Privacy Policy

21/09/2026 [21/09/2026]

You connect one Gmail inbox. Our software reads the mail arriving in it, picks out the Epassi and Edenred payments, the table bookings and the orders, and puts them on a board you can keep open through service. This page explains exactly what that means for the information involved — what we look at, what we keep, how long we keep it, and what you can do about it.

The service is run by [G-Reader], registered in [Finland], [G-reader Support]. If you want to ask us anything about this document, write to

Two sets of people, and which one you are

This matters, because the answers are different.

If you're the restaurant — the business paying for this — then we decide how your account information is handled, and this page is our account of it.

If you're a guest who booked a table or placed an order, your details reached us inside the restaurant's email. They belong to the restaurant, not to us. We hold them only because the restaurant asked us to put them on their board, we do only what they tell us with them, and we delete them on the schedule below. Ask the restaurant first — they're the ones who decide. If you write to us instead we'll pass it on and help them answer.

What we ask Google for

Signing in and connecting an inbox are two separate things, on purpose.

Signing in tells us your email address and the identifier Google uses for your account. Nothing more. Signing in gives us no access to any mail at all.

Connecting an inbox is a second, deliberate step behind its own button, where Google shows you its own permission screen. You are agreeing to let us read the mail in that account. The inbox you connect doesn't have to be the account you sign in with — you can sign in as yourself and point us at [email protected].

What that permission does not let us do:

• We cannot send mail, reply to anyone, or write anything from your address.
• We cannot delete, archive, label, or mark anything as read.
• We cannot change any setting on your Google account.
• We never see your Google password. We never ask for it, and you should never give it to us.

Be clear about what it does let us do. The permission Google gives us can read mail in that account — it is not technically limited to Epassi, Edenred and booking mail. Our software examines new messages in the inbox, including their full text, because that is the only way to tell a payment confirmation from everything else. What we then keep is described below, and it is very little.

You can take the permission back at any time. Inside the app it's under Settings, next to the inbox we're watching — the word disconnect. From Google's side it's under your Google account connections. Disconnecting in the app stops us reading immediately and destroys our copy of the permission. We also ask Google to cancel the grant; if Google can't be reached at that moment we still let go of our copy, but the grant may remain listed in your Google account until you remove it there. Disconnecting does not cancel billing — that's separate, and it's in the terms.

What we actually keep

We do not copy your inbox, and we do not store the body of any message.

When a mail is one we're watching for, we keep the parts you need on the board:

• Payments (Epassi, Edenred) The amount, who it came from, the subject line, a short extract of the text, and the time it arrived.
• Bookings The date and time, the number of guests, and whatever the guest wrote in the form — usually their name, phone number, email address, and any note they left. We keep it because it's what you need in your hand when the phone rings.
• Orders and anything you've set up yourself If your own website sends order mail, you can tell us which labels in it matter — order number, items, pickup time, whether your system already took payment. We store those fields under the names you gave them and show them back to you. We don't interpret them; if your email says "Maksettu: Ei", the board says "Maksettu: Ei". Only fields you configure are kept.

Mail that isn't one of those is not put on your board and nothing from inside it is stored — no sender, no subject, no extract. We do keep the identifier Google gives each message we've examined, with the time we examined it, including for messages that matched nothing. That's how we avoid showing you the same payment twice and how we catch mail that Google's change feed skipped. It is an identifier and a timestamp, nothing from the message itself, and it's deleted after 30 days.

Separately from your inbox, we hold what running an account needs:

• Your business name, the email address you signed in with, and the identifier Google uses for your account.
• The permission token that lets us keep reading your inbox. It is stored encrypted, and it is the first thing destroyed when you disconnect or delete.
• Your billing record: the date and amount of each payment, the period it paid for, whether it went through, and how it was paid as a label such as "Card · Visa", "Apple Pay" or "MobilePay" — plus the references Stripe uses for your customer, subscription and invoices. No card number or any of its digits is part of that — see below.
• Your plan history: the periods you had free access or used the service during a testing period, with their start and end dates.
• The matching phrases and field labels you've set up, if you've told us your mail looks different from the standard ones.
• Anything you write to us in support, and what we write back.
• A record of account actions — signed in, connected an inbox, subscription changed — with the time each happened.
• A record of times we couldn't read your inbox: the address, when it stopped, when it came back, and whether the mail from that period was recovered. This is how we know whether anything was missed.
• A short security record of requests that were refused — the time, the address it came from, the page requested, and a truncated copy of what was submitted. This is how we notice someone trying to get into your account.

How long we keep it

The board is a working view, not an archive. Deleting runs on a regular sweep rather than exactly on the minute, so treat these as "shortly after". None of it touches the original mail, which stays in Gmail.

• Payments on your board Deleted 24 hours after they arrive. They're there for the shift.
• Bookings and orders with a date Deleted once that date has passed. A future reservation stays until its day is over.
• Bookings with no date Kept 30 days, then deleted.
• Message identifiers 30 days.
• Records of interrupted reading 90 days after the interruption is resolved. One that's still unresolved stays until it is.
• Account activity records 365 days.
• Security records 90 days. When you delete your account they stop pointing at you, but the records themselves stay for that period — otherwise deleting an account would be a way to erase the trail of what was done with it.
• Unfinished signup attempts 30 days. A signup that was paid for but never became an account is kept until it's resolved, because that's money taken with nothing delivered and it needs sorting out rather than deleting.
• Your account details and support conversations Kept while you have an account. Deleted when you delete it — support conversations have their contents removed straight away, while the ticket number, topic and dates stay for one year, so you can still ask us whether something was dealt with. After that year they are deleted too.
• Billing records Kept after you delete your account, because accounting and tax law require proof of what was charged: six years from the end of the year the payment was made in, then deleted automatically. [CONFIRM WITH YOUR ACCOUNTANT] Invoice references may still identify the transaction after an account is closed.
• Proof that a deletion happened When you delete your account we write a receipt: a reference code, the dates, what was done, and a protected one-way representation of your email so we can find it if you quote the code. It is kept for one year so we can answer "did you actually delete it?", then deleted.

We do not currently keep separate backup copies of the application database. That means deleted board data is genuinely gone and we cannot restore it for you — and it does not affect your original mail in Gmail, Stripe's own records, or our infrastructure provider's records.

Google's rules, and how we're bound by them

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. In plain terms:

• We use what we read from your inbox only to provide and improve the board you're looking at — the feature we described to you and nothing else.
• We do not sell it, or anything from your inbox, to anyone.
• We do not pass it to advertising companies, data brokers, or anybody who resells information, and we do not use it to show ads anywhere.
• We do not pass it to anyone deciding whether to lend you money or judging your credit.
• We do not use it to develop, train or improve artificial intelligence or machine-learning models.
• We transfer it only where needed to provide those features, for a necessary security purpose, where the law requires it, or in a sale of the business with your prior explicit agreement.

Does a person here read your mail?

No — and it's built that way, not just promised. The matching is done by software. Our own admin screens are written so they cannot display the contents of your board: they show counts, connection health, billing state and timestamps. "Seven bookings today" is the most they can tell us.

Someone here sees something of yours in three situations only:

• You showed us. If you write to support saying "this booking didn't show up", whatever you paste into that conversation is read by us. So is a sample email you send us so we can teach the system your booking format — that sample is used on the screen and never saved to the database. A general support question is not permission to go looking in your inbox; if we need a specific message, we'll ask you for it.
• Something is being attacked or abused and we have to look to protect accounts — yours included.
• The law requires it — a court order or an equivalent legal obligation. We don't hand anything over just because it was requested politely.

Who else is involved

• Google holds your mail. We only read it; they decide whether we may, and you tell them. See the Google Privacy Policy.
• Stripe takes the subscription payments. Your card details go straight to them on their own page — they never come to us, and we could not show you your card number if you asked, because we don't have it. Nothing from your board is ever sent to Stripe. See the Stripe Privacy Policy.
• Cloudflare sits in front of the service, delivering and protecting the traffic between your browser and us. Everything you send or receive passes through it. See the Cloudflare Privacy Policy.

Nobody else. We don't share your information with other customers, partners, or anyone who wants to buy it. We may disclose something where the law requires it or to defend a legal claim, and our professional advisers may see what they need to under a duty of confidence.

[CONFIRM: the Cloudflare contracting entity and which countries it processes in, and the safeguard relied on for any transfer outside the EEA. A server in Finland does not by itself mean everything stays in the EEA.]

Cookies and what your browser stores

We use only what the service needs to work. There is no advertising, no analytics, and no tracking of you across other sites.

• Sign-in session — up to 14 days.
• Sign-in protection, so a Google sign-in can only be completed in the browser that started it — up to 40 minutes.
• Signup and payment flow, carrying who you are across the trip to Stripe — up to 30 minutes.
• Request-security token — lasts until you close the browser.
• Your display choices on the board, such as hiding amounts or full-screen — stored in your own browser until you change or clear them, and never sent to us.

Cloudflare may set its own security cookies as part of protecting the site. Google and Stripe control the cookies on their own pages.

Why we're allowed to do this

• To do what we agreed — running your account, taking payment, answering you.
• Because we have a legitimate interest — keeping the service reliable, stopping abuse, and being able to settle a dispute about what happened. We weigh that against your rights, and you can object.
• Because the law requires it — accounting and tax records, and responding to legal obligations.

For your guests' information, you — the restaurant — decide the lawful basis, because you're the one who collected it. Google letting us into the mailbox is technical permission; it isn't a legal basis for everyone whose details are inside it.

Keeping it safe

• The permission that lets us read your inbox is stored encrypted, not in plain text.
• Everything between you and us travels over an encrypted connection.
• Accounts are separated from each other in the software itself, not by remembering to check — one account cannot reach another's board, bookings, or support conversations.
• Signing in is done entirely by Google. We have no passwords to lose.
• Everything shown on a board is escaped before it's displayed, so a booking form can't be used to attack the screen it appears on.

No service can promise nothing will ever go wrong. If something happens that affects your information we'll tell you without undue delay and tell you what we're doing about it, rather than hoping you don't notice. Where the law requires it we notify the supervisory authority within 72 hours of becoming aware.

What you can do

• Stop us reading your inbox — Settings → disconnect. It takes effect at once, and you keep your account.
• Delete everything — Settings → Delete my data. This asks Stripe to cancel your subscription, hands our access back to Google, and erases your account. You get a reference code afterwards; we can confirm the deletion from that code alone, without having kept your details. If any step can't be completed at that moment — Stripe unreachable, Google not answering — we keep trying until it's done and the receipt records what actually happened. Tell us if anything looks wrong, especially if a charge appears afterwards.
• Ask what we hold about you, ask us to correct it, ask for a copy, ask us to restrict or stop a particular use, or object to anything we do on the basis of legitimate interest. Write to support or to the address at the top. We may need to check who you are first. Normally there's no charge and we answer within a month; if we need longer we'll tell you inside that month and say why.
• Get a particular booking removed sooner than the schedule above — ask in support and we'll do it.

If you think we've handled your information badly, you can complain to a data protection authority — in the country where you live, where you work, or where you think it went wrong. In Finland that's the Office of the Data Protection Ombudsman. You don't have to come to us first, though we'd rather you did so we can fix it.

Children and sensitive details

This is a tool for businesses. It isn't meant for anyone under 18 and we don't knowingly set up accounts for them.

Booking notes sometimes contain more than a name — an allergy, a reason for the occasion, something about a child. We don't ask for any of it and we don't want it. If you collect it, that's yours to justify and to keep to a minimum. Please don't send medical records, identity documents or card details through support or booking notes.

If this policy changes

If we change anything that matters — what we look at, what we keep, how long we keep it — we'll tell you in the app before it takes effect, not quietly edit this page. The date at the top always says when it last changed. An updated page is not itself your agreement to a new purpose; if something new needs your permission, we'll ask for it first.