Privacy Policy

Xanner (“Xanner”, “we”, “us”) builds an in-venue ordering system: guests scan a QR code at their table, browse a menu, and place an order that a venue’s staff confirm, prepare, and deliver. This policy explains what information the Xanner platform — the website at xanner.co and the software we install at venues — handles, and how.

The short version

• Guests order without giving any personal details — no name, phone number, or email.
• Each venue’s data lives in its own isolated database and is never shared with other venues.
• We don’t sell data, and we don’t run advertising or cross-site tracking.
• The only personal data we hold about an individual is a staff member’s name and sign-in credential, and any email or message you send us to ask about access.

1. Who this policy covers

It covers three groups of people:

• Guests who order at a table using the QR menu.
• Venue staff and operators who use the Service Station, waiter, kitchen, and admin dashboards.
• Visitors to xanner.co who contact us or ask for access.

2. Information we handle

Guests ordering at a table

We deliberately collect no personal information from guests. An order records the items chosen, quantities, the table it came from, the amounts, and timestamps. That is operational data about an order, not about an identifiable person — we don’t ask for or store names, phone numbers, emails, or payment-card details.

Venue staff and operators

To sign in, a staff member has a display name and a PIN; operators and admins use a password. The system keeps an audit trail of key actions — for example confirming or cancelling an order, or opening and closing a session — so a venue can hold its own team accountable.

When you contact us

If you submit your email on xanner.co to request access, or email us directly, we receive that address and whatever you choose to include in your message. We use it only to reply and to discuss setting Xanner up for your venue.

Cookies

The dashboards use a single essential, signed session cookie to keep a signed-in staff or admin user logged in. We don’t use advertising, analytics, or cross-site tracking cookies, and the guest ordering page doesn’t require anyone to sign in.

3. How we use information

• Run the ordering loop — take orders, show them to the Service Station, and track preparation and delivery.
• Keep accounts secure and let a venue see who did what.
• Reconcile stock and takings at the end of each session.
• Respond to access requests and support questions.
• Diagnose problems and improve Xanner during the pilot.

We don’t use your information for advertising, and we don’t sell it to anyone.

4. Where your data lives

Xanner is designed to run on the venue’s own hardware — a small local server at the site — so the order loop keeps working without the internet. Where a venue uses our hosted option, data sits on a dedicated server we operate. In both cases each venue’s database is separate: one venue cannot see another’s menu, orders, staff, or takings.

5. Sharing

We don’t sell personal data. We share it only:

• with the venue whose workspace the data belongs to;
• with service providers who help us host or operate the platform, under confidentiality terms and only as needed; or
• where we are required to by law.

6. Keeping and deleting data

Operational data — orders, sessions, stock movements — is kept while it is useful to the venue for running and reconciling service, and the venue controls it. Access-request emails are kept while we are in touch about a possible rollout and for a reasonable period afterwards. You can ask us to delete personal data we hold about you (see Your rights). When a venue stops using Xanner, we work with them to return or delete their data.

7. Security

We design for least data and strong isolation: a separate database per venue, parameterised database queries, signed session cookies, and PINs and passwords that are stored hashed — never in plain text. No system is perfectly secure, but we take reasonable steps to protect the information we hold.

8. Your rights

Depending on where you are — and under the Nigeria Data Protection Act 2023 where it applies — you may have the right to access the personal data we hold about you, correct it, delete it, or object to certain uses. To exercise any of these, email privacy@xanner.co and we will respond.

9. Children

Xanner is a tool for venues and their staff. It is not directed at children, and the guest ordering page does not knowingly collect personal information from anyone.

10. Changes

We may update this policy as Xanner grows beyond the pilot. We will change the date at the top when we do, and we will make significant changes clear.

11. Contact

Questions about privacy? Email privacy@xanner.co.