Privacy & cookies.

What we collect

Only what we need to serve you.

• When you order: name, email, optional phone, and payment data — processed directly by Square; we never see your card details.
• When you join Nova Loyalty: your email to send the sign-in code and track points.
• When you use AI search: your query and the AI's response are logged confidentially for forensic purposes (e.g. in case an allergen dispute ever arises). The query is not linked to you until you place an order — see cookies below.

Cookies

Strictly-necessary cookies only.

We do not use advertising or tracking cookies. We do not sell or share data. The cookies below are required for the site to function and therefore do not require a consent banner under GDPR/PECR.

• nk_locale — your preferred language (EN / ES). 30 days.
• nk_session — random anonymous identifier to link your AI searches to your order if you place one (for allergen forensics). Contains no PII. 30 days.
• nk_admin — restaurant staff session cookie. /admin only. 8 hours.
• nk_loyalty — Nova Loyalty session (only if you joined). 30 days.

AI search notice

The AI can be wrong.

AI-generated menu suggestions are an aid, not a substitute for talking to staff. For serious allergies and intolerances, always confirm with the kitchen before ordering — cross-contamination in a shared kitchen cannot be guaranteed by menu data alone. Each AI interaction is logged confidentially along with the disclaimer version you saw and the menu state at that moment.

Sharing & selling

We do not sell your data.

We share data only with the providers we need to operate: Square (payments + catalog), Vercel (hosting), Cloudflare (DNS + bot protection), Resend (transactional email), and AI providers Anthropic + Groq (only for your AI search queries). None of these resell or share this data.

Your rights

How to request access or deletion.

You can request a copy of the data we hold on you, or ask us to delete it, by writing to:

hello@spaosystems.com

We will respond within 30 days. For financial-compliance reasons, order records may be retained as required by applicable tax law.