GCR ("the app") is a point-of-sale and management application for cafés and restaurants,
operated by SLOVA LTD, trading as Slova Tech ("we", "us"). This policy explains what
the app collects, why, and what control you have over it.
Contact: contact@gcrmanager.site
01 — Who this policy is for
The app has two kinds of users:
- Owners — create an account with an email address and manage a restaurant.
- Servers (waiters) — sign in with a short login code created for them by their owner. Servers do not provide an email address or a personal password.
We do not collect information about your customers. Orders are recorded as items, prices and optionally a table number — never customer names, contact details or payment credentials.
02 — What we collect
a) Account information
- Owners: email address and password. The password is stored only as a salted hash by our authentication provider; we never see or store it in plain text.
- Servers: a display name and an app-generated login code. To create the account we generate an internal placeholder address of the form
<code>@gcr.local. This is not a real mailbox and is never used to contact anyone.
b) Business information you enter
- Restaurant name.
- Menu items: name, description, category, price and an optional photo.
- Orders: items, quantities, unit prices, totals, status, timestamps, optional item notes, table number (or "takeaway"), the payment method label (Cash or Card), and which server recorded the order.
- Team: server names, their login codes, and whether they are active.
- Receipt settings: restaurant name, an optional Wi-Fi network name and password, a footer message, currency and receipt language.
Note on receipt settings. Anything you enter there — including a Wi-Fi password — is printed on customer receipts. Only enter details you are happy to share with customers.
c) Subscription and billing information
If you subscribe, payment is taken on our website and processed by Stripe.
- We never receive your card number. Card details are entered on Stripe's systems and are never transmitted to or stored by us.
- What we store against your restaurant is limited to: your subscription status, the billing period end date, and Stripe's own subscription and customer identifiers.
- Your Account ID (the restaurant identifier shown in the app) is sent to Stripe with the payment so the subscription can be matched to your restaurant.
- Stripe processes your name, email address, billing address and payment details as a data controller in its own right, under its own privacy policy.
d) Images
Menu photos and your restaurant logo are uploaded to our storage provider. These files are served from public URLs — anyone with the exact link can view them. Please do not upload private or sensitive images.
e) Information stored on your device
- A local cache of your menu, orders and team, so the app works offline.
- Preferences: language, theme, accent colour, currency and the selected Bluetooth printer.
- Your sign-in session token.
f) Device permissions
- Camera — used only when you choose to take a photo for a menu item. Photos are not accessed otherwise.
- Bluetooth (connect / scan) — used only to find and connect a thermal receipt printer. We declare
neverForLocation: we do not request location permission and do not derive your location from Bluetooth.
- Internet / network state — to sync your data.
03 — What we do not collect
- No location data.
- No contacts, SMS, call logs, or files beyond what you explicitly pick.
- No advertising identifiers. The app contains no ads and no analytics or tracking SDKs.
- No payment card data. "Cash" and "Card" are labels you choose for your own records — the app does not process, transmit or store card numbers or payment credentials.
04 — How we use the information
Only to provide the service: to authenticate you, store and sync your restaurant's menu, orders and team, produce receipts and sales reports, and keep your data separated from other restaurants.
We do not sell your data, and we do not use it for advertising or profiling.
05 — Who we share it with
- Supabase — our hosting provider for authentication, database and file storage, processing data on our behalf. See supabase.com/privacy.
- Stripe — processes subscription payments on our behalf and as an independent controller of your payment data. See stripe.com/privacy.
- Google Play — distributes the app.
We may also disclose information where required by law.
06 — Data separation and security
- Each restaurant's data is isolated at the database level (row-level security), so one restaurant cannot read or modify another's data.
- Data is encrypted in transit (HTTPS/TLS).
- Passwords are hashed by our authentication provider.
No system is perfectly secure, but we take reasonable measures to protect your information.
07 — Data retention and deletion
We keep your data for as long as your account exists.
You can delete your account at any time from inside the app: open Settings → Delete my account. For an owner this permanently deletes the owner account, the restaurant, and all of its data — menu items, orders and every server account belonging to it. This cannot be undone.
Full instructions, including how to request deletion without the app: Account & data deletion →
08 — Children
The app is a business tool and is not directed to children. We do not knowingly collect information from children.
09 — Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict processing. Contact us at contact@gcrmanager.site and we will respond within a reasonable period.
This policy is governed by the laws of England and Wales.
Company details
Legal name: SLOVA LTD
Trading name: Slova Tech
Company number: 17462722
Registered address: 128 City Road, London, EC1V 2NX, United Kingdom
Email: contact@gcrmanager.site
Website: gcrmanager.site
10 — Changes to this policy
If we make material changes we will update the "last updated" date at the top of this page and, where appropriate, notify you in the app.
11 — Contact
Questions or requests: contact@gcrmanager.site
