have the right to access, rectify, cancel, and oppose the processing of your personal data. To exercise these rights, contact us at info@mesalink.app.

• Strictly necessary cookies: user session (authjs.session-token), 2FA verification, language preference. No consent required.
• Preference cookies: visual theme (light/dark), font size. Stored in localStorage.
• We do not use tracking, advertising or third-party analytics cookies.

8. Contact

For privacy inquiries, contact us at info@mesalink.app.

• Restaurant account data: while the account is active. When the subscription is cancelled, data is deleted within 30 calendar days, except where legal retention obligations apply.
• Order data (end customers): 90 days from the order date. Encrypted delivery data is deleted together with the order.
• Sales chatbot conversations: 180 days from the last interaction.
• Security and audit logs: 1 year.
• Data required by law (tax): according to the applicable legal periods.

9. Data security

We implement the following security measures to protect your personal data:

• Encryption in transit: HTTPS/TLS on all communications
• Encryption at rest: AES-256-GCM for sensitive data (delivery address and phone)
• Secure authentication: bcrypt-hashed passwords, email verification, optional 2FA
• Role-based access control: owner, admin, staff, driver — each role only accesses the data it needs
• Rate limiting: protection against brute-force attacks and API abuse
• Audit logs: record of administrative actions

10. Security breach notification

In the event of a security breach affecting your personal data, we will notify the Personal Data Protection Agency within 72 hours of becoming aware of the incident, in accordance with Art. 35 of Law 21.719. We will also notify you directly if the breach poses a high risk to your rights.

11. Minors

mesalink.app is not intended for people under 18. We do not knowingly collect data from minors. If we discover that we have collected data from a minor, we will delete it immediately.

12. Changes to this policy

We reserve the right to update this policy. Changes will be notified by email at least 15 days in advance. The date of the last update is shown at the top of this document.