Last updated: 29/07/2026

1. Who provides the service

Gastrali is a management platform for restaurants (full POS, kitchen app, waiter/handheld app, customer app for ordering and paying at the table, owner dashboard, statistics, reservations, shift planning and staff time tracking/clock-in) provided by Pablo Japón González, with address at C/Santiago Apóstol, 37 (Local), 21002 Huelva, Spain and national ID (DNI) 49111248S, hereinafter “Gastrali” or “the Provider”. Contact: contacto@gastrali.com.

2. Purpose and description of the service

These Terms govern the use of the Gastrali platform by restaurants that register to use its features — POS, kitchen app, waiter app, customer app (ordering and payment), owner dashboard and statistics, brand customisation, reservations, shift planning and staff time tracking — according to the plan subscribed to (Free, Pro or Premium), hereinafter “the Customer” or “the Restaurant”.

The Platform is intended exclusively for professionals and businesses in the hospitality sector who subscribe to the service in the course of their business activity. Gastrali may modify, improve or extend the Platform’s features at any time, provided this does not substantially reduce the essential features of the plan subscribed to by the Customer.

3. Acceptance

By registering and creating a restaurant account on Gastrali, you accept these Terms of Service in full, including the Personal Data Processing Agreement Annex (Section 10).

4. Registration and account

Access to the Platform requires prior registration of the Restaurant. The information entered must be accurate, complete and truthful, and the Restaurant undertakes to keep it up to date.

The Restaurant is responsible for keeping its login credentials safe and confidential, and for any activity carried out under its account. If the Restaurant authorises its staff to use the Platform (e.g. to clock in, manage shifts or use the POS), it will be solely responsible for that staff’s activity and for ensuring they comply with these Terms.

5. Subscription, prices and billing

Access to the advanced features requires subscribing to a paid plan (Pro or Premium) from those published on the Gastrali website. Prices are in euros and do not include VAT unless otherwise stated. They may be updated, in which case the Restaurant will be notified reasonably in advance of the next renewal.

Payment is made using the methods enabled on the Platform (card, through Stripe). In the event of non-payment, Gastrali may suspend access to the features of the subscribed plan until payment is settled.

5a. Specific conditions of the Free Plan

The Free Plan exists so that the Restaurant’s diners can discover and use Gastrali through the customer app (ordering via QR code at the table). For this reason, a Restaurant using the Free Plan undertakes to make the customer app (QR) available to its diners, and not to use it solely as an internal management tool without use by them.

Gastrali may monitor the use of the account (for example, whether diner orders have been recorded) to verify compliance with this condition. If an account on the Free Plan records no diner orders for a continuous period of 30 days, Gastrali may notify the Restaurant by email and, if the situation is not resolved within the following 7 days, temporarily restrict access to the account.

Gastrali also reserves the right to flag as a “suspicious account” and restrict access to any account in which it detects signs of fraud, abuse, anomalous activity or breach of Section 7 (Prohibited uses), notifying the Restaurant by email and stating the reason.

In both cases, the Restaurant may request a review or reactivation of its account by writing to contacto@gastrali.com. Restricting access never means deleting the Restaurant’s data, which is governed by the provisions of Section 6.

These conditions do not apply to the paid plans (Pro and Premium).

6. Term and termination

The contractual relationship remains in force for as long as the Restaurant keeps its account active. The Restaurant may cancel at any time from its dashboard or by contacting Gastrali.

After cancellation, Gastrali will keep the Restaurant’s data available for export for thirty (30) calendar days, after which it may be deleted, unless there is a legal obligation to retain it (e.g. the 4 years for clock-in records, as set out in the Annex in Section 10).

7. Prohibited uses

The Restaurant undertakes not to: (i) make fraudulent or unauthorised use of the Platform; (ii) attempt to access other restaurants’ data or restricted areas; (iii) reverse engineer, decompile or copy the Platform; (iv) introduce viruses or malicious code; (v) deliberately overload Gastrali’s systems; (vi) transfer its account to third parties without Gastrali’s prior authorisation.

8. Intellectual property

The Gastrali Platform (code, design, brand and structure) is the property of Gastrali. The Restaurant is granted a non-exclusive, non-transferable licence of use, valid for the duration of the subscription, solely to manage its own business.

The data the Restaurant enters into the Platform (reservations, staff, shifts, clock-ins, orders, etc.) is and remains the property of the Restaurant. Gastrali only processes it to the extent necessary to provide the service, in accordance with the Annex in Section 10.

9. Confidentiality

Both parties undertake to keep confidential any non-public information of the other party to which they have access by reason of the contract, during its term and for two years after it ends.

10. Annex — Personal Data Processing Agreement (Art. 28 GDPR)

When using Gastrali, the Restaurant processes personal data of its diners and its own staff through the platform. In this relationship, the Restaurant is the Data Controller (it decides what the data is used for) and Gastrali acts as the Data Processor (it processes the data on behalf of the Restaurant, following its instructions). This Annex governs that relationship in accordance with Article 28 of the GDPR.

10.1 Subject matter and duration

Gastrali will process the personal data needed to provide the subscribed service (reservations, shifts, clock-in and the related POS features) for as long as the contractual relationship between the Restaurant and Gastrali lasts.

10.2 Nature and purpose of the processing

Storage, consultation, modification and management of data through the Gastrali platform (POS, kitchen app, waiter app, customer app and admin portal), so that the Restaurant can:

  • Manage table orders and payments made by its diners through the customer app.
  • Manage its diners’ reservations.
  • Plan its staff’s work shifts.
  • Record its staff’s working hours (clock-in), in compliance with the legal obligation in Article 34.9 of the Spanish Workers’ Statute (Estatuto de los Trabajadores).
  • Manage cash movements and end-of-shift closings (Z Report).
  • Generate statistics about its own business.

10.3 Types of personal data processed

  • Diners (reservations): name, phone number, email (optional), number of people, reservation date and time, reservation notes.
  • Restaurant staff: name, internal access code, role/permissions, contracted hours, assigned schedule (shifts), clock-in/clock-out/break records and related comments.
  • Operational data linked to employees: cash movements and end-of-shift closing reports (Z Report) showing the name of the employee who opened/closed/operated the till; internal audit log (action performed, employee and date/time) to keep track of changes on the platform.

Under no circumstances is biometric data processed (clock-in is done with a code, not a fingerprint or facial recognition), nor any special categories of data under Article 9 GDPR.

Internal note (checked against the full database schema): tables such as Menu, Menus, Qrs, Registros_pedidos, confirmacionPago, mesa_state_cache, web_orders, web_previa_actions, factura_counter or Turnos_Config do not identify any natural person by name and are not considered personal data for the purposes of this Annex.

10.4 Categories of data subjects

The Restaurant’s diners and the Restaurant’s staff/employees.

10.5 Gastrali’s obligations as Processor

Gastrali undertakes to:

  • Process the data only according to the Restaurant’s instructions and for the purposes of this Annex, without using it for its own purposes.
  • Ensure that anyone authorised to process the data keeps it confidential.
  • Apply appropriate technical and organisational security measures (encryption in transit, access control, backups).
  • Assist the Restaurant so it can respond to requests from its diners or employees to exercise their rights (access, rectification, erasure, etc.).
  • Notify the Restaurant without undue delay of any personal data breach it becomes aware of.
  • Delete or return all personal data to the Restaurant once the service ends, unless there is a legal obligation to retain it (e.g. the 4 years required for clock-in records).
  • Not subcontract the processing to another processor without informing the Restaurant beforehand.

10.6 Own infrastructure and authorised sub-processors

The backend (API), the database and the real-time sync server (POS/Unity) run on Gastrali’s own server, managed directly by Gastrali, with no hosting sub-processor.

For specific functions of the service, Gastrali uses the following external providers, which act as sub-processors:

Provider Function Data accessed
Resend Sending transactional emails (reservation confirmations) Name, email, reservation details
Supabase Restaurant account authentication Email and name of the Restaurant account holder
Stripe Payment processing (subscription and diner payments) Payment data (Gastrali does not store full card details)
Netlify Hosting of the web admin portal and payment-related functions Data passing through the admin portal and the payment functions

Gastrali may update this list, informing the Restaurant reasonably in advance.

International data transfers: some of the providers above (Stripe, Netlify, Supabase, Resend) may transfer data outside the European Economic Area (EEA), typically to the United States. Depending on the provider, these transfers rely on the EU-U.S. adequacy framework (Data Privacy Framework) and/or Standard Contractual Clauses (SCCs) approved by the European Commission — mechanisms that these providers include in their own data processing agreements. Stripe is certified under the EU-U.S. Data Privacy Framework, with SCCs as a backup mechanism.

Location of Gastrali’s own server: the server where Gastrali hosts the backend, the database and the Unity server is located in Spain. As it is within the EU/EEA, no international data transfer clause is needed for this part of the infrastructure.

10.7 Security measures

Access to data restricted by authentication; encrypted communications (HTTPS); no biometric data is requested or stored; regular database backups.

11. Liability and availability

Gastrali will use reasonable means to keep the service available, without guaranteeing uninterrupted availability. The Restaurant is responsible for the accuracy of the data it enters and for meeting its own legal obligations as an employer (working-time records, employment law) and as data controller towards its diners and employees.

Gastrali’s total liability to the Restaurant for any claim arising from these Terms will not exceed the amount paid by the Restaurant to Gastrali in the twelve (12) months before the event giving rise to the claim. Gastrali will not be liable for indirect damages, loss of profits or loss of business.

12. Changes

Gastrali may modify these Terms, notifying Restaurants reasonably in advance. Continued use of the platform after the notification means acceptance of the new Terms.

13. Assignment

The Restaurant may not assign its rights and obligations under these Terms without Gastrali’s prior consent.

14. Severability and entire agreement

If any clause of these Terms is declared void or unenforceable, the rest will remain in force. These Terms, together with the Privacy Policy and the Data Processing Agreement Annex, constitute the entire agreement between the parties.

15. Governing law and jurisdiction

These Terms are governed by Spanish law. For any dispute, both parties submit to the Courts and Tribunals of Huelva (Spain).

This is an English translation provided for convenience. In the event of any discrepancy, the Spanish version shall prevail.