Privacy Policy

1. Who we are

La Carta (hereinafter, "the App") is developed and operated by Ingeniería.dev, led by Chris Flores (hereinafter, "we", "the Developer").

• Contact: [email protected]
• Address: Av. Javier Barros Sierra 495, Santa Fe Lomas de Santa Fe Zedec Santa Fé, Álvaro Obregón 01219, Mexico City, CDMX, Mexico

2. Two very different kinds of user

Reading this policy is much easier once this distinction is clear, because the two groups are treated differently on purpose.

• The restaurant. The owner and the kitchen staff install this App and sign in with an account. This is the only group that has an account with us, and the only group whose personal data we hold.
• The diner. A guest sitting at one of your tables installs nothing. They scan the QR code, the menu opens in their phone's browser at menu.ingenieria.dev, and they order. We never ask them for a name, an email address, or a phone number, and we do not have one on file.

3. What data we collect

3.1 From the restaurant account

To give you an account that works across your devices, we store on our server:

• Your name — so the App can address you and identify who owns the venue
• Your email address — it is your login identifier, and the address we send your verification code to
• Your password — stored only as an Argon2id hash. We never store, log, or transmit your password in plain text, and we cannot read it, recover it, or tell you what it is. If you forget it, it is reset, never retrieved

When you sign up or sign in, we email you a three-digit verification code to confirm the address belongs to you. See Section 6.1 for the service that delivers that email.

3.2 The content you publish

Everything you create in order to run your menu is stored on our server, because that is what the diner's browser has to load when the QR code is scanned:

• The name and details of each restaurant you manage
• Categories, and the dishes inside them — their names, descriptions, and prices
• Photos of dishes that you choose to upload. They are stored as files on our own server. They are not uploaded to any third-party image host, CDN, or cloud storage provider

This content is public by design: any person who scans your QR code can see it. Please do not put anything in a dish name, a description, or a photo that you would not want a stranger at a table to read.

3.3 From diners — deliberately almost nothing

When a guest orders from the web menu, the server stores:

• The order itself — which dishes, what quantities, and which table they came from, so the kitchen can prepare and serve it
• Ratings and comments, and only if the guest chooses to leave them, so you can see what people thought of a dish
• A random table-session identifier, which expires three hours after it is issued. It exists so that a guest's cart survives while they read the menu, and so that two tables ordering at once don't collide. It is a random value: it is not derived from the person, their device, or their phone number, and it identifies nobody once it has expired

We do not ask for, receive, or store a diner's name, email address, phone number, address, payment details, or any account credential. There is no diner account to create, because there is nothing we want to know about them.

4. What we never collect

The following is true of the App as a whole, for restaurants and diners alike:

• No advertising, and no advertising networks
• No third-party analytics, no usage metrics, no behavioral profiling
• No tracking SDKs of any kind, and no crash-reporting SDK. The App never requests App Tracking Transparency permission, because it performs no tracking
• No location data, no contacts, no calendar, no reminders, no microphone, no health data, and no HealthKit
• No camera access. Photos of dishes come from the system photo picker (see Section 7)
• No payment data. The App contains no purchases and processes no money — payment happens at your restaurant, by whatever means you already use

We do not sell, rent, or share your data with third parties for their own purposes, and we never will. The only parties that ever receive data are the infrastructure providers listed in Section 6, strictly so the service can function.

5. What is stored on your device

The App keeps very little on the iPhone or iPad itself:

Your password itself is never stored on the device. Signing out removes the session token from the Keychain; deleting the App removes everything in this table with it.

6. External services

La Carta is not an offline app: it has a backend, because your menu has to reach the phone of a guest who never installed anything. These are the only parties involved.

6.1 Our own server

Your account and your menu live on a server operated by the Developer at menu.ingenieria.dev, running a PostgreSQL database on infrastructure rented from Digital Ocean in their SFO3 region (San Francisco, United States). Digital Ocean is our hosting provider: they supply the machine, they do not process your data for any purpose of their own. All traffic between the App and the server travels over HTTPS.

6.2 Resend (email delivery)

The three-digit verification code that confirms your email address is delivered by Resend, an email delivery service. To send it, Resend necessarily receives your email address and the message containing the code. Nothing else is shared with them — not your password, not your menu, not your orders. See Resend's Privacy Policy.

6.3 Apple

Apple distributes the App through the App Store and delivers the notifications described in Section 7 through the Apple Push Notification service. Their handling of that data is governed by Apple's Privacy Policy. The App contains no In-App Purchases, so no purchase data exists.

7. System permissions

La Carta requests only what it actually uses:

• Notifications — optional. Used for one thing: to tell you that a new order has arrived from one of your tables. If you decline, the App keeps working; you will simply need to look at the orders screen yourself. You can change this at any time in Settings → Notifications → La Carta.

Choosing a photo for a dish uses the standard iOS photo picker. The picker runs outside the App and hands over only the single image you selected — the App never receives access to your photo library as a whole, which is why no photo library permission is requested.

The App does not request access to: the camera, your full photo library, location, contacts, calendar, reminders, the microphone, Bluetooth, the local network, health data, or HealthKit.

8. Marketing and advertising

The App displays no ads. We do not collect data for remarketing, profiling, segmentation, behavioral analysis, or any promotional purpose. We do not participate in ad networks. We will not email you marketing messages: the only email we ever send to a restaurant account is the verification code it asked for, and operational notices about the service.

9. Data retention and deletion

• Your account and menu are kept for as long as your account exists, because the menu has to stay reachable for your guests.
• You can delete your account at any time, from inside the App or by emailing [email protected]. Deleting it permanently removes your name, your email address, your password hash, your restaurants, your dishes, your uploaded photos, and the associated orders from our database. This cannot be undone.
• Table sessions expire automatically three hours after they are created.
• Orders and ratings are kept so you can consult your own history, and are deleted together with the account they belong to.

10. Minors

The App is a business tool intended for restaurant owners and staff, who are expected to be adults. It contains no content directed at children and no advertising. Diners are never asked for personal data at all, so no data about a minor sitting at a table is ever collected.

11. User rights (GDPR, CCPA, LFPDPPP, LGPD)

If you hold a restaurant account, the following rights apply to the data described in Section 3:

• Right to access: Your account data and your entire menu are visible to you inside the App at any time. For a copy in another form, email us.
• Right to rectification: You can edit your name, your dishes, your prices, and your photos directly in the App.
• Right to erasure: Deleting your account removes your personal data and your content from our server permanently (see Section 9).
• Right to portability: Email us and we will provide the data associated with your account in a machine-readable format.
• Right to object and to restrict processing: Email us. Since we process your data only to operate the service you asked for, objecting in practice means closing the account.
• Right not to be subject to automated decisions: We make no automated decisions about you. There is no profiling, no scoring, and no algorithm deciding anything that affects your legal rights, employment, credit, or insurance.

To exercise any of these rights, email [email protected]. We respond within 48 business hours and resolve requests within the period required by applicable law.

12. Security

• All communication between the App and the server uses HTTPS. Nothing travels in the clear.
• Passwords are stored only as Argon2id hashes — a modern, memory-hard algorithm designed to make cracking a stolen hash impractical. Plain-text passwords are never written to disk or to a log.
• Email addresses are verified with a one-time code before an account becomes usable.
• Your session token is kept in the iOS Keychain, protected by the operating system and by device-level encryption, and is inaccessible to other apps on the device.
• Access to the database is restricted to the application server.

No system is perfectly secure. If a breach ever affected your personal data, we would notify you by email and, where the law requires it, the competent authority, without undue delay.

13. International transfers

Our server is located in the United States (Digital Ocean, SFO3 region), and our email provider, Resend, also operates from the United States. If you use the App from Mexico, the European Union, Brazil, or elsewhere, your account data is therefore transferred to and stored in the United States. That transfer is necessary to provide the service you requested, and it is the only reason it takes place.

14. Changes to this policy

We may update this Privacy Policy to reflect changes to the App or to applicable law. The current version will always be published at this URL, along with the date of the last update. Material changes will also be announced inside the App.

15. Governing law

This Policy is governed by the laws of the United Mexican States, in particular the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). Any dispute will be submitted to the competent courts of Mexico City.

16. Contact

Privacy Officer: Chris Flores
Email: [email protected]
Postal address: Av. Javier Barros Sierra 495, Santa Fe Lomas de Santa Fe Zedec Santa Fé, Álvaro Obregón 01219, Mexico City, CDMX, Mexico