Privacy notice

Last updated 28 September 2026

Who is responsible

Sera is run by a private individual based in Amsterdam, the Netherlands. For anything in this notice, including any request about your data, contact hello@eatsera.nl.

What we collect

We measure how the site is used: which menus are opened, which dishes are added, which delivery hour is picked and whether the order is completed. Your postcode is part of that measurement, because the delivery routes only work at postcode level and where people ask is how we choose the next neighbourhood. Our hosting provider also records standard server logs, which include your IP address.

If you order as a guest, we store your name, email address and delivery address with that order, so we can send your receipt and deliver it. Your phone keeps a guest session so you can see the order afterwards.

If you ask for our emails (“tell me when you open here”, or tonight’s menu), we store your email address and postcode, and which kitchens you’ve ordered from, to send at most one such email a day. Every one has a link to change or stop them, and you can ask us to delete it all.

If you create an account, we also store:

• your name and email address, used to log you in with an emailed link or code;
• your delivery address;
• the orders you place: nights, delivery hours, dishes and prices, plus any requests for a dish and notes for the courier you add, which go to the kitchen and the courier;
• each delivery’s status and arrival time. While your dinner is on its way, the courier’s position is shown on your delivery page; it is deleted as soon as the delivery is done. The delivery page link in your emails works without logging in, so don’t forward it to people you wouldn’t share your address with;
• the allergies you choose to save, if any.

When you pay, you enter your payment details on Stripe’s page, not ours. We never see or store your card or bank details; we only receive confirmation that an order was paid. We do not collect your phone number.

Why we use it, and on what legal basis

• To run your account and your orders: logging you in, remembering your address, taking payment and showing your order history. Basis: the steps you ask us to take before and under an agreement with you.
• To flag dishes and tell the kitchen about your allergies. Allergies are health information, a special category under the GDPR. Basis: your explicit consent, given when you save them. You can clear them at any time in your account, and we then delete them.
• To understand whether the concept works, at what price and in which neighbourhoods. Basis: our legitimate interest in assessing demand before building a business. This uses aggregate behaviour, not your identity.
• To measure our advertising. Basis: your consent, given through the banner. Nothing is shared with advertising platforms unless you accept.

Cookies and similar technology

• Necessary. Your basket, your address and your cookie choice are stored in your browser's local storage so the page works and stops asking. This never leaves your device.
• Measurement. Runs without cookies and without a persistent identifier until you accept. If you accept, we remember you across visits so repeat visits are not double-counted.
• Advertising. The Meta pixel only loads if you accept. If you decline, it is never loaded, and if you change your mind and decline later it is switched off and its cookies are cleared.

You can change your choice using the cookie link at the bottom of the confirmation screen.

Who else sees it

• Vercel Inc. — hosting and server logs (USA)
• Supabase Inc. — accounts, login emails, profiles and orders (EU, Ireland)
• Stripe Payments Europe Ltd. — payments (EU, Ireland)
• Resend — login and order emails
• PostHog — product analytics (EU, Germany)
• Meta Platforms Ireland — ad measurement, only with consent (EU / USA)
• Kadaster (PDOK) — the Dutch government’s address and map service. If you tap “Use my location”, your browser sends your location to it to find your street; we don’t store your location. The delivery page loads its map from it and looks up your street to place it on the map (Netherlands)
• HeiGIT (openrouteservice) — works out the bike route, and so the arrival time, from the courier’s position to the map position of your address. It gets coordinates only, no names (Germany)

Transfers outside the EU rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. We do not sell your data, and we do not share your email address with the restaurants shown on this site.

How long we keep it

Accounts, addresses, allergies and orders: until you ask us to delete your account. Analytics data is kept for a maximum of 12 months.

Your rights

Under the GDPR you can ask us for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, ask for it in a portable format, and withdraw your consent at any time. Email hello@eatsera.nl and we will act within one month. Deletion is simple here: we remove your account and everything attached to it.

If you are unhappy with how we have handled things, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Changes

If this notice changes we will update the date at the top. The project is at an early stage, so it may change as things take shape.