Privacy Policy

Meta Pixel and Meta Conversions API (CAPI)

We use the Meta Pixel and the Meta Conversions API ("CAPI") provided by Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) for visitors located in Switzerland and the EEA, and by Meta Platforms, Inc. (1 Hacker Way, Menlo Park, CA 94025, USA) for other regions.

The Meta Pixel is a JavaScript snippet loaded in your browser on every page of abanero.app once you grant consent. It measures conversions on Meta platforms (Facebook, Instagram), helps us build custom audiences, and improves our advertising. The Conversions API is a complementary server-to-server channel: when a key event happens (in particular when an event package becomes paid), our server sends the same event directly to Meta with a shared event identifier so the browser-side and server-side records can be deduplicated. This compensates for browser-level signal loss caused by ad blockers and the iOS App Tracking Transparency framework.

Data processed by the Meta Pixel includes: IP address, user agent, page URL and referrer, identifiers stored in the `_fbp` and `_fbc` cookies, and event metadata (page view, view content, initiate checkout, add payment info, purchase value and currency). Through the Conversions API we additionally send information you have provided to us — typically your email address, and your phone number if available — after hashing it with SHA-256 on our server. Hashed identifiers cannot be reversed by us or by Meta and are used only to match events to your Meta account if you have one (so-called "enhanced matching"). The original (non-hashed) email and phone number remain in our database for the contractual relationship and are not shared with Meta in plain form.

The Meta Pixel and the Conversions API run only when you grant the "marketing" category in CookieHub. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR; Art. 31(1) Swiss FADP). You can withdraw consent at any time via "Cookie preferences" in the footer; CookieHub then revokes the Meta cookies and we stop sending Conversions API events for new actions. Meta acts as joint controller with us for the Pixel. Meta may transfer data to the United States and other third countries on the basis of Standard Contractual Clauses.

Further information: Meta joint-controller addendum · Meta privacy policy.

Microsoft Clarity

On the event-planner pricing page (`/for-event-planners`) and on the event-purchase configurator (`/event_purchases/...`), we use Microsoft Clarity, a product of Microsoft Ireland Operations Ltd. (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) and Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA).

Clarity records anonymised session replays and aggregates them into heatmaps, scrollmaps and click-maps. We use Clarity exclusively to understand how visitors interact with the paid event-planner conversion funnel, so we can fix usability issues. Clarity does not run on any other page of the platform.

Data processed by Clarity includes: IP address (Microsoft truncates it before storage), user agent, page URL and referrer, viewport size, mouse movements, clicks, scroll positions and keystrokes. Input fields are masked by default — Clarity does not capture the values you type into name, email, address, password or free-text fields. Clarity also reads identifiers from the `_clck`, `_clsk`, `MUID` and `ANONCHK` cookies.

Clarity runs only when you grant the "analytics" category in CookieHub. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR; Art. 31(1) Swiss FADP). You can withdraw consent at any time via "Cookie preferences" in the footer; Clarity then stops recording new sessions. Microsoft may transfer data to the United States and other third countries on the basis of Standard Contractual Clauses.

Further information: Microsoft Clarity privacy statement.

Klaviyo (newsletter and marketing emails)

We use Klaviyo, a service of Klaviyo, Inc. (125 Summer Street, Suite 1000, Boston, MA 02110, USA), for our newsletter sign-up form and for sending marketing emails to subscribers who have opted in.

Klaviyo is loaded only on pages served in French (our CH-FR market). The sign-up form appears as an exit-intent popup for visitors who have granted the "marketing" category in CookieHub. When you subscribe through the form, Klaviyo collects your email address. Klaviyo also sets a first-party identifier cookie (`__kla_id`) and may process your IP address, user agent, and on-site browsing behaviour for list segmentation and email personalisation.

You can also opt in to our newsletter when you create an account (food-truck owner sign-up), when you buy an event package, or when you place a food order at an event. The opt-in box is never pre-ticked. When you opt in, we record your consent timestamp and share your email, first and last name, preferred language, country/market and account type with Klaviyo so we can send and segment the newsletter; if the opt-in accompanies a purchase, the basket value is shared as well. The list uses double opt-in, so Klaviyo emails you a confirmation link and only subscribes you once you click it.

The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 31(1) Swiss FADP). You can withdraw consent at any time by clicking "Unsubscribe" in any marketing email, or by revoking the "marketing" category in CookieHub — this stops new tracking immediately and prevents further marketing emails. Klaviyo may transfer data to the United States on the basis of Standard Contractual Clauses and, where certified, the EU–U.S. Data Privacy Framework.

Further information: Klaviyo privacy notice.

Stripe (payments and payouts)

Card and digital-wallet payments on Abanero are processed by Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) and Stripe, Inc. (354 Oyster Point Boulevard, South San Francisco, CA 94080, USA). Payouts to food truck owners and event planners via Stripe Connect are processed by the same companies.

Data processed by Stripe includes: card number and security code (entered directly into Stripe-hosted fields, never reaching our servers in clear form), name and billing address, payment amount and currency, IP address, device and browser information, and — for Connect accounts — identity, business and bank details required by Stripe to comply with anti-money-laundering and "know your customer" obligations. Stripe also applies its own fraud-prevention engine (Stripe Radar) to transactions on our platform.

The legal basis is the performance of the contract between you and us (Art. 6(1)(b) GDPR; Art. 31(1) Swiss FADP) for payment of orders and event packages, and our and Stripe's legal obligations regarding payment regulation and accounting (Art. 6(1)(c) GDPR). Stripe is certified under the EU–U.S. Data Privacy Framework and its Swiss extension; transfers to the United States are additionally covered by Stripe's Standard Contractual Clauses.

Further information: Stripe privacy policy.

Postmark (transactional email)

Transactional and system emails — for example confirmations, password resets, order updates, invitations and contact-form acknowledgements — are sent on our behalf by Postmark, a product of ActiveCampaign LLC (1 N Dearborn Street, 5th Floor, Chicago, IL 60602, USA).

Data processed by Postmark includes: the recipient email address, the sender address, the subject and content of the message, delivery and bounce metadata (timestamps, message IDs, open/click signals when applicable), and the recipient's IP address as seen by mail servers.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR; Art. 31(1) Swiss FADP) for service-related messages, and our legitimate interest in detecting delivery failures and abuse. Postmark may transfer data to the United States on the basis of Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.

Further information: Postmark privacy policy.

Cloudinary (image hosting and delivery)

Images you upload to Abanero (food truck pictures, menu item photos, profile illustrations) are stored, transformed and delivered by Cloudinary Ltd. (3400 Hillview Avenue, Building 3, Palo Alto, CA 94304, USA, with offices in Israel and Europe).

Data processed by Cloudinary includes: the image files themselves and any metadata they may contain (such as EXIF data, capture date, device model or, in rare cases, GPS coordinates if the camera embedded them); the URLs through which the images are requested; and the IP address, user agent and referrer of visitors viewing the images on our pages or in our mobile app. We recommend you remove unnecessary metadata from photos before uploading.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR; Art. 31(1) Swiss FADP) for hosting your content, and our legitimate interest in serving images efficiently and securely. Cloudinary may process data in the United States, Israel and the EEA; for transfers to countries without an adequacy decision, Cloudinary relies on Standard Contractual Clauses.

Further information: Cloudinary privacy policy.

Twilio (transactional SMS)

When a food truck marks your order as ready for pickup, we may send you a short SMS containing the food truck name and your pickup code. SMS delivery is operated by Twilio Ireland Ltd. (25-28 North Wall Quay, Dublin 1, Ireland) and Twilio Inc. (101 Spear Street, 1st Floor, San Francisco, CA 94105, USA).

Data processed by Twilio includes: the recipient mobile number in international (E.164) format, the message body, our sender number, and delivery metadata (timestamps, delivery status, carrier information).

SMS notifications are sent only when you provide a phone number for an order. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR; Art. 31(1) Swiss FADP). Twilio may transfer data to the United States on the basis of Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.

Further information: Twilio privacy notice.

Firebase Cloud Messaging and Apple Push Notification service (push notifications)

When you install our mobile app for food truck owners and accept system push notifications, your device generates a push token. We use that token to send you operational notifications such as new orders, order status changes, event invitations and event-related reminders.

On Android, push delivery is operated by Google Ireland Ltd. and Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) via Firebase Cloud Messaging (FCM). On iOS, FCM acts as a relay to Apple Push Notification service (APNs), operated by Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) and Apple Inc. (One Apple Park Way, Cupertino, CA 95014, USA).

Data processed includes: the FCM/APNs device token, the content of each notification (typically the order or event title and a short message), the time of delivery and the delivery status returned by FCM/APNs. We store device tokens, the device platform and the associated user account on our servers in order to address notifications correctly and to deactivate stale tokens.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR; Art. 31(1) Swiss FADP) and your acceptance of notifications at the operating-system level. You can disable notifications at any time in your device settings; we then stop using the corresponding token. Google and Apple may transfer data to the United States on the basis of Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.

Further information: Firebase privacy and security · Apple privacy policy.

Sentry (error monitoring and performance diagnostics)

To detect and fix bugs and outages in production, we use Sentry, a product of Functional Software, Inc. d/b/a Sentry (45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA). Sentry runs only in our production environment and is not used in development or test.

When the platform encounters an unexpected error or a slow request, our servers transmit a structured event to Sentry. That event may include: a stack trace and the source-code context of the error; the HTTP method, path and headers of the request that caused it; the user-agent string and IP address of the requesting client; the identifier of the user account, if any, that was authenticated at the time; and a sampled subset of recent request and logging breadcrumbs to help reconstruct what happened. We have enabled the option that includes basic personal identifiers in error events so that we can correlate an incident with the affected account. We do not deliberately send passwords, full card numbers, or session secrets — those values are filtered by our application before they reach Sentry.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR; Art. 31(1) Swiss FADP) in operating a reliable and secure service and in being able to investigate incidents quickly, balanced against your rights. Sentry processes data in the United States on the basis of Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework, and retains events for a limited period (currently up to 90 days).

Further information: Sentry privacy policy.

Google reCAPTCHA v3 (invisible bot protection)

To prevent automated abuse of sensitive forms (in particular sign-up, sign-in, password reset, the contact form, and selected order and event flows), we use Google reCAPTCHA v3, provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

reCAPTCHA v3 is invisible: there is no challenge to solve. The reCAPTCHA JavaScript runs in your browser on the relevant pages and assigns each interaction a risk score. To do this, it collects information about your device and behaviour, including: IP address, browser and operating-system information, screen size, time spent on the page, mouse and touch movements and other interaction signals, as well as cookies set by Google for spam and abuse detection. This data is processed by Google and transmitted to us as a numeric score that we use to decide whether to accept or further verify the request.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR; Art. 31(1) Swiss FADP) in preventing fraud, abuse and automated attacks on the platform and on your account. Because reCAPTCHA is part of our security baseline, it is not gated by the cookie consent banner: if you do not wish reCAPTCHA to evaluate your browser, do not submit the relevant forms. Google may transfer data to the United States on the basis of Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.

Further information: Google privacy policy · reCAPTCHA terms of service.

Fal.ai (AI-generated menu illustrations — food truck owners only)

We offer food truck owners an optional feature to generate a textless illustration of a menu item from the information they have entered (name, description, ingredients, allergens and category). This feature is provided by Fal.ai, operated by Features and Labels Inc. (548 Market Street, PMB 35410, San Francisco, CA 94104, USA), and uses the Flux Pro Kontext text-to-image model together with a background-removal model (BiRefNet) accessed through the fal.run API.

Data processed by Fal.ai includes: the prompt assembled from the menu metadata you entered, the resulting generated image, the IP address of our servers (not yours — the request is made server-to-server from our backend), and standard request metadata required to deliver the response. The feature is triggered only when a food truck owner explicitly asks to generate an image. It is not used for diners, customers, or event organisers.

The legal basis is the performance of our contract with the food truck owner (Art. 6(1)(b) GDPR; Art. 31(1) Swiss FADP) and our legitimate interest in offering useful tools to our merchants. Per our agreement with Fal.ai, prompts and generated outputs are processed only to return the result and are not used by Fal.ai to train its models. Fal.ai processes data in the United States on the basis of Standard Contractual Clauses.

Further information: Fal.ai privacy policy.