ServeShift Privacy Policy

Effective date: 16 October 2026
Controller: GXLabs Kft., 6000 Kecskemét, Daróczi köz 13. 3. em. 80. ajtó, Hungary
Company registration no.: 03-09-137736
Tax no.: 11733759-2-03
Contact: info@gxlabs.hu
Website: https://serveshift.eu

1. Scope

This Privacy Policy explains how GXLabs Kft. processes personal data in connection with ServeShift, including the ServeShift website, Desktop application, Staff mobile application, Cloud service, guest-ordering website, account and subscription functions, support and security operations.

ServeShift is an offline-first restaurant operations platform. Restaurant operational data is primarily stored on the customer's Desktop installation and is synchronized to the Cloud for synchronization, backup, device authorization and related service functions.

2. Roles under GDPR

For website visitors, billing-account data, subscription administration, security, service administration and our own business communications, GXLabs Kft. generally acts as data controller.

For personal data that a restaurant customer enters into ServeShift for its own operational purposes (for example staff names, customer/guest information entered by the restaurant, order notes or other business records), the restaurant is generally the data controller and GXLabs Kft. acts as data processor to the extent we process that data on the restaurant's documented instructions. The restaurant remains responsible for having an appropriate legal basis and providing required notices to its staff and guests.

Where required by GDPR Article 28, the parties should also have an appropriate data-processing agreement. This Privacy Policy does not replace such an agreement.

3. Data we may process

Depending on how ServeShift is used, data may include:

• account and billing information: name, business name, billing address, country, e-mail address, tax/VAT number, billing language and subscription details;
• local user data: display name, roles, permissions, authentication and audit information;
• device and installation data: installation ID, device ID, client version, credential metadata, pairing and revocation status;
• restaurant data: venue profile, menu/catalogue, translations, tables, rooms, inventory, orders, payments, cash sessions, business-day records, expenses, reports and audit events;
• guest-ordering data entered by a venue or its guests, such as table reference, guest count, order notes and the content of an order;
• technical data: IP address, timestamps, request metadata, error/security logs and service-health information;
• payment and invoice metadata received from the payment provider. Card numbers and full payment credentials are not stored by ServeShift.

4. Purposes and legal bases

We process data where necessary to:

• provide and operate ServeShift;
• create and manage accounts and subscriptions;
• process payments and subscription invoices;
• synchronize restaurant data and maintain backups;
• authenticate installations, staff devices and users;
• prevent abuse, fraud and unauthorized access;
• provide support and troubleshoot technical issues;
• maintain audit trails and comply with legal obligations;
• communicate essential service, security, billing and account information.

Depending on the processing, the legal basis may be performance of a contract, compliance with a legal obligation, legitimate interests, or consent where consent is required.

5. Cloud synchronization and backups

The Desktop application is the primary operational authority. The Cloud receives authenticated synchronization events and full backups. Sync uses at-least-once delivery with idempotent ingestion. Backups include the local database snapshot, required application-managed files and metadata needed for restoration; credentials and secrets are not embedded in plaintext backups.

Backups are retained according to operational retention settings and are subject to integrity verification and restoration testing. A backup is not a substitute for the customer's own legal or operational retention obligations.

6. Guest ordering and local network

If a restaurant enables guest ordering, the guest website is served by the restaurant's Desktop installation over its local network. Guests do not receive a permanent account credential. A short-lived visit token is used to associate a guest with a table. Visit tokens expire after inactivity. Guest ordering data is primarily local to the restaurant and is synchronized to the Cloud according to the platform's normal synchronization rules.

The restaurant is responsible for configuring its local network appropriately and for informing guests about any processing for which it is the controller.

7. Payments and subscriptions

ServeShift subscription payments are processed through the configured payment provider. The current production architecture uses Stripe Billing for subscription invoices and payment processing. Stripe may process customer, billing and payment information under its own contractual and privacy terms.

ServeShift receives relevant billing and subscription metadata, such as customer/provider identifiers, subscription status, invoice identifiers, amounts, currency and payment status. ServeShift does not need to store full card details.

8. Service providers and recipients

We may use service providers necessary to operate the service, including cloud infrastructure/storage providers, payment and billing providers, e-mail providers when enabled, security/monitoring providers and professional advisers. Providers receive only the data necessary for their role and are subject to appropriate contractual and security arrangements where required.

Current infrastructure includes Railway-hosted Cloud components and Stripe for subscription billing.

9. International transfers

Where personal data is transferred outside the EEA, we use an appropriate GDPR transfer mechanism where required, such as an adequacy decision or appropriate contractual safeguards. The exact provider-specific transfer mechanisms may depend on the services enabled for the account.

10. Retention

We retain controller-side account, billing, security and legal records for as long as necessary for the relevant purpose and applicable legal limitation/retention periods. Restaurant operational data processed as a processor is retained according to the customer's configuration, contract and applicable instructions, subject to backup and security-retention cycles.

After termination, access may be restricted while data remains available for an appropriate transition/deletion period. Data may also remain in securely isolated backups until their scheduled expiry.

11. Data subject rights

Subject to applicable law, individuals may have rights of access, rectification, erasure, restriction, objection, data portability and withdrawal of consent where processing is based on consent. Requests concerning restaurant operational data should normally be directed to the relevant restaurant, as controller. Requests concerning GXLabs-controlled data may be sent to info@gxlabs.hu.

Individuals also have the right to lodge a complaint with a competent data-protection supervisory authority.

12. Security

We use technical and organisational measures appropriate to the risk, including authenticated Cloud access, tenant isolation, scoped device credentials, credential rotation/revocation, password hashing, rate limiting, audit logging, transactional local persistence, encrypted HTTPS connections to the Cloud and controlled backup access. LAN communication is subject to the deployment's local-network security configuration.

No system can guarantee absolute security.

13. Children

ServeShift is a business software service and is not directed to children. Restaurants must not intentionally use ServeShift to collect children's personal data unless they have a lawful basis and comply with applicable law.

14. Cookies and local storage

The ServeShift website may use browser local storage for language and similar functional preferences. We do not rely on non-essential tracking cookies for the core service unless a separately disclosed feature is introduced.

15. Changes

We may update this Privacy Policy when the service, law or processing activities change. The current version is published on https://serveshift.eu.

16. Contact

For privacy questions or requests:

GXLabs Kft.
6000 Kecskemét, Daróczi köz 13. 3. em. 80. ajtó, Hungary
E-mail: info@gxlabs.hu
Website: https://serveshift.eu