Privacy Policy

Last updated: November 9, 2026 · Version 2026-11-09

This Privacy Policy explains how EBOX3 (brand REYSTI; "ebox3", "we", "us") collects and uses personal data when you visit our website, create an account, use the REYSTI platform, or order on a kiosk powered by REYSTI, or use a free REYSTI customer account (digital receipts). The REYSTI platform is offered to businesses only under our Terms of Service; customer accounts are governed by the Customer Terms and section 7A below.

1. Who we are

EBOX3, Apartat de correus 1033, AD500 Andorra, NIF L-714284-H. Contact for any privacy matter: legal@reysti.com. ebox3 is established in Andorra and is subject to the Andorran Law 29/2021 of 28 October on the protection of personal data (Llei 29/2021, qualificada de protecció de dades personals). Andorra benefits from an adequacy decision of the European Commission. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing, we comply with it as well.

2. Our two roles: controller and processor

• Controller: for data about our business customers (restaurant owners, their staff and contacts), website visitors, people who contact us and people who apply for a trial. This policy describes that processing.
• Processor: for data about the customers of restaurants ("End Customers") who order on a kiosk or other ordering channel. Each restaurant is the controller of that data and decides why and how it is used; we process it only on the restaurant's instructions under our Data Processing Addendum. End Customers who wish to exercise their rights should contact the restaurant; if they contact us, we will forward the request to the restaurant. Sections 3.2, 6 and 7 describe this processing for transparency.

3. Data we collect

3.1 As controller

• Account and business data: business name, legal form, address, country, state, tax identification number, business type, name, e-mail address and phone number of the account holder and authorised users, password (stored as a hash), language and time zone.
• Billing data: subscription, plan, number of kiosks, add-ons, invoices, payment history. Card payments to us are handled by Redsys and our banks (Creand, MoraBanc) on their hosted payment pages: we never receive or store your full card number or security code; we receive a payment token, the card brand, masked digits, the expiry date and the transaction result.
• Usage and technical data: IP address, browser and device type, logs of sign-ins, actions in the back office, kiosk status and error reports, dates and times.
• Communications: messages sent through the contact form, by e-mail or to support, and your marketing preferences.

3.2 As processor (End Customers, on behalf of the restaurant)

• Order contents, order number, time, amount, taxes, delivery type (dine-in, take-away), table or pager number.
• Optional first name entered to call the order, and an optional phone number for an order-ready text message.
• Payment references returned by the restaurant's payment terminal (for example a transaction id and status). Card data is handled by the restaurant's own payment processor (for example SumUp or Square); we do not receive card numbers.
• Voice audio, only while it is transcribed (section 6), and the resulting text of the order.
• Loyalty identifiers (e-mail or phone number) and loyalty points balances, where the restaurant uses such a feature and the End Customer chooses to take part.
• Names, PIN-based sign-ins and activity logs of the restaurant's staff using the waiter, kitchen and back office applications.

3.3 Sources

We receive personal data directly from you (forms, account, support), from the restaurant you work for or order from (as processor), automatically from your device when you use our website, applications or kiosks (technical data and logs), and from our payment banks (payment results).

4. Purposes and legal bases (controller processing)

Our legitimate interests are running a secure and profitable business, preventing abuse and improving our products. We do not use automated decision-making that produces legal effects on you.

5. AI features

Some features send content to third-party AI service providers (currently OpenAI, L.L.C. and Anthropic, PBC, for voice transcription and interpretation, menu import from photos, texts, translations and menu design, and AI image-generation services for product photos). We send only what the feature needs (for example menu text, product photos, voice audio or an order transcript). Under the business terms of these providers, data sent through their business APIs is not used to train their models. AI results are suggestions that the restaurant must review; we do not use AI to make decisions about individuals. Please do not include personal data in menu content, images or prompts.

6. Voice ordering

When an End Customer presses the voice-ordering button, the kiosk records the spoken order and sends the audio to an AI provider to transcribe and interpret it. The audio is not stored by ebox3 after the order has been interpreted; the AI provider processes it only to return the transcript and may keep it for a short period for abuse monitoring under its own terms. We keep the order and, where the restaurant enables it, the text transcript in the order log. We do not create voiceprints, do not use voice to identify or recognise anyone, and do not collect biometric identifiers or biometric information within the meaning of the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act, Washington RCW 19.375 or similar laws. Voice ordering is optional; End Customers can always order by touch.

7. Text messages

If an End Customer enters a phone number on a kiosk, it is used only to send transactional messages about that order (for example "your order is ready"), under the consent line shown on the kiosk. It is never used for marketing by ebox3. Message and data rates may apply. The restaurant is the controller of this number.

7A. REYSTI customer accounts (digital receipts)

Customers of restaurants and shops that use REYSTI can scan the QR code of their ticket to see a digital copy of it and can create a free REYSTI customer account to keep their tickets from every venue that uses REYSTI (pages /t/..., /my-tickets, and later the REYSTI customer app). The Customer Terms apply to these accounts.

Who is responsible

ebox3 is the controller of the customer account (the account itself, the e-mail address, the saved-ticket list and the marketing consent). Each venue remains the controller of its own orders and bills, which ebox3 processes for it as processor (section 2). Deleting a customer account does not delete the venue's records of the purchase.

Data we process

• Account: a random customer id, e-mail address, optional display name, language, creation and last sign-in dates, account status.
• Marketing consent: whether you opted in (off by default), the date and time (UTC), the version of the consent text you saw and where you gave it (a venue's ticket page, the website or the app), and a private unsubscribe key.
• Sessions: sign-in sessions of up to 180 days; we keep only a one-way hash of each session token. On the website the token and your e-mail are kept in your browser's local storage.
• Saved tickets: for each ticket you save: the ticket link, order reference, venue name and logo, order number, total, currency and dates.
• Pending sign-ins: e-mail address, a hashed 6-digit code, language, the page to return to, the ticket to save and your consent choice. A sign-in link is valid for 15 minutes and single use.
• Loyalty points: where a venue offers a loyalty programme, the points you earn and use at that venue, linked to your account. The venue runs the programme and is the controller of this data; we keep it for the venue as processor (Customer Terms, section 5).
• Ticket links (/t/{code}): a read-only view of the order that contains no personal data; it stays available for 90 days, or as long as it is saved in an account.

Purposes and legal bases

Marketing: we send marketing e-mails only if you ticked the separate opt-in box. They are sent by ebox3 under the REYSTI name; we do not give your e-mail address to the venues or to anyone else for their own marketing. Every marketing e-mail contains a one-click unsubscribe link (/t/unsubscribe/...), and you can also switch marketing off at any time in /my-tickets. Withdrawing consent does not affect your account or your tickets. Service e-mails (sign-in links, security notices) are not marketing and are sent without consent.

Retention

• Account and consent records: until you delete the account (inactive accounts may be deleted after a long period of inactivity, with prior e-mail notice). Proof of a withdrawn consent may be kept for as long as needed to demonstrate compliance.
• Saved tickets: until you remove them or delete your account.
• Pending sign-ins: valid 15 minutes, purged after about one day.
• Ticket links: 90 days, or while saved in an account.

Your rights and deleting your account

You have the rights described in sections 12 and 13. You can delete your account yourself at any time in /my-tickets; this removes your profile, consents, sessions, saved tickets and pending sign-ins. The venues' orders and bills are kept by the venues as their own records. For questions about a purchase, contact the venue; for your account, e-mail legal@reysti.com.

United States

Our marketing e-mails comply with the CAN-SPAM Act: they identify the sender, contain our postal address and a working unsubscribe link, and opt-outs are processed within 10 business days (in practice immediately). We do not sell or share customer account data (see section 13).

Children

Customer accounts are not intended for anyone under 16. We do not knowingly collect personal data from children under 13 (US Children's Online Privacy Protection Act) or under 16 without the consent required by law. If you believe a child created an account, e-mail us and we will delete it.

Future customer app

A REYSTI customer app (ordering, payment, loyalty points, discounts and promotions) is planned. Before those features process new categories of data, we will update this policy and, where required, ask for your consent.

8. Recipients and service providers

We do not sell personal data. We share it only with the following categories of recipients, each bound by contract to use it only to provide their service to us:

• cloud hosting, database and storage: Microsoft Azure (EU regions where available);
• payments to ebox3: Redsys, through our Andorran banks Creand and MoraBanc (for our own subscription fees only);
• AI service providers (currently OpenAI, L.L.C. and Anthropic, PBC) and AI image-generation services (section 5);
• e-mail and SMS delivery providers, to send service e-mails, digital tickets, marketing e-mails you opted in to and order-ready text messages;
• the restaurant concerned, for End Customer data, and the payment processor chosen by that restaurant (for example SumUp or Square), which acts under its own contract with the restaurant and its own privacy policy;
• professional advisers, auditors, insurers, and authorities or courts where required by law or to protect our rights;
• a buyer or successor in case of a merger, acquisition or sale of all or part of our business, which will be bound by this policy for the data transferred.

The categories of sub-processors are listed in our Data Processing Addendum. We keep an up-to-date list of the providers we use, available on request at legal@reysti.com, and we inform our business customers at least 30 days before a new sub-processor processes their End Customers' data.

9. International transfers

Our service providers may process data outside Andorra, including in the European Union and the United States. Transfers rely on adequacy decisions (the EU and the countries recognised as adequate, the EU-US Data Privacy Framework where the recipient is certified) or on standard contractual clauses approved by the European Commission, together with any supplementary measures required, in accordance with Andorran law and, where applicable, the GDPR.

10. Retention

• Account data: for the duration of the contract, then up to 30 days for data export, then deleted or anonymised, except what we must keep.
• Invoices, payments and accounting records: as long as required by tax and accounting law (generally up to 10 years).
• End Customer order data: as instructed by the restaurant and the Data Processing Addendum; deleted after the end of the restaurant's contract and the export window. Restaurants can delete an End Customer's phone number from the back office.
• Voice audio: not stored (section 6).
• Logs and security data: generally up to 12 months.
• Data needed for legal claims: until the end of the applicable limitation period.

11. Security

We use appropriate technical and organisational measures, including encrypted connections (HTTPS), access control, hashed passwords, tokenised payments, least-privilege access and backups. No system is completely secure; we cannot guarantee absolute security. If a personal data breach occurs, we will notify the authorities and the people concerned where the law requires it (and, for End Customer data, the restaurant concerned, as described in the Data Processing Addendum). You are responsible for keeping your own passwords, codes and mailbox secure.

12. Your rights (Andorra, EU/EEA, UK)

Subject to the conditions of the law, you have the right to access your data, rectify it, erase it, restrict or object to its processing (including at any time to direct marketing), receive it in a portable format, and withdraw any consent you gave (without affecting earlier processing). To exercise them, e-mail legal@reysti.com; we may ask you to prove your identity. We answer within one month (extendable where the law allows). Exercising your rights is free, unless a request is manifestly unfounded or excessive. You may also complain to the Andorran Data Protection Agency (Agència Andorrana de Protecció de Dades, APDA, www.apda.ad), which is our supervisory authority, or, where the GDPR applies, to the supervisory authority of the country where you live or work. We would appreciate the chance to deal with your concern first.

Where we process your data as processor for a restaurant (End Customer data), please send your request to that restaurant; if you send it to us, we forward it to the restaurant without undue delay.

13. Notice for US residents

We do not sell or share personal information, as the terms "sell" and "share" are defined in the California Consumer Privacy Act as amended by the CPRA, and we do not use personal information for targeted (cross-context behavioural) advertising or profiling with legal effects. We do not use or disclose sensitive personal information for purposes other than those permitted by law. The categories of personal information we collect, their sources, purposes and recipients are described in sections 3, 4 and 8, and our retention periods in section 10.

Depending on your state of residence (for example California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws) and to the extent those laws apply to us, you may have the right to know or access, correct, delete and obtain a copy of your personal information, to opt out of sale, sharing, targeted advertising and profiling, and to appeal our decision. We will not discriminate against you for exercising these rights. Send requests to legal@reysti.com; an authorised agent may act for you with proof of authorisation. We verify requests by matching information you provide with the information we hold (for example by e-mail confirmation from the account address). If we refuse a request you may appeal by replying to our answer; if the appeal is denied, you may contact your state Attorney General. For End Customer data, we act as service provider/processor of the restaurant and will forward your request to it.

Notice at collection (California). In the last 12 months we collected the following categories of personal information: identifiers (name, e-mail, phone number, IP address, account ids); commercial information (subscriptions, orders, saved tickets); internet or network activity (logs of use of our website and applications); audio information (voice orders, only while transcribed); and professional information (business name and role). We collect them for the purposes in sections 4 and 7A, disclose them for business purposes to the categories of recipients in section 8, and keep them for the periods in section 10. Because we do not sell or share personal information, there is no "Do Not Sell or Share" link; we also honour browser opt-out preference signals (such as Global Privacy Control) where the law requires it.

14. Cookies and local storage

Our website uses only first-party cookies and browser storage that are necessary for it to work or that remember your choices. We do not use analytics, advertising or third-party tracking cookies, and our fonts are hosted on our own servers.

When you pay us, the payment page of Redsys or of our bank opens inside or from our website and may set its own cookies, which are necessary for the payment and governed by their own policies. Because we use only necessary and preference storage, no consent banner is required; you can block or delete cookies in your browser settings, but signing in and the setup wizard may then not work.

15. Children

Our website and back office are intended for businesses and are not directed to children. We do not knowingly collect personal data from children under 16 (under 13 in the United States) as controller. Kiosks are operated by restaurants for the general public; restaurants are responsible for their End Customers, and kiosks do not require personal data to order. REYSTI customer accounts are not intended for anyone under 16 (section 7A).

16. Changes to this policy

We may update this policy, for example when we add features, change providers or when the law changes. The date and version at the top show the latest version. We will inform account holders (business accounts and REYSTI customer accounts) of material changes by e-mail or in the service before they apply, and ask for your consent where the law requires it.

17. Contact and complaints

EBOX3 (REYSTI), Apartat de correus 1033, AD500 Andorra, NIF L-714284-H. E-mail: legal@reysti.com.

© EBOX3 · Apartat de correus 1033, AD500 Andorra · NIF L-714284-H. All rights reserved.