Privacy Policy
Sincliq Inc.1000 Northwest Street
Mid-Town Brandy Wine, Suite 1200
Wilmington, DE 19801
USA
hello@sincliq.com
Sincliq Inc. (Sincliq) explains how we handle personal information when you visit our website, contact us, use an account, buy services or interact with a business using Sincliq. Processing depends on the function used and our role. Reading this policy does not give consent.
1. Scope, responsible entity and applicable law
The controller for our own purposes is Sincliq Inc., 1000 Northwest Street, Mid-Town Brandy Wine, Suite 1200, Wilmington, DE 19801, USA. Contact: hello@sincliq.com; postal requests may use the same address. This version concerns the US market and the identified US company. Language does not change this entity. Applicable rights depend on the processing, territorial scope, your residence and statutory thresholds or exemptions, not simply a market selector. GDPR bases and rights below apply where the GDPR governs the activity. US provisions apply where the relevant law covers the business, information and individual.
2. Our role depends on the purpose
We are a controller for our business relationships, website, enquiries, own sales, billing and security purposes we determine. A venue normally controls its guest records, orders, reservations and employment administration; we handle entrusted records on documented instructions as its processor. A staff login can involve our own account security alongside processing for an employer. Applicable US service-provider or contractor restrictions may also govern entrusted data. Roles follow actual purposes, rather than simply whether someone is a guest or employee.
3. Categories and sources
You supply contact details, messages, account information and relevant order, delivery and billing details. Employers supply staff identities and permissions; venues and enabled partners supply guest, transaction, reservation and loyalty records. Browsers and service operations generate session identifiers, network information and technical events. Payment providers return references and status. Where we obtain information indirectly as controller, we provide Article 14 information normally within one month, or earlier at first contact or disclosure, unless a lawful exception applies.
4. Website delivery and technical security
Website requests involve IP addresses, requested pages, request times, browser or device information and diagnostic events where recorded. We use necessary technical information to deliver pages, investigate failures, prevent abuse and protect accounts. Our GDPR basis is Article 6(1)(f): legitimate interests in reliable operation and protection against unauthorized access, balanced against individual rights. Information needed for an individual's contracted service may instead fall under Article 6(1)(b). This does not authorize optional advertising or analytics tracking.
5. Accounts and authentication
Account functions use Supabase authentication and associated business records. Depending on the sign-in step, processing includes email, user identifiers, credentials, session tokens, verification events and security settings, including an additional authentication factor where used. Business details and roles connect access to the correct organization. An individual's contract or requested pre-contractual steps relies on Article 6(1)(b); handling company representatives and securing access relies on Article 6(1)(f). A company contract does not make every employee a personal contracting party.
6. Enquiries, requested offers and support
Contact details, sector, consent and timing, market, source-page URL and anti-spam checks support enquiries and requested offers. Available message or callback channels may collect your message, telephone and preferred time. Postmark delivers submissions to our mailbox for handling as correspondence. Responses rely on legitimate communication interests or requested steps toward your own contract. Offer consent covers the stated purpose and channel; other marketing requires its own basis and necessary consent.
7. Our orders and business administration
We process purchases and order enquiries received through available ordering channels. Buyer and business details, items, amounts, tax identifiers, addresses and correspondence support fulfilment, delivery, complaints and returns. GDPR bases are an individual's contract, legitimate interests for corporate contacts or disputes, and Article 6(1)(c) for applicable tax and accounting duties. Required records may remain after fulfilment for those purposes. Withholding necessary contact, transaction or invoice information may prevent the relevant service. Optional marketing information and consent are separate from the data needed for your purchase.
8. Payments and payment providers
Payment routes depend on the service and its configuration and may involve Adyen, Saferpay, PAYONE, ING or Fiserv. Adyen uses browser components and server communication; encrypted payment-method information or wallet tokens, including Apple Pay tokens, can pass through our systems. Relevant data includes browser information, email, references, amount, currency, items, tips and session identifiers. Records may include necessary tokens or masked payment details. Use the payment interface: never send full card numbers or CVV by email. Providers have separate authentication, fraud-prevention and legal responsibilities. Processing supports the transaction and security purposes described above.
9. Venue records and staff administration
Enabled venue functions may process guest names, phones, items, receipts, table and loyalty identifiers, points, tax details, booking services, assigned staff and times. Configured bookings may include a Saferpay deposit. Staff records include roles, permissions, PIN hashes rather than plaintext PINs, and transaction or shift activity. The venue determines lawful purposes, notices and retention; account access is distinct from employment administration or monitoring. Section 26 BDSG may apply to German employment processing. We provide contracted processing and Article 28 assistance; this policy does not replace the processing agreement or establish the venue's legal basis.
10. Optional integrations and separate services
Uber Eats, Nuvio-related services, fiskaly and hotel or reservation connections apply only when available and enabled. A logo does not activate data exchange. The account holder authorizes connections; permissions and data must be limited to their purpose. Delivery-platform retrieval is limited to order handling; the panel allows disabling or disconnecting Uber Eats at any time. Disconnection does not erase records lawfully retained by either party. Each partner remains responsible for its separate purposes. A hotel demonstration does not establish an active connection to every displayed booking channel.
11. Sensitive information and free-text fields
Avoid unnecessary health details, identity-document numbers or sensitive information in messages or order notes. Allergy or accessibility notes may reveal health information. Typing information is not, by itself, explicit consent under Article 9 GDPR. The responsible controller needs an Article 6 basis, an Article 9 condition and safeguards. US law can also classify account credentials as sensitive. Required consent and sensitive-data restrictions depend on applicable legislation.
12. Children and information about minors
Business accounts and sales services address businesses and authorized users. Venue orders, bookings or messages may nevertheless contain information about minors. Venues must consider children's protection when choosing what to collect and how to use it. Parents or guardians can contact us about our controller activities, or the venue about its records. Where COPPA applies to online collection from children under 13, its notice, parental-consent and other protections must be met. Any sale or sharing involving minors is subject to the additional consent requirements of applicable law.
13. Marketing and choice
Optional marketing is separate from accounts, purchases and enquiries. Required consent under Article 6(1)(a) must cover purpose and channel. Poland's Electronic Communications Law, Article 398, and Germany's section 7 UWG govern relevant commercial contact; exceptions require their statutory conditions. Withdraw consent or object through hello@sincliq.com. Minimal suppression records may remain to respect your choice and demonstrate compliance.
14. Cookies and browser storage
The website uses browser storage for privacy choices, sign-in, trusted sessions, language and account preferences. Cookies and local storage differ technically but both can involve storage or access on your device. US requirements depend on applicable law and functionality; relevant opt-outs appear below. European device-access rules, including their consent requirements and necessary-function exceptions, still apply when the activity falls within their scope. The preference panel saves your choices; its optional categories do not themselves activate analytics or advertising trackers. You can reopen settings from the website footer and change them, or clear browser storage, which may sign you out or reset choices. Consent covers the disclosed purpose and providers; materially different optional uses require the appropriate information and choice.
15. Website guidance, AI links and decisions
Website guidance and demonstrations help you explore services and do not themselves make solely automated decisions with legal or similarly significant effects. AI links open external services: some include the suggested prompt in the URL; Gemini uses a manual copy-and-submit flow. Opening a link can disclose its prompt and connection information to that provider. Avoid adding unnecessary personal or confidential information. The provider's terms govern submitted information, retention and any use for developing or training models. Payment providers' own decision processes and safeguards are explained in their respective notices.
16. Recipients and organizational changes
Recipients depend on purpose: Supabase supports authentication and data services, Postmark email, and infrastructure providers such as Railway hosting. Payment providers receive payment information; enabled partners receive relevant order or service records. Authorized staff, advisers, necessary delivery providers and legally entitled authorities may receive relevant data. Processors follow contractual instructions; further processors are subject to required authorization and contractual safeguards. Independent controllers have separate duties. Reorganization or a business transfer may require necessary disclosure to advisers or a successor, with lawful grounds, confidentiality and purpose restrictions. Consent is required only where the applicable law calls for it.
17. Locations and international transfers
Storage and access locations depend on provider, deployment and support arrangements. A service may involve processing outside the EEA, including remote access from abroad. Where GDPR Chapter V applies, transfers require a valid mechanism: relevant adequacy or Article 46 safeguards, such as standard contractual clauses with necessary assessment and supplementary measures. Certification-dependent frameworks apply only to covered recipients. Ask hello@sincliq.com for information about destinations relevant to your service or copies of applicable safeguards, subject to necessary protection of others' confidential information.
18. Retention by purpose
Retention reflects account duration, enquiry resolution, required follow-up, tax and accounting duties, limitation periods, consent or withdrawal records, and proportionate diagnostic, security or dispute needs. We assess categories separately. Legal holds may preserve relevant evidence. Configuration-dependent log and backup periods must correspond to their purposes and protection needs. We delete or anonymize data when lawful retention ends. You can request the criteria and reasons applicable to your records.
19. Closing accounts and entrusted records
The account-deletion form records a request in Supabase and may trigger a Postmark notification; submission is not automatic deletion. Closing access, disconnecting services and erasure rights differ. Necessary billing, legal or security records may remain for restricted purposes. Entrusted venue information is returned or deleted on controller instructions under the processing agreement, unless law requires retention. Export follows agreed terms and statutory rights. Protected backups may remain until their applicable replacement or deletion cycle. Uninstalling an application or clearing browser storage does not erase server records or every device copy.
20. Security and incidents
Protections are proportionate to the information and risks, including authentication, permissions and access controls. Access on our side is limited to authorized people who need it for their responsibilities. No system is completely secure. Report suspected exposure through hello@sincliq.com without unnecessary sensitive material. As processor, we notify the controller without undue delay of a personal-data breach and assist it. As controller, we assess and make required authority or individual notifications under applicable law; contractual incident duties remain applicable.
21. Rights under the GDPR
Where GDPR applies, you may request confirmation, access, a copy, correction, erasure, restriction, and portability for automated processing based on consent or your contract. Article 22 protects against qualifying solely automated decisions, with applicable safeguards including human intervention and contesting decisions. Statutory conditions apply: recordkeeping or claims may limit erasure; copies must respect others' rights. We explain limitations; a venue's or provider's involvement does not itself justify refusal.
22. Objection and withdrawal of consent
You may object to processing based on legitimate interests for reasons connected with your particular situation. We stop unless compelling legitimate grounds override your interests, rights and freedoms, or processing is needed for legal claims. For direct marketing, you may object at any time without giving a reason, including to related profiling; that processing must stop. Consent can be withdrawn at any time as easily as it was given, including by contacting us. Withdrawal does not affect earlier lawful processing or separate processing supported by another applicable basis.
23. Requests and proportionate verification
Contact hello@sincliq.com or the address in section 1; the /account-deletion form also accepts requests. Identify the service, account or transaction and desired action without special legal wording. We use existing details for proportionate verification; we do not require identity-document copies by default or creation of an account. Necessary additional checks protect against wrongful disclosure. Contact the venue first for its records; we direct requests appropriately and assist. Representatives may demonstrate authority; opt-outs do not require access-request identity verification.
24. GDPR response times and complaints
For GDPR requests, we respond without undue delay and within one month. Complexity or volume may justify two additional months, explained within the first month. Refusals include reasons and remedies. Requests are normally free; fees or refusals for manifestly unfounded or excessive requests need statutory justification. You may complain to the authority for your habitual residence, workplace or alleged infringement, including Poland's UODO or the competent German authority, and seek judicial remedies. These are not universal US deadlines.
25. California information and rights
If the CCPA, as amended by the CPRA, applies, relevant categories include identifiers and contact records, commercial and payment records, internet or network activity, professional account information and, where present, sensitive account credentials or health-related notes. Sections 3–11 and 16–18 explain their sources, business purposes, recipient categories and retention criteria. You may request categories and specific information collected, sources, purposes and disclosures, correction, deletion and a portable copy; opt out of sale or sharing; and limit qualifying sensitive-information uses. Statutory exceptions apply. These rights may cover business contacts and workers; they are not limited automatically to retail consumers.
26. Other US rights, deadlines and appeals
Applicable state laws may grant access, correction, deletion, portability, disclosure information and opt-outs from sale, targeted advertising or significant-decision profiling. Exceptions may protect required records, security, claims and others' rights. Use section 23's channels; agents may act with appropriate authority and lawful verification. We do not unlawfully discriminate or retaliate. Where law specifies 45 days, including ordinary CCPA access, correction and deletion requests, that period applies; another 45 days requires lawful grounds and timely notice. Opt-outs can have shorter deadlines, including California's maximum 15 business days. Where state law provides an appeal, reply to a refusal or email requesting review. We explain the outcome and regulator complaint route within the applicable period, including 60 days under Virginia law.
27. Sale, sharing and preference signals
Sale can include valuable consideration other than money; California sharing includes cross-context behavioral advertising. These meanings differ from necessary disclosures to service providers. The current website preference mechanism stores local choices and does not detect or implement Global Privacy Control (GPC). Saving a choice therefore does not confirm an account-wide sale or sharing opt-out. Whether a disclosure qualifies as sale or sharing depends on its purpose, terms and applicable law. Send relevant requests or enquiries to hello@sincliq.com. Where law requires honoring a qualifying signal, that obligation remains; an email channel does not replace it.
28. Updates and continuing commitments
We publish revisions here with their date and, where legally required, notify you through an appropriate channel. New purposes receive the information and fresh consent required by law. Updates do not retroactively authorize incompatible use or remove rights. Agreed customer and processing commitments continue under their terms. Contact hello@sincliq.com for clarification or an accessible explanation.
Last updated: 08.10.2026