NowOS privacy policy.

Data controller and our role

For user accounts, security, support, product improvement, and this website, the data controller is EATNOW, a French simplified joint-stock company (SAS) with share capital of €500, registered with the Paris Trade and Companies Register under number 990 635 096, EU VAT number FR94990635096, with registered office at 60 rue François Ier, 75008 Paris, France.

When NowOS processes customer, reservation, order, or sales data on behalf of a merchant, that merchant remains the controller of this business data and EATNOW acts as its processor under the agreement entered into with the merchant.

Data protection contact: privacy@eat-now.app

Data we process

The categories processed depend on the features used and the information supplied by the merchant, its staff, or its customers.

• Account and permissions: name, work email address, internal identifier, role, organization, and assigned location.
• Device and pairing: device identifier and name, model, operating system and app version, register role, connection status, and technical information required for local-network pairing.
• Point-of-sale activity: catalog, orders, sales, payment amounts and tender types, refunds, business days, cash movements, stock, printing, and fiscal data.
• Customers and reservations: name, telephone number, email address, reservations, visit history, prepayments, internal notes and, when supplied, allergies or preferences.
• Invoicing: personal or company name, address, email address, tax identifiers, and VAT number entered to issue an invoice.
• Diagnostics and usage: pseudonymous technical identifiers, screens and actions used, operation duration, app version, performance, errors, crashes, and connectivity state.
• Support: problem category, optional comment, and technical context attached to a report. Assistance requests opened from the backoffice also include the messages you write and the page you were on; they are answered by an AI assistant and are shared with your organization, not private to you — see “AI assistance” below.
• Website and commercial contact: page path, language, page family, navigation source, call-to-action interactions, and the information you choose to provide by email or through Calendly when requesting a demonstration.

Data we do not collect

NowOS does not collect full payment-card numbers, perform advertising tracking, or use screen or audio recording. Payment records contain the amount, tender type, status, and provider references needed to operate the point of sale, not the card number.

The camera is used only to scan pairing QR codes and product barcodes. Images are processed for that purpose and are not uploaded. Bluetooth and local-network access are used only when a connected device or supported peripheral requires them.

Purposes and legal bases

• Performance of the service contract: provide the app and backoffice, authenticate authorized users, operate registers locally, synchronize business data, offer support, and manage the commercial relationship.
• Legal obligations: issue and retain sales, invoicing, fiscal, and accounting information where applicable.
• EATNOW’s legitimate interests: secure the service, prevent misuse, diagnose incidents, and perform limited measurement of product and website reliability and usage.
• Pre-contractual steps: answer enquiries and organize a demonstration requested by a prospective customer.

Local operation and audience measurement

Operational data is stored on the register so the service can continue when internet access is unavailable. Paired devices communicate through the main register on the venue’s local network. Accepted activity is synchronized with the NowOS backoffice when a connection is available.

When PostHog is enabled, the website records only page views, call-to-action clicks, and language changes. Autocapture, session replay, person profiles, performance monitoring, and SDK IP collection are disabled; persistence is kept in memory and Do Not Track is respected. No form field or message content is sent through this measurement.

AI assistance

Assistance requests opened from the NowOS backoffice are answered by an AI assistant. The message you write, the page you were on, and the earlier messages in that conversation are sent to Google’s Gemini model through the Vercel AI Gateway for the sole purpose of producing an answer. They are not used to train models.

These conversations belong to the organization, not to their author: any owner or manager of your organization can open, read and continue them. This is deliberate — it lets a colleague pick up a question you asked — but it means you should not put anything in them you would not show your management. Personal requests should go to privacy@eat-now.app instead.

The assistant answers from the NowOS documentation and from the context of the page you are on. It does not read your customer, reservation or sales data.

Data protection contact: privacy@eat-now.app

Recipients and service providers

Data is available only to authorized people at the relevant merchant and, when necessary, authorized EATNOW personnel. EATNOW uses technical providers for hosting, app distribution and updates, product analytics, diagnostics, AI assistance, and demonstration scheduling, including Railway, Expo/EAS, PostHog, Sentry, Vercel (AI Gateway), Google (Gemini model, reached through that gateway), and Calendly. Each provider receives only the data needed to perform its role and acts under its own contractual and security obligations.

Where a provider processes data outside the European Economic Area, EATNOW relies on the safeguards required by applicable law, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

Retention

• Account and configuration data: for the contractual relationship and then for the period needed to handle requests and legal obligations.
• Sales, invoice, and compliance data: for the fiscal, accounting, and evidentiary periods applicable to the merchant.
• Analytics, diagnostics, errors, and reports: for no more than 90 days, unless a specific incident must be kept longer to resolve it or establish or defend legal rights.
• Commercial enquiries: for the time needed to answer the request and follow up on the prospective business relationship, then deleted or archived in accordance with applicable limitation periods.
• Data held locally on a register: until it is synchronized, removed through an available deletion function, or the device is reset, subject to legally required retention.

Security

NowOS combines protected local storage, encrypted communications, limited technical identifiers, access controls, and cryptographic signatures. No measure removes all risk; EATNOW maintains procedures designed to prevent, detect, and handle unauthorized access, loss, or alteration.

Your rights

Depending on your circumstances, you may request access, correction, deletion, restriction, or portability of your personal data and object to certain processing. You may also lodge a complaint with the French Data Protection Authority, the CNIL.

For data managed by your employer or by a merchant with which you made a reservation or purchase, contact that merchant first. EATNOW may request only the information necessary to verify your identity and locate the relevant data.

Exercise your rights: privacy@eat-now.appContact the CNIL

Changes to this policy

This policy may change as NowOS features, providers, or legal requirements evolve. The date shown at the top of the page identifies the current version. Material changes will be communicated through an appropriate channel when required.