Security and data protection at etlas
Your customers’ data is yours. Here, with no small print, is where it lives, who can see it and how you take it with you or delete it.
Where the data is
| What | Where |
|---|---|
| The application and the database (customers, stamps, sales, bookings) | DigitalOcean server in Frankfurt, Germany (EU) |
| Images and files (logos, menu photos, card images) | Amazon S3, in the United States (Ohio) |
| Subscription payments | Stripe |
Each business has its own database, separate from everyone else's: one shop's customers never mix with another's. All communication is encrypted (HTTPS) and passwords are stored encrypted, never in plain text.
Backups
Every day a full, compressed copy of all the databases is made, and the copies from the last 7 days are kept.
Who can see what
- Your team log in with their own user account, and each person sees what their role allows: a waiter can't see the statistics or the settings.
- Tablets (kitchen, kiosk) use a device account with the minimum permissions.
- We only access your account to give you support or fix a problem.
Payments
We don't store card numbers. The subscription is charged by Stripe, and what you take in your shop goes through your own card terminal or payment provider.
GDPR and consent
For your customers' data, you are the data controller and etlas is the processor: we process it on your behalf and for the purposes you decide. When joining the club, the customer accepts your terms and your privacy policy, and permission to receive marketing communications is requested separately and recorded. Anyone who says no doesn't receive campaigns.
Taking it with you or deleting it
- Download: your customers as a CSV from Privacy and data, whenever you like, without having to ask us.
- Deletion: from the same place you can ask for your account to be deleted. It is put on hold for a while in case it was a mistake, and then it is erased.
Frequently asked questions
Where is my customers' data?
On our server and database in Frankfurt (Germany, EU). Images and files (logos, menu photos) are stored in Amazon S3, in the United States.
Do you store payment card details?
No. Subscription payments are processed by Stripe, and payments in your shop go through your own card terminal or payment provider. We never see or store card numbers.
Can I download or delete my data?
Yes. You can download your customers as a CSV from the dashboard whenever you like, and you can ask for your account to be deleted: it is put on hold for a while in case it was a mistake, and then it is erased.
Is it GDPR compliant?
We act as the data processor for your customers' data: you decide what it is used for and we process it on your behalf. Consent for marketing communications is requested separately and recorded.