Privacy policy

Last updated 30 October 2026

Who we are

Flow is run by Two Bit LTD (TwoBit Studio), 9000 Varna, Bulgaria. Contact: business@twobit-studio.com.

Two Bit LTD is the controller for restaurant owner accounts. For guest data, the restaurant is the controller and Flow is the processor. This means the restaurant decides why guest data is used. We only handle it on the restaurant's behalf.

What data we hold

• Owner account: email address and a password hash. Passwords are handled by Supabase Auth. We never see them.
• Restaurant data: menu, tables, staff names and PINs, orders, tabs, reviews and settings.
• Guests: guests have no accounts. Orders are tied to a table, not to a person. A guest may type a review text and a name. This is optional.
• Browser storage: your browser may keep small local data in localStorage, such as a login token and a cart. We use no advertising or tracking cookies.

Where data is stored

The website runs on Vercel (Frankfurt region). Supabase (Frankfurt, EU) holds the database, file storage for menu photos and logos, authentication and realtime.

AI cameras (optional)

Detection runs on the restaurant's own device. Only counts are sent, such as people or items per table zone. We do not store video or images. An optional live view is sent peer-to-peer (WebRTC) between the restaurant's own devices, on request. We do not store it.

Payments

Flow does not process payments today. If online payments are added later, they will be handled by Stripe. We will update this policy first.

Why we use data (legal bases)

• Running your account and the service: performance of a contract (Art. 6(1)(b) GDPR).
• Security, preventing abuse and keeping the service working: legitimate interests (Art. 6(1)(f)).
• Meeting legal duties, such as accounting: legal obligation (Art. 6(1)(c)).
• Guest data in a restaurant's orders and reviews: the restaurant chooses the legal basis, usually contract or legitimate interests.

Who processes data for us

• Vercel Inc. - website hosting, Frankfurt region.
• Supabase - database, file storage, authentication and realtime. Frankfurt, EU.
• Stripe - only if online payments are added in future.

We do not sell personal data.

How long we keep data

We keep data while the account is active. After a restaurant closes its account, we delete its data within 30 days. We keep something longer only if the law requires it.

Your rights

You can ask for access, correction, erasure, restriction or portability of your data. You can also object to how it is used. Email business@twobit-studio.com. If you are a guest, we may pass your request to the restaurant, because it is the controller.

You can also complain to the Bulgarian Commission for Personal Data Protection (CPDP): cpdp.bg.

Changes

We may update this policy. We will change the date at the top. For big changes we will tell restaurant owners by email.