Privacy Policy

Last updated: 23 July 2026 · English is the authoritative version

This policy covers MiniAgent HORECA — the owner portal at miniagent.localpartner.eu and the staff app used at your venue. It explains what we collect, why, and who else touches it. Your LocalPartner account is covered by the same policy, since one account runs both products.

1. Who is responsible for your data

The data controller for the MiniAgent HORECA service is Wocherie OÜ (registry code 16826825), Gerassimovi 4-64, 20105 Narva, Estonia. For anything privacy-related, write to info@localpartner.eu.

One important split. For your own account data — your business details, your login, your subscription — we are the controller.

For the data your venue puts into the app about your staff — their names, their sign-off PINs, who signed which check and when — you are the controller and we are only the processor. You decide what goes in, how long it stays and who sees it. We store and serve it on your instructions, and we do not use it for anything else. That means you are the one who must tell your staff that their sign-offs are recorded, and you are the one who answers their access or erasure requests. We will help you carry them out.

Staff data never leaves that purpose. A name is used to label a sign-off inside your own venue and nowhere else — we do not create accounts for your staff, do not contact them, do not profile them, and do not carry their names into LocalPartner or any other product.

2. What we collect

Business account data

Contact name and email address
Business name, city, country, registration address, CVR / registration number
Subscription and invoice history (card details are handled by Stripe — we never see or store them)

Venue and device data

Venue names, city, shift settings and country
Paired device tokens, device names and last-seen timestamps

Staff and self-monitoring data (you are the controller)

Staff names, role or zone, and their 4-digit sign-off PIN
Which checks are assigned to which person
Self-monitoring records: the check, the value recorded (for example a fridge temperature), the timestamp, who signed it, and any corrective note or later annotation
Shift notes written on the staff communication board
Dish, ingredient and allergen data, prep and use-by label data, and food-cost figures you enter
Photos you submit to the optional AI menu scan

Technical data

IP address, browser and device information
Local storage used for your session token, your language choice, and — on a paired device — the device token. We do not use tracking or advertising cookies.

3. Why we process it, and on what legal basis

Contract performance (Art. 6(1)(b) GDPR) — running the service: accounts, venues, checks, records, labels, billing.
Your legal obligation as a food business (Art. 6(1)(c) GDPR) — EU Regulation 852/2004 requires food businesses to keep HACCP-based self-monitoring records. The obligation is yours; the app is where you keep them.
Legitimate interest (Art. 6(1)(f) GDPR) — keeping the service secure, preventing abuse, and fixing faults.
Our own legal obligation (Art. 6(1)(c) GDPR) — accounting and tax records.

We do not profile your staff, and we do not use your records to train any model.

4. Who else processes your data

Sub-processor	What for
Stripe	Subscriptions, payments, invoices — privacy policy
Railway	Backend hosting and the database (EU region) — privacy policy
Vercel	Hosting of the portal and help centre — privacy policy
Resend	Transactional email and the daily digest — privacy policy
Anthropic	The optional AI menu scan only. A photo you submit is sent for analysis and is not used for model training — privacy policy

We do not sell personal data, and we do not share your records with other venues. If we add or change a sub-processor we will update this table and give notice before the change takes effect.

5. How long we keep it

Your records stay available for as long as your account is active. After you delete your account we remove your data, keeping only what accounting and tax law requires us to keep — invoices — for the statutory period.

Export before you delete. How long self-monitoring records must be kept is set by your national food authority, not by us, and an inspector may ask for records that predate your cancellation. Download what you need from Records first — deletion is permanent and we cannot restore it.

6. Your rights

Under the GDPR you can ask to access, correct, erase, restrict or port your data, and object to processing based on legitimate interest. Where processing relies on consent, you can withdraw it at any time.

Write to info@localpartner.eu and we will answer within 30 days. If the request concerns staff data held by a venue, that venue is the controller — we will pass the request on and support them in answering it.

7. Security

Traffic is encrypted with HTTPS. Passwords are hashed with bcrypt. The database is hosted in the EU with encryption in transit. Access to production data is limited to what is needed to operate and support the service.

What a staff PIN is — and what it is not

A staff PIN is an attribution mechanism, not a login and not a high-security secret. Its only job is to put a name on a signed check so an inspector can see who is accountable.

It works only inside MiniAgent HORECA, on a device your venue has already paired.
It grants no access to any account of ours — not the owner portal, not LocalPartner, not our API, not billing, not support. It cannot be used to sign in anywhere.
It is scoped to your venue. A PIN from one venue means nothing at another.
We never use it for identification, authentication or anything beyond attributing a sign-off.

Even so, treat PINs as confidential inside your venue: do not display them where guests or other staff can read them, and change or remove a person's PIN when they leave.

8. Transfers outside the EEA

Data is processed primarily inside the EU/EEA. Some sub-processors listed above may process data outside the EEA under appropriate safeguards, including the European Commission's Standard Contractual Clauses.

9. Supervisory authority

If you believe your data protection rights have been breached, you can complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon — www.aki.ee — or to the authority in your own country.

10. Legal references in the app

The app and the help centre quote regulations and national guidance, and link to the source where one is published. Those pages are a plain-language summary written for convenience. They are not legal advice, they are not maintained as an official record, and rules change without us being told.

Checking the current rules that apply to your business, in your country, is your responsibility. Always verify against your national food authority before you rely on a figure or a requirement. Where our summary and the official source differ, the official source governs.

11. Deleting your account

You can delete the account yourself in the owner portal: Billing → Delete account. It removes the account from both MiniAgent HORECA and LocalPartner, cancels the subscription immediately, and cannot be undone.

12. Changes to this policy

We may update this policy. Material changes will be announced by email or a notice in the portal, and the date at the top always shows the current revision.

Home Terms Help & FAQ

Wocherie OÜ · Reg. no. 16826825 · Gerassimovi 4-64, 20105 Narva, Estonia · info@localpartner.eu