Privacy policy

Version of 16 October 2026

This policy explains what personal data Maxilog processes, why, on what legal basis, for how long, who it is shared with and how to exercise your rights. It covers the maxilog-resto.com website, the restaurant customer area and the Maxilog software (online ordering, mobile app, kiosk, till, kitchen display, delivery and the other products of the platform).

Data processed when publishing to social networks is covered on a separate page: Privacy: social media publishing.

The French version of this policy is the reference version.

1. Who we are

Maxilog is published by Maxilog Software, a single-member limited company (SUARL) under Tunisian law, Ksar Zaouia, 4170 Zarzis, Tunisia, registered with the National Business Register under number 1783380M. Further company details are in our legal notice.

We have not appointed a data protection officer. For any question about your data, and to exercise your rights, there is one address: contact@maxilog-resto.com.

2. Two different roles, depending on the data

Maxilog is the controller of its own data: visits to this website, demo, quote and contact requests, the relationship with restaurant customers (customer-area accounts, contracts, invoicing) and the security of its services.
Maxilog is a processor (Article 28 GDPR) for the data restaurants process with its software: orders, their customers’ accounts and addresses, loyalty, reviews, till data and their staff’s data. The restaurant is the controller: it decides what is done with that data, and Maxilog acts only on its instructions.

Ordered from a restaurant that uses Maxilog? The restaurant is your first point of contact about your data: its own privacy policy applies, and your requests should go to it. If you write to us directly, we pass your request on to the restaurant and help it reply.

3. Data Maxilog processes on its own behalf

Visiting the website

Data: IP address, browser, pages requested, date and time, in our servers’ technical logs.
Why: to run the website, protect it from abuse and fix errors.
Legal basis: our legitimate interest in a website that is secure and works.
Retention: 14 days. Security logs (sign-ins, administration access) are kept for 90 days.

Audience measurement (with your consent)

Data: only with your consent, Google Analytics counts visits and pages viewed, using the _ga and _ga_* cookies. When you send a form, only the form’s name and the language are sent, never your name, email or message.
Why: to learn which pages are useful and improve the site. No advertising: Google signals and ad personalisation are turned off.
Legal basis: your consent, which you can withdraw at any time.
Retention: the cookies expire 13 months after they are set, and later visits do not extend them. Measurement data is kept for at most 14 months. Your cookie choice is kept for 6 months, then we ask again.

Demo, quote and contact requests

Data: your name and email and, depending on the form, your phone number, your restaurant’s name and town, your estimated order volume, your needs and the products you are interested in. We also record the language, the landing page, the referring site and the campaign parameters in the address (UTM), to know how you found us.
Required or not: we need your name and email to reply. Without them we cannot handle your request. Everything else is optional.
Why: to reply, prepare the demo or quote, then follow up on our discussion.
Legal basis: steps taken at your request before a contract, and our legitimate interest in following up sales enquiries.
Retention: 3 years from your last contact with us (your request, your reply to one of our messages, a meeting). We then delete it. You can also ask us to delete it sooner, at any time. If you become a customer, this information joins your customer file (see below).

Maxilog information emails

Data: your name, your email and the list of emails already sent.
Why: to send you a few emails about our software after your request.
Legal basis: your consent, given by ticking the box in the form. Without it, you only receive our replies to your request.
Retention: until you unsubscribe, which you can do at any time with the link in every email. We then keep the date you unsubscribed, so that we do not write to you again, for as long as your request (at most 3 years after your last contact).

Prospecting restaurants

Data: the business contact details a restaurant publishes itself (its name, its town, its business email address and the page it appears on, its Instagram and Facebook pages), and our exchanges with it.
Why: to present Maxilog to restaurants, in writing, about their business.
Legal basis: our legitimate interest in making our software known to restaurant professionals. We never buy or rent lists, and we never guess an address.
Objecting: reply "STOP" to one of our messages, use the unsubscribe button of your email app, or write to us at contact@maxilog-resto.com. Your request applies at once, including to a message already scheduled.
Retention: 3 years after our last exchange, then we delete this data. An address that objected receives nothing more; afterwards we keep only a fingerprint of it, not the address itself, so that we never write to you again.

Restaurant customers and their users

Data: name, email, phone number and role of the people who use the customer area, login details, a log of important actions, contract and invoicing information. When the restaurant set up your access, it is the restaurant that gave us this information. Subscriptions are paid through Stripe: Maxilog does not store card numbers.
Why: to provide the contracted service, manage access, invoice, and provide support and security.
Legal basis: performance of the contract, our legal invoicing and accounting obligations, and our legitimate interest in security and the action log.
Retention: for the whole contract, then 5 years, the period during which a dispute can still arise. Invoices and accounting records are kept for 10 years, as accounting rules require.

Social media publishing

When a restaurant connects its Facebook, Instagram, TikTok, Google Business Profile or LinkedIn accounts, the data processed, retention periods and recipients are described in the dedicated policy.

No automated decisions

Maxilog makes no decision with legal or similarly significant effects on you based solely on automated processing, and does no profiling.

4. Data processed on behalf of restaurants

When you order from a restaurant that uses Maxilog, on its website, its app, its kiosk or at the counter, Maxilog processes on the restaurant’s behalf:

your name, email and phone number, if you create an account or leave your details;
your delivery addresses, order history and favourites;
your loyalty account, if the restaurant offers one;
what is needed to send notifications to your phone (a notification token);
the status of your payment. Online payment goes through the restaurant’s provider, Stripe or PayPal: you enter your card details with that provider, and Maxilog does not store them.

The restaurant decides what it does with this data and is answerable to you for it. Maxilog is contractually bound to use it only to run the restaurant’s service, to protect it and to help the restaurant answer your requests.

By default, the account of a customer who has neither signed in nor ordered for 3 years is anonymised: their name, contact details and addresses are erased. Only the orders remain, no longer linked to the person, because the restaurant needs them for its accounts.

5. Who receives the data

Only the Maxilog staff who need the data for their work can access it, and we sell no data. We use the following providers, each for a specific task:

OVH SAS (France): hosting of servers and databases in the European Union, and sending emails.
Google (Google Ireland Ltd and Google LLC): storage of our backups, encrypted before they are sent; app notifications (Firebase Cloud Messaging) and sign-in protection (Firebase App Check); sign-in with a Google account; website audience measurement, only with your consent.
Apple: sign-in with an Apple account and notifications on iPhone.
Sentry (Functional Software, Inc.): technical error tracking, with data hosted in the European Union. It is set up not to receive identifying data: IP addresses, emails and sign-in tokens are removed before sending.
Stripe: restaurants’ subscription payments to Maxilog and, for restaurants that use it, payment for orders online and at the counter.
PayPal: payment for orders, for restaurants that use it.
Brevo and Octopush (France): sending the text messages a restaurant chooses to send its customers.
Base Adresse Nationale (French government, api-adresse.data.gouv.fr): checking the delivery address entered. Delivery maps and routes are computed on our own servers.
Cloudflare: bot check (Turnstile) on sign-in and sign-up forms, when the restaurant turns it on.
Retell AI: voice agent that answers phone calls, when the restaurant turns it on.
An artificial intelligence provider (Anthropic by default): help writing posts and review replies. The list of possible providers and the data they receive are in the social media privacy policy.

Each of these providers is bound to Maxilog by a contract that requires it to protect the data and use it only for the task it was given.

When a restaurant itself connects Uber Eats, Deliveroo or its social networks to Maxilog, the data exchanged with those platforms is also subject to their own terms.

We may also disclose data to authorities where the law requires it.

6. Transfers outside the European Union

Our servers and databases are located in the European Union. Some data is nevertheless accessed or processed from other countries:

Tunisia: Maxilog Software is established in Tunisia, and its staff access the systems from Tunisia to run the service and provide support. Tunisia is not covered by a European Commission adequacy decision. Maxilog applies the GDPR to this data, and Tunisian data protection law also applies to it. For data processed for restaurants, this access is governed by the European Commission’s standard contractual clauses, built into each restaurant’s contract. The data stays stored in the European Union, and access is through named accounts, limited to what is necessary.
United States and other countries: some of the providers listed above (in particular Google, Apple, Stripe, PayPal, Cloudflare, Retell AI and the artificial intelligence provider) may process data outside the European Union, notably in the United States. These transfers rely on the EU–US Data Privacy Framework for the companies that have joined it, and otherwise on the European Commission’s standard contractual clauses.

You can obtain a copy of these safeguards by writing to contact@maxilog-resto.com.

7. Cookies and browser storage

The website uses only two kinds of trackers:

those that are necessary for the website and the customer area to work, stored in your browser: your session when you sign in, your language, your display preferences and your cookie choice. They do not require your consent;
Google Analytics cookies (_ga, _ga_*, 13 months), set only if you accept them. Before you agree, no Google script is loaded and no request is sent to Google.

Declining is as easy as accepting, and you can change your mind at any time: , or use the “Cookies” link at the bottom of every page. If you decline after accepting, the Google Analytics cookies are deleted.

8. Security

We protect data with appropriate technical and organisational measures, including:

encrypted connections (HTTPS) between your device and our servers;
secrets (keys and access tokens) kept in an encrypted vault, separate from the databases;
backups encrypted before they leave our servers, kept for at most 6 months;
access limited to those who need it, and two-factor authentication for Maxilog staff access to the service administration;
error and incident monitoring.

Deleted data disappears from our backups as they are replaced, within 6 months at most.

If a data breach occurs, we notify the supervisory authority within 72 hours where the GDPR requires it, and we tell you if it is likely to put you at high risk. For data we process for a restaurant, we notify that restaurant without undue delay, so that it can do the same.

9. Your rights

Under the conditions set by the GDPR, you can:

access your data and get a copy of it;
have it corrected or completed;
have it erased;
ask for its processing to be restricted;
receive the data you gave us, where its processing is based on your consent or a contract, in a common format, to pass it on to another service (portability);
object to processing based on our legitimate interest, and to direct marketing at any time;
withdraw your consent, without affecting what was done before;
set instructions for what happens to your data after your death.

To exercise these rights, write to contact@maxilog-resto.com. We reply within one month, which we may extend by two months for a complex request, after telling you. We only ask for proof of identity if we have reasonable doubts about who you are.

If you believe your rights have not been respected, you can lodge a complaint with a supervisory authority. In France, the CNIL (cnil.fr). You can also contact the authority of the EU country where you live. In Tunisia, the National Authority for the Protection of Personal Data (INPDP, inpdp.tn).

Representative in the European Union: we are appointing a representative under Article 27 GDPR. Until their details are published here, write to us directly at contact@maxilog-resto.com.

10. Changes

If we change how we process your data, we update this page and the date at the top. For a significant change, we notify restaurant customers by email.

11. Contact

Maxilog Software
Ksar Zaouia, 4170 Zarzis, Tunisia
contact@maxilog-resto.com