Privacy Policy

Version: 2026-10
Last updated: 6 October 2026
Previous version: 16 August 2026

1. Who we are and what this covers

Caterway is a quote and order tool for caterers, restaurants and venues. Gentlio Oy runs it. This policy explains what personal data we handle, why, on what legal basis, who else receives it and what your rights are.

It covers four groups of people:

caterers and their team members who use Caterway ("you");
visitors to caterway.io;
businesses and people we contact about Caterway (see §18);
the caterers' own customers, for whom the caterer is responsible and we only process data on the caterer's behalf (see §4).

The rules that apply include the EU General Data Protection Regulation (GDPR, 2016/679), the Finnish Data Protection Act (1050/2018) and the Finnish Act on Electronic Communications Services (917/2014).

2. Controller and contact details

Gentlio Oy (business ID 3644859-5), trading as Caterway
Sörnäisten rantatie 25 A1, 00530 Helsinki, Finland
Email: support@caterway.io

We have not appointed a data protection officer. Send any privacy question or request to the address above, and our management handles it.

3. Who is responsible for what

Data	Our role
Caterer accounts, billing and support	Controller
Visitors to caterway.io and the dashboard	Controller
Prospects in our sales CRM, sales email, menu tool leads	Controller
The caterers’ customers: quote requests, events, dietary needs, messages, invoices	Processor for the caterer (GDPR Art. 28)
Daily counts of how often each caterer’s calculator was opened and sent (§8.4)	Processor for the caterer. We use only platform-wide totals for ourselves
Daily page counts on caterway.io (§8.5)	Controller

Data
Caterer accounts, billing and support
Our role
Controller
Data
Visitors to caterway.io and the dashboard
Our role
Controller
Data
Prospects in our sales CRM, sales email, menu tool leads
Our role
Controller
Data
The caterers’ customers: quote requests, events, dietary needs, messages, invoices
Our role
Processor for the caterer (GDPR Art. 28)
Data
Daily counts of how often each caterer’s calculator was opened and sent (§8.4)
Our role
Processor for the caterer. We use only platform-wide totals for ourselves
Data
Daily page counts on caterway.io (§8.5)
Our role
Controller

4. If you are a caterer's customer

When you ask a caterer for a quote through Caterway, the caterer decides what happens to your details. The caterer is the controller and Caterway is its processor. We use your details only to run the service for the caterer, under our Data Processing Agreement.

Ask the caterer first if you want to see, correct or delete your details. If you write to us instead, we pass your request to the caterer and tell you that we did.

The caterer's customer pages (the calculator, quotes, order pages and the caterer's public page, also when embedded on the caterer's own website) load no analytics or marketing tools and store nothing on your device for us. Our server counts how often a calculator is opened and sent, without cookies and without keeping your IP address. See §8.4.

5. What we collect, why, and on what basis

Data	Why	Legal basis (GDPR)
Account: name, email, phone, business name, business ID, address, language and settings, and the time you confirmed at signup that you use Caterway for your business or organisation. Team members’ names and emails. Your password is handled by our sign-in provider, and we never see it.	To create your account and run the service.	Contract, Art. 6(1)(b)
What you put into the service: products, prices, calculators, quotes, events, customers, invoices, files.	To run the service. Your customers’ data in it is yours (§4).	Contract, Art. 6(1)(b)
Billing: plan, payments, invoices, billing address, VAT number. Card details stay with Stripe.	To bill your subscription and keep the books.	Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c)
Referrals: who signed up with your referral code, and the reward status. A caterer who referred you sees your business name or a partly hidden email address, your signup date and whether the reward has been earned.	To give both of you the free month the referral program promises, and to stop self-referrals.	Contract, Art. 6(1)(b)
Each time you accept the Terms and the Data Processing Agreement: the version and the time, kept as its own row in a log that is never rewritten. Your marketing email choice, also kept as a log.	To show what you agreed to and when.	Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f)
Your cookie choice on caterway.io and the dashboard: an anonymous receipt with a random id, your choices, the policy version and the time. No IP address, and no link to your account.	To show that we asked for consent and what you chose.	Legal obligation, Art. 6(1)(c), read with Art. 7(1)
Support messages and emails with us.	To answer you.	Contract, Art. 6(1)(b)
Service emails about your account: onboarding tips, trial and plan notices.	To help you get started and tell you about your plan.	Contract and legitimate interest, Art. 6(1)(b) and (f)
Marketing email about Caterway.	Product news and offers.	Consent, Art. 6(1)(a). You choose at signup and can unsubscribe in any email.
Security and error data: IP address, browser, request counts, error reports.	To keep the service safe, stop abuse and fix bugs.	Legitimate interest, Art. 6(1)(f)
The country we detect at signup from your IP address. We store only the country, not the IP address. Kept as long as your account exists.	To comply with sanctions and with other countries’ rules on transferring personal data.	Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f)
Daily page counts on caterway.io, made on our server without cookies: page, referring site, campaign tags, country, device type, browser and language (§8.5).	To know how many people visit which pages and where they come from.	Legitimate interest, Art. 6(1)(f). Nothing is stored on or read from your device, so no consent is needed.
Analytics on caterway.io and the dashboard (§8).	To see how the site is used and improve it.	Consent, Art. 6(1)(a)
Where a signup came from: campaign tags, landing page, referring caterer, campaign code (§8).	To know which campaigns work and to credit a referring caterer.	Consent, Art. 6(1)(a), for the storage on your device
Menu tool: the menu you upload and the email you leave for the result.	To send you the result you asked for.	Steps at your request, Art. 6(1)(b)
Prospects in our sales CRM.	See §18.	Legitimate interest, Art. 6(1)(f)

Data
Account: name, email, phone, business name, business ID, address, language and settings, and the time you confirmed at signup that you use Caterway for your business or organisation. Team members’ names and emails. Your password is handled by our sign-in provider, and we never see it.
Why
To create your account and run the service.
Legal basis (GDPR)
Contract, Art. 6(1)(b)
Data
What you put into the service: products, prices, calculators, quotes, events, customers, invoices, files.
Why
To run the service. Your customers’ data in it is yours (§4).
Legal basis (GDPR)
Contract, Art. 6(1)(b)
Data
Billing: plan, payments, invoices, billing address, VAT number. Card details stay with Stripe.
Why
To bill your subscription and keep the books.
Legal basis (GDPR)
Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c)
Data
Referrals: who signed up with your referral code, and the reward status. A caterer who referred you sees your business name or a partly hidden email address, your signup date and whether the reward has been earned.
Why
To give both of you the free month the referral program promises, and to stop self-referrals.
Legal basis (GDPR)
Contract, Art. 6(1)(b)
Data
Each time you accept the Terms and the Data Processing Agreement: the version and the time, kept as its own row in a log that is never rewritten. Your marketing email choice, also kept as a log.
Why
To show what you agreed to and when.
Legal basis (GDPR)
Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f)
Data
Your cookie choice on caterway.io and the dashboard: an anonymous receipt with a random id, your choices, the policy version and the time. No IP address, and no link to your account.
Why
To show that we asked for consent and what you chose.
Legal basis (GDPR)
Legal obligation, Art. 6(1)(c), read with Art. 7(1)
Data
Support messages and emails with us.
Why
To answer you.
Legal basis (GDPR)
Contract, Art. 6(1)(b)
Data
Service emails about your account: onboarding tips, trial and plan notices.
Why
To help you get started and tell you about your plan.
Legal basis (GDPR)
Contract and legitimate interest, Art. 6(1)(b) and (f)
Data
Marketing email about Caterway.
Why
Product news and offers.
Legal basis (GDPR)
Consent, Art. 6(1)(a). You choose at signup and can unsubscribe in any email.
Data
Security and error data: IP address, browser, request counts, error reports.
Why
To keep the service safe, stop abuse and fix bugs.
Legal basis (GDPR)
Legitimate interest, Art. 6(1)(f)
Data
The country we detect at signup from your IP address. We store only the country, not the IP address. Kept as long as your account exists.
Why
To comply with sanctions and with other countries’ rules on transferring personal data.
Legal basis (GDPR)
Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f)
Data
Daily page counts on caterway.io, made on our server without cookies: page, referring site, campaign tags, country, device type, browser and language (§8.5).
Why
To know how many people visit which pages and where they come from.
Legal basis (GDPR)
Legitimate interest, Art. 6(1)(f). Nothing is stored on or read from your device, so no consent is needed.
Data
Analytics on caterway.io and the dashboard (§8).
Why
To see how the site is used and improve it.
Legal basis (GDPR)
Consent, Art. 6(1)(a)
Data
Where a signup came from: campaign tags, landing page, referring caterer, campaign code (§8).
Why
To know which campaigns work and to credit a referring caterer.
Legal basis (GDPR)
Consent, Art. 6(1)(a), for the storage on your device
Data
Menu tool: the menu you upload and the email you leave for the result.
Why
To send you the result you asked for.
Legal basis (GDPR)
Steps at your request, Art. 6(1)(b)
Data
Prospects in our sales CRM.
Why
See §18.
Legal basis (GDPR)
Legitimate interest, Art. 6(1)(f)

We do not sell personal data. We do not make decisions about you by automated means alone.

6. AI features

Some features use Google's Gemini models: menu import, order import and text drafting. They run only when you start them. The file or text you submit goes to Google for processing, and the result comes back to you. An imported order list can contain your customers' names and contact details, so import only what you need. Order import sends the photo or pasted text as it is, so any customer names, phone numbers, email addresses and notes in it reach Google. The import screen says this before you upload anything.

These calls go to Google Cloud's Gemini Enterprise Agent Platform (formerly Vertex AI), in Caterway's own Google Cloud project, on the EU multi-region endpoint. Google documents that this endpoint keeps ML processing within EU member states. Google processes the content under Google Cloud's data processing terms.

7. Allergies and diets

A caterer's calculator can ask about allergies and special diets. Allergies are health data, and some diets can reveal religious belief. Both are special categories of data under GDPR Art. 9. The caterer decides whether to collect them and is responsible for the legal basis. We store them for the caterer and use them for nothing else.

Named guests are on by default. The customer can add a guest's name to a diet row, or leave it out: names are optional. If any row has a name or a free-text note, the customer must tick one consent box before sending, and that one tick covers every named row. We store the time and the version of that text with the request. Names and diet notes are deleted automatically 90 days after the event by default, or after the period the caterer chose, between 30 and 365 days. With no event date, the period runs from the request date. The counts, without names, stay with the quote.

A caterer can instead choose counts only, such as "2 x gluten-free". Then the calculator asks for no names, and our server removes any guest name it is sent.

8. Cookies and similar storage

8.1 The cookie banner

On your first visit to caterway.io or the dashboard you see a short banner. "Reject all" and "Accept all" have equal weight, and "Settings" lets you choose by category. Both optional categories are off until you turn them on. Nothing optional runs before you choose.

You can change or withdraw your choice at any time from the link in the footer of every page, or in Settings > Account. When you withdraw a category, we remove what it stored. Withdrawing analytics also reloads the page so its scripts stop. We ask again after 6 months, or sooner if the categories change.

Each choice also leaves an anonymous receipt on our server: the random id stored with your choice in your browser, the choices, the policy version and the time. It holds no IP address and is not linked to your account. We keep it for the life of the choice plus 3 years (§12), so we can show that consent was asked and given.

8.2 Categories

Necessary, always on: sign-in, security, remembering your cookie choice and the language and layout you picked.
Analytics, off by default: Microsoft Clarity, Vercel Analytics, Vercel Speed Insights and our own visitor statistics in the browser, which tell visits apart and show who is on the site now. The page counts in §8.5 are not in this category: they run on our server and store nothing on your device.
Marketing, off by default: which campaign brought you here, and the 30-day referral cookie from a "Powered by CaterWay" link on a caterer's calculator.

Sentry (error monitoring) and Cloudflare Turnstile (bot check) run without consent, because the service cannot be kept secure without them. Sentry sets no cookies. Turnstile runs in a frame served by Cloudflare.

8.3 What is stored on your device

Name	Type	Category	Lifetime	Purpose
sb-…-auth-token	Cookie (first party)	Necessary	Up to 400 days, renewed while you stay signed in. Removed when you sign out.	Keeps you signed in (Supabase).
cw_cookie_consent	localStorage	Necessary	6 months, or until the policy version (now 2026-10) changes	Remembers your cookie choice.
sidebar:state	Cookie (first party)	Necessary	7 days	Remembers whether the dashboard side menu is open.
caterway-db	IndexedDB	Necessary	Up to 24 hours. Emptied when you sign out. Never created on a caterer’s customer pages.	Keeps the events, quotes and products you opened in the dashboard, so they show at once and when your connection drops.
caterway-offline-queue	IndexedDB	Necessary	Until the change is sent, then it is deleted. Never created on a caterer’s customer pages.	Holds a dashboard change you made without a connection until it can be sent.
cw_portal_lang	Cookie (first party)	Necessary	12 months	Remembers the language you chose on a caterer’s public page.
cw_code	Cookie (first party)	Necessary	30 days	Keeps a campaign discount code you arrived with, so the price applies at signup.
caterway_no_track	localStorage	Analytics	Until you clear it	Marks a browser that has opened the dashboard, so we do not count our own users as visitors.
caterway_session_id	sessionStorage	Analytics	Until you close the tab	A random id that groups one visit’s page views. Not linked to your account.
_clck	Cookie (first party)	Analytics	Set by Microsoft. See Microsoft's Clarity cookie list.	Clarity: keeps a pseudonymous Clarity user id for this site.
_clsk	Cookie (first party)	Analytics	Set by Microsoft	Clarity: joins page views into one recorded session.
CLID, MUID, ANONCHK, MR, SM	Cookies (Microsoft domains)	Analytics	Set by Microsoft	Clarity: Microsoft’s own identifiers. Per Microsoft, Clarity does not use them for advertising.
Vercel Analytics, Speed Insights	No cookies	Analytics	None on your device	Page views and page speed, counted without cookies.
cw_ref	Cookie (first party)	Marketing	30 days	The caterer whose “Powered by CaterWay” link you followed, so we can credit them if you sign up.
caterway_attribution	sessionStorage	Marketing	Until you close the tab	The campaign tags and page your visit started on, saved with your account if you sign up.
Turnstile	Frame from challenges.cloudflare.com	Necessary (security)	Set by Cloudflare	Checks that a form is sent by a person. Per Cloudflare, it uses IP address, browser and TLS details only to detect bots.
Sentry	No cookies	Necessary (security)	None on your device	Sends us a report when the page hits an error.

Name
sb-…-auth-token
Type
Cookie (first party)
Category
Necessary
Lifetime
Up to 400 days, renewed while you stay signed in. Removed when you sign out.
Purpose
Keeps you signed in (Supabase).
Name
cw_cookie_consent
Type
localStorage
Category
Necessary
Lifetime
6 months, or until the policy version (now 2026-10) changes
Purpose
Remembers your cookie choice.
Name
sidebar:state
Type
Cookie (first party)
Category
Necessary
Lifetime
7 days
Purpose
Remembers whether the dashboard side menu is open.
Name
caterway-db
Type
IndexedDB
Category
Necessary
Lifetime
Up to 24 hours. Emptied when you sign out. Never created on a caterer’s customer pages.
Purpose
Keeps the events, quotes and products you opened in the dashboard, so they show at once and when your connection drops.
Name
caterway-offline-queue
Type
IndexedDB
Category
Necessary
Lifetime
Until the change is sent, then it is deleted. Never created on a caterer’s customer pages.
Purpose
Holds a dashboard change you made without a connection until it can be sent.
Name
cw_portal_lang
Type
Cookie (first party)
Category
Necessary
Lifetime
12 months
Purpose
Remembers the language you chose on a caterer’s public page.
Name
cw_code
Type
Cookie (first party)
Category
Necessary
Lifetime
30 days
Purpose
Keeps a campaign discount code you arrived with, so the price applies at signup.
Name
caterway_no_track
Type
localStorage
Category
Analytics
Lifetime
Until you clear it
Purpose
Marks a browser that has opened the dashboard, so we do not count our own users as visitors.
Name
caterway_session_id
Type
sessionStorage
Category
Analytics
Lifetime
Until you close the tab
Purpose
A random id that groups one visit’s page views. Not linked to your account.
Name
_clck
Type
Cookie (first party)
Category
Analytics
Lifetime
Set by Microsoft. See Microsoft's Clarity cookie list.
Purpose
Clarity: keeps a pseudonymous Clarity user id for this site.
Name
_clsk
Type
Cookie (first party)
Category
Analytics
Lifetime
Set by Microsoft
Purpose
Clarity: joins page views into one recorded session.
Name
CLID, MUID, ANONCHK, MR, SM
Type
Cookies (Microsoft domains)
Category
Analytics
Lifetime
Set by Microsoft
Purpose
Clarity: Microsoft’s own identifiers. Per Microsoft, Clarity does not use them for advertising.
Name
Vercel Analytics, Speed Insights
Type
No cookies
Category
Analytics
Lifetime
None on your device
Purpose
Page views and page speed, counted without cookies.
Name
cw_ref
Type
Cookie (first party)
Category
Marketing
Lifetime
30 days
Purpose
The caterer whose “Powered by CaterWay” link you followed, so we can credit them if you sign up.
Name
caterway_attribution
Type
sessionStorage
Category
Marketing
Lifetime
Until you close the tab
Purpose
The campaign tags and page your visit started on, saved with your account if you sign up.
Name
Turnstile
Type
Frame from challenges.cloudflare.com
Category
Necessary (security)
Lifetime
Set by Cloudflare
Purpose
Checks that a form is sent by a person. Per Cloudflare, it uses IP address, browser and TLS details only to detect bots.
Name
Sentry
Type
No cookies
Category
Necessary (security)
Lifetime
None on your device
Purpose
Sends us a report when the page hits an error.

8.4 The caterers' customer pages

The pages a caterer's customers use load no analytics or marketing tools and no cookie banner, whatever the visitor chose elsewhere. That covers the calculator (/c and /calculator), quotes (/q), order pages (/t), the caterer's public page (/p), and any of our pages embedded in a frame on the caterer's website. Nothing is stored on the visitor's device for us there.

Our server counts, per calculator and day, how often the calculator was opened, how often the send button reached us and how often a request was stored. It counts from the requests the visitor's browser makes anyway to load the calculator and send the request. Nothing runs in the browser for it and nothing is stored on the device. Each count keeps only the day, the country, the device type (phone, tablet or computer), and the website the calculator was opened from or embedded on. No IP address, name, contact detail, browser identifier or time of day is kept, so a count cannot be traced back to a person. Only the caterer's team and our administrators can read a calculator's counts. We use only totals across all calculators for ourselves. We keep the counts for 25 months (§12).

The fonts on the caterer's calculator and pages are served from our own servers. The visitor's browser does not contact Google Fonts or any other font service.

8.5 Page counts without cookies

Every time our server sends a page of caterway.io to a browser, it adds one to a daily count. It counts only real page loads, not search engine robots or pages the browser fetches in advance. From the request the browser sends anyway, it keeps:

the page, without anything after the question mark in the address;
the site you came from, as a domain only (for example google.com), and any campaign tags in the link (utm_source, utm_medium, utm_campaign);
your country, which our host Vercel works out from your IP address. We never see or keep the IP address itself;
the device type and browser family (for example phone, Safari), worked out from your browser's description of itself, which is then thrown away;
the first language your browser asks for.

Nothing is stored on or read from your device, and no identifier is created, so we cannot tell whether two page loads came from the same person, follow you between pages or recognise you on a later visit. Visits while you are signed in are not counted. The counts tell us how many people visit which pages and where they come from. We keep them for 25 months (§12). Our basis is legitimate interest, Art. 6(1)(f): knowing how the site is found and used, with no effect on you that you could notice. You can object by writing to support@caterway.io, but because nothing in the counts points to you, we cannot single out your page loads to remove them.

9. Email we send

We send account and service emails, such as signup confirmations, password resets, quote notifications and billing notices. You get these while you have an account. Marketing email goes only to those who said yes, and every one has an unsubscribe link. Our emails contain no open or click tracking.

10. Who receives personal data

We share data only with the service providers listed in §16, who process it on our behalf under contract, and with:

our accountant and lawyers, as far as their work needs it;
authorities, when the law requires it;
a buyer of our business, if Caterway is sold, under the same protection as this policy.

Within a caterer's workspace, team members see the data the workspace owner gives them access to.

11. Transfers outside the EU

Our database is in the EU (Paris) and our server functions run in the EU (Frankfurt). Some providers in §16 are based in the United States or work globally, so data can be processed outside the EU. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.

12. How long we keep data

The table says how long we keep each kind of data, from when the period starts, and why. Periods set by law are marked "statutory". The rest are our own judgment, based on the closest guidance from data protection authorities.

Data	Kept for	Counted from	Why
Your account and workspace	While the account exists	Account creation	To run the service.
The country detected at signup (not the IP address)	While the account exists	Signup	Sanctions and other countries’ data transfer rules (§5).
Our ledgers and financial statements	10 years	End of the financial year	Statutory: Accounting Act (kirjanpitolaki 1336/1997), chapter 2, section 10.
Our billing vouchers: our invoices to you and payment receipts	6 years	End of the year in which the financial year ended	Statutory: Accounting Act, chapter 2, section 10, and VAT Act (arvonlisäverolaki), section 209 n.
Your account after you close it	At most 30 days, then deleted	Closure	Time to export your data or undo a mistaken closure.
A free account that is never used	We warn you after 24 months without a sign-in, then delete it	Your last sign-in	The French data protection authority (CNIL) considers 2 years proportionate.
Proof of our contract with you: each acceptance of the Terms and the Data Processing Agreement (the terms acceptance log), and your plan history	3 years	Closure, or the due date of your last invoice, whichever is later	The general limitation period for claims (Act 728/2003).
Your customers’ quote requests that were never answered, never accepted, or were declined	12 months by default. You can choose 3 to 36 months, or switch their automatic deletion off.	Event date, or the request date if there is no event	They never became a contract. We show a notice on your dashboard 30 days before we delete them.
Accepted quotes and orders	6 years	End of the calendar year of the event, or of the request if there is no event date	Business correspondence for a sale, which the Accounting Act requires to be kept (chapter 2, section 10, subsection 2). Nothing with an invoice or payment request is deleted automatically.
E-signature IP address and browser on an accepted quote	3 years	Event date, or the last payment due date if later	Proof of the contract while claims are still possible. After that only these two details are removed; the rest of the quote stays.
Invoices and payment requests you issue to your customers	While your account is open, plus the 30-day closing period, when you can download them with Download all data	Closure	Your own bookkeeping law sets how long you must keep them, for example 6 years in Finland, 7 in Sweden, 5 in Norway and 10 in Switzerland. Keep your own copies. We are not your archive.
Named guests’ diet and allergy details, and free-text diet notes	90 days by default. The caterer can choose 30 to 365 days. Counts without names stay with the quote.	Event date, or the request date if there is no event	Special-category data, collected only with the customer’s explicit consent (§7) and kept only for the complaint window.
Quote messages and your notes on a quote	As long as the quote they belong to	As for the quote	Part of the contract file.
Other data about your customers	While your account is open, unless you delete it sooner	When you add it	You decide. We process it for you under the Data Processing Agreement.
Log of emails sent	12 months	Send date	Proof of delivery, and handling abuse.
Security and error logs	At most 12 months	The event	CNIL’s logging guidance: 6 to 12 months.
Analytics events and page views from consented browser statistics	13 months, then only anonymous totals	The event	Allows a year-on-year comparison. CNIL caps audience data at 25 months.
Daily page and calculator counts made on our server (§8.4, §8.5)	25 months	The day counted	Counts only, with no IP address or identifier. CNIL caps audience statistics at 25 months.
Rate-limit records	7 days	End of the limit window	Abuse prevention only.
Your cookie choice, in your browser	6 months, then we ask again	Your choice	CNIL’s guidance. Traficom asks for a period that matches typical use.
The receipt of your cookie choice on our server (no IP address)	6 months plus 3 years	Your choice	To prove consent within the limitation period (EDPB Guidelines 05/2020, paragraph 107).
Marketing email consent log	As long as we need to prove your consent	Your choice	To show that you agreed, and when.
Prospects in our sales CRM who never replied	12 months	Our last email to them, or when we added them if we never emailed	They never engaged, so we keep them for less than CNIL’s 3-year ceiling.
Prospects in our sales CRM who replied	3 years	Their last contact with us	CNIL’s guidance for prospects.
Do-not-contact list (hashed email addresses)	As long as we contact businesses about Caterway	The opt-out	Needed to honour a “no”. A hashed address is still personal data, so we list it here.
Menu tool leads	24 months	The last interaction	The person showed interest in Caterway.
Admin audit log	2 years	The event	Accountability for our access to caterers’ data.
Privacy requests and our answers	3 years	Our answer	Proof within the limitation period.
Database backups	About 7 days (daily backups on our database provider’s Pro plan)	The backup	Deleted data drops out as old backups roll off. We keep a register of deletions and apply it again after any restore.

Data
Your account and workspace
Kept for
While the account exists
Counted from
Account creation
Why
To run the service.
Data
The country detected at signup (not the IP address)
Kept for
While the account exists
Counted from
Signup
Why
Sanctions and other countries’ data transfer rules (§5).
Data
Our ledgers and financial statements
Kept for
10 years
Counted from
End of the financial year
Why
Statutory: Accounting Act (kirjanpitolaki 1336/1997), chapter 2, section 10.
Data
Our billing vouchers: our invoices to you and payment receipts
Kept for
6 years
Counted from
End of the year in which the financial year ended
Why
Statutory: Accounting Act, chapter 2, section 10, and VAT Act (arvonlisäverolaki), section 209 n.
Data
Your account after you close it
Kept for
At most 30 days, then deleted
Counted from
Closure
Why
Time to export your data or undo a mistaken closure.
Data
A free account that is never used
Kept for
We warn you after 24 months without a sign-in, then delete it
Counted from
Your last sign-in
Why
The French data protection authority (CNIL) considers 2 years proportionate.
Data
Proof of our contract with you: each acceptance of the Terms and the Data Processing Agreement (the terms acceptance log), and your plan history
Kept for
3 years
Counted from
Closure, or the due date of your last invoice, whichever is later
Why
The general limitation period for claims (Act 728/2003).
Data
Your customers’ quote requests that were never answered, never accepted, or were declined
Kept for
12 months by default. You can choose 3 to 36 months, or switch their automatic deletion off.
Counted from
Event date, or the request date if there is no event
Why
They never became a contract. We show a notice on your dashboard 30 days before we delete them.
Data
Accepted quotes and orders
Kept for
6 years
Counted from
End of the calendar year of the event, or of the request if there is no event date
Why
Business correspondence for a sale, which the Accounting Act requires to be kept (chapter 2, section 10, subsection 2). Nothing with an invoice or payment request is deleted automatically.
Data
E-signature IP address and browser on an accepted quote
Kept for
3 years
Counted from
Event date, or the last payment due date if later
Why
Proof of the contract while claims are still possible. After that only these two details are removed; the rest of the quote stays.
Data
Invoices and payment requests you issue to your customers
Kept for
While your account is open, plus the 30-day closing period, when you can download them with Download all data
Counted from
Closure
Why
Your own bookkeeping law sets how long you must keep them, for example 6 years in Finland, 7 in Sweden, 5 in Norway and 10 in Switzerland. Keep your own copies. We are not your archive.
Data
Named guests’ diet and allergy details, and free-text diet notes
Kept for
90 days by default. The caterer can choose 30 to 365 days. Counts without names stay with the quote.
Counted from
Event date, or the request date if there is no event
Why
Special-category data, collected only with the customer’s explicit consent (§7) and kept only for the complaint window.
Data
Quote messages and your notes on a quote
Kept for
As long as the quote they belong to
Counted from
As for the quote
Why
Part of the contract file.
Data
Other data about your customers
Kept for
While your account is open, unless you delete it sooner
Counted from
When you add it
Why
You decide. We process it for you under the Data Processing Agreement.
Data
Log of emails sent
Kept for
12 months
Counted from
Send date
Why
Proof of delivery, and handling abuse.
Data
Security and error logs
Kept for
At most 12 months
Counted from
The event
Why
CNIL’s logging guidance: 6 to 12 months.
Data
Analytics events and page views from consented browser statistics
Kept for
13 months, then only anonymous totals
Counted from
The event
Why
Allows a year-on-year comparison. CNIL caps audience data at 25 months.
Data
Daily page and calculator counts made on our server (§8.4, §8.5)
Kept for
25 months
Counted from
The day counted
Why
Counts only, with no IP address or identifier. CNIL caps audience statistics at 25 months.
Data
Rate-limit records
Kept for
7 days
Counted from
End of the limit window
Why
Abuse prevention only.
Data
Your cookie choice, in your browser
Kept for
6 months, then we ask again
Counted from
Your choice
Why
CNIL’s guidance. Traficom asks for a period that matches typical use.
Data
The receipt of your cookie choice on our server (no IP address)
Kept for
6 months plus 3 years
Counted from
Your choice
Why
To prove consent within the limitation period (EDPB Guidelines 05/2020, paragraph 107).
Data
Marketing email consent log
Kept for
As long as we need to prove your consent
Counted from
Your choice
Why
To show that you agreed, and when.
Data
Prospects in our sales CRM who never replied
Kept for
12 months
Counted from
Our last email to them, or when we added them if we never emailed
Why
They never engaged, so we keep them for less than CNIL’s 3-year ceiling.
Data
Prospects in our sales CRM who replied
Kept for
3 years
Counted from
Their last contact with us
Why
CNIL’s guidance for prospects.
Data
Do-not-contact list (hashed email addresses)
Kept for
As long as we contact businesses about Caterway
Counted from
The opt-out
Why
Needed to honour a “no”. A hashed address is still personal data, so we list it here.
Data
Menu tool leads
Kept for
24 months
Counted from
The last interaction
Why
The person showed interest in Caterway.
Data
Admin audit log
Kept for
2 years
Counted from
The event
Why
Accountability for our access to caterers’ data.
Data
Privacy requests and our answers
Kept for
3 years
Counted from
Our answer
Why
Proof within the limitation period.
Data
Database backups
Kept for
About 7 days (daily backups on our database provider’s Pro plan)
Counted from
The backup
Why
Deleted data drops out as old backups roll off. We keep a register of deletions and apply it again after any restore.

Outside the EU. We use this one table for every account, wherever you are. What differs by country is your own bookkeeping period. You keep your own copies of what your law requires, and we let you export your data before we delete it.

You can delete your account in Settings > Account. The account closes at once: your calculators go offline and stop taking requests. 30 days later we delete the account, the workspace's data and every file you uploaded. Until then you can sign in, cancel the deletion or download all your data. We email you when you ask and again 3 days before the date. We keep our own billing records and the proof of our contract for the periods above.

13. Security

What we actually do:

All traffic uses HTTPS, and browsers are told to use HTTPS only (HSTS).
The database is in the EU. Each workspace's data is separated by row-level security in the database.
Our database provider encrypts stored data and takes daily backups.
Passwords are handled by our sign-in provider and stored only as hashes.
You can turn on two-factor authentication (an authenticator app) for your account.
Card payments happen on Stripe's hosted pages. Card details never reach our servers.
Sign-in, signup and the quote request form are protected by a bot check. Our sign-in provider limits repeated sign-in attempts, and AI features have usage limits.
We monitor errors so we can fix them quickly.

No system is completely secure. If a breach puts your rights at risk, we tell you and the Data Protection Ombudsman as the GDPR requires.

14. Your rights

Under the GDPR you have the right to:

see the data we hold about you (Art. 15);
have it corrected (Art. 16);
have it deleted (Art. 17), unless we must keep it, for example for bookkeeping;
restrict its processing (Art. 18);
get it in a machine-readable form (Art. 20);
object to processing based on legitimate interest, and to direct marketing at any time (Art. 21);
withdraw consent at any time, without affecting what happened before.

Much of this you can do yourself: edit your profile, change cookie choices, unsubscribe from marketing email, download all your data in one file (Settings > Account > Download all data), or delete your account. For anything else, email support@caterway.io. We answer within one month. If a request is complex, we may extend this by two months and tell you why (GDPR Art. 12(3)). We may ask you to confirm your identity.

15. Data Processing Agreement

When a caterer stores their customers' data in Caterway, our Data Processing Agreement governs how we process it. It covers everything GDPR Art. 28 requires, and you accept it when you create an account.

16. Subprocessors and service providers

These providers process personal data for us. The last column says whether they can receive a caterer's customers' data. The same list, with a change log, is at caterway.io/subprocessors. We give account owners 30 days' notice by email before we add or replace a provider that handles customers' data.

Provider	Purpose	Location	Personal data	Your customers’ data?
Supabase, Inc.	Database, sign-in, file storage and server functions.	EU: Paris, France (AWS eu-west-3).	Everything stored in the service, including your customers’ data.	Yes
Vercel Inc.	Hosts the website and app. With analytics consent only: Vercel Analytics and Speed Insights on caterway.io and the dashboard.	Server functions in the EU (Frankfurt, fra1). Pages are delivered through Vercel’s global edge network.	Web requests, including IP address and the content of the pages and forms in transit.	Yes
Resend, Inc.	Sends all email from the service, including quotes and confirmations to your customers.	EU: Ireland (eu-west-1). Resend, Inc. is a US company, so this is a transfer outside the EU, covered by Resend’s data processing agreement and the EU standard contractual clauses.	Recipient names and email addresses, and the email content.	Yes
Stripe Payments Europe, Limited	Caterway subscription billing. Card details go straight to Stripe’s hosted pages.	EU: Ireland. Stripe may transfer the data within the Stripe group, including to the United States, under Stripe’s own data processing agreement.	The caterer’s billing details. Not your customers’ data.	No
Google Cloud (Gemini Enterprise Agent Platform, formerly Vertex AI)	AI features you start yourself: menu import, order import and text drafting. Also Caterway’s own sales CRM (classifying and summarising replies).	EU: Google Cloud’s EU multi-region. Google documents that this endpoint keeps ML processing within EU member states. Runs in Caterway’s own Google Cloud project under Google Cloud’s data processing terms.	The files and text you submit. Order import: your customers’ names, phone numbers, email addresses, event addresses and order notes, as written in the photo or text you upload. CRM: prospects’ emails.	Yes
Google (Gmail API)	Syncs Caterway’s own sales mailbox with its CRM.	Google’s global infrastructure.	Correspondence with prospects. Not your customers’ data.	No
Sentry (Functional Software, Inc.)	Error monitoring. Session replay is off.	EU: Germany (Sentry’s EU data region).	IP address, browser, the page address and technical details of the error. An error report can include data that was on the page.	Yes
Cloudflare, Inc. (Turnstile)	Bot check on sign-in, signup and the quote request form.	Global.	IP address, browser details and similar technical signals.	Yes
Microsoft (Clarity)	Session analytics on caterway.io and the dashboard, only with analytics consent. Never on your customers’ pages.	United States.	Clicks, scrolling and page views, IP address and device details.	No
Web push services (Apple, Google, Mozilla)	Deliver the push notifications a caterer turns on for their own devices.	Global.	Notification text, which can include a customer’s name.	Yes

Provider
Supabase, Inc.
Purpose
Database, sign-in, file storage and server functions.
Location
EU: Paris, France (AWS eu-west-3).
Personal data
Everything stored in the service, including your customers’ data.
Your customers’ data?
Yes
Provider
Vercel Inc.
Purpose
Hosts the website and app. With analytics consent only: Vercel Analytics and Speed Insights on caterway.io and the dashboard.
Location
Server functions in the EU (Frankfurt, fra1). Pages are delivered through Vercel’s global edge network.
Personal data
Web requests, including IP address and the content of the pages and forms in transit.
Your customers’ data?
Yes
Provider
Resend, Inc.
Purpose
Sends all email from the service, including quotes and confirmations to your customers.
Location
EU: Ireland (eu-west-1). Resend, Inc. is a US company, so this is a transfer outside the EU, covered by Resend’s data processing agreement and the EU standard contractual clauses.
Personal data
Recipient names and email addresses, and the email content.
Your customers’ data?
Yes
Provider
Stripe Payments Europe, Limited
Purpose
Caterway subscription billing. Card details go straight to Stripe’s hosted pages.
Location
EU: Ireland. Stripe may transfer the data within the Stripe group, including to the United States, under Stripe’s own data processing agreement.
Personal data
The caterer’s billing details. Not your customers’ data.
Your customers’ data?
No
Provider
Google Cloud (Gemini Enterprise Agent Platform, formerly Vertex AI)
Purpose
AI features you start yourself: menu import, order import and text drafting. Also Caterway’s own sales CRM (classifying and summarising replies).
Location
EU: Google Cloud’s EU multi-region. Google documents that this endpoint keeps ML processing within EU member states. Runs in Caterway’s own Google Cloud project under Google Cloud’s data processing terms.
Personal data
The files and text you submit. Order import: your customers’ names, phone numbers, email addresses, event addresses and order notes, as written in the photo or text you upload. CRM: prospects’ emails.
Your customers’ data?
Yes
Provider
Google (Gmail API)
Purpose
Syncs Caterway’s own sales mailbox with its CRM.
Location
Google’s global infrastructure.
Personal data
Correspondence with prospects. Not your customers’ data.
Your customers’ data?
No
Provider
Sentry (Functional Software, Inc.)
Purpose
Error monitoring. Session replay is off.
Location
EU: Germany (Sentry’s EU data region).
Personal data
IP address, browser, the page address and technical details of the error. An error report can include data that was on the page.
Your customers’ data?
Yes
Provider
Cloudflare, Inc. (Turnstile)
Purpose
Bot check on sign-in, signup and the quote request form.
Location
Global.
Personal data
IP address, browser details and similar technical signals.
Your customers’ data?
Yes
Provider
Microsoft (Clarity)
Purpose
Session analytics on caterway.io and the dashboard, only with analytics consent. Never on your customers’ pages.
Location
United States.
Personal data
Clicks, scrolling and page views, IP address and device details.
Your customers’ data?
No
Provider
Web push services (Apple, Google, Mozilla)
Purpose
Deliver the push notifications a caterer turns on for their own devices.
Location
Global.
Personal data
Notification text, which can include a customer’s name.
Your customers’ data?
Yes

17. Children

Caterway is a business service, and account holders must be at least 18. A caterer's guest details can include children, for example a child's diet. The caterer is responsible for that data.

18. If we have contacted you about Caterway

We contact catering businesses, restaurants and venues that might benefit from Caterway. GDPR Art. 14 asks us to tell you the following when we did not get your details from you.

What we hold: the business name, business ID, address, website and public contact details. For a named contact person: name, role, work email and phone. Our emails with you, and our notes.

Where it comes from: public business registers (the Finnish Trade Register and Business Information System, the Norwegian Brønnøysund Register Centre and the Danish CVR register), the business's own website, the contact data provider Apollo, and what you tell us.

Why and on what basis: to offer Caterway to businesses it may suit. Our legal basis is legitimate interest (GDPR Art. 6(1)(f)): we contact businesses about a business service, at work addresses, and every message tells you how to stop.

Who else sees it: our mailbox runs on Gmail, our database on Supabase, and Google's Gemini models help us sort and summarise replies (see §16).

How long: 12 months after our last email if you never replied, and 3 years after your last contact with us if you did. If you ask us to stop, we keep only what we need to make sure we never contact you again.

How to object: reply "no" to any of our messages, or email support@caterway.io. We stop, and add your address to our do-not-contact list. You also have the other rights in §14 and the right to complain in §20.

19. Changes to this policy

When we change this policy, we update the version and date at the top. If a change affects you materially, we email account owners before it takes effect. Earlier versions are available on request.

20. Complaints

If you think we handle your data wrongly, please tell us first. You can also complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi, tietosuoja@om.fi) or to the supervisory authority where you live or work.