Who we are
Serbiz Menu (menu.serbiz.io) is a QR menu and ordering service by Serbiz, a brand of Sereno Labs. In this policy, "we" and "us" mean Sereno Labs.
Serbiz Menu is operated by Sereno Labs, an online business based in Makati City, Philippines. Business registration is in progress. Email: contact@serbiz.io. Privacy questions also go to this address.
Data Protection Officer: Carlo Sereno, contact@serbiz.io (Attn: DPO)
Who this policy covers
- Business owners and their staff who sign up and use Serbiz Menu for their restaurant, café or food business.
- Customers of those businesses who scan a QR code to view a menu and place an order.
Each business decides how it uses Serbiz Menu with its own customers and is responsible for getting their consent.
For order and customer data, the business is the personal information controller and we are its personal information processor: we handle this data only to provide the service to the business. For owner account and subscription billing data, we are the personal information controller.
What we collect
- Owner and staff accounts: name, email and password (stored only as a hash). If you use Google sign-in: your name, email and Google account ID (scopes:
openid email profile). Two-factor authentication secrets are stored encrypted.
- Business info: store details, menus, item photos, tables and settings you enter, and the business's own GCash QR image and account name.
- Customer orders: items, table or counter, and a note. For takeout, the customer's name and mobile number, which are needed to fulfil the order. SMS updates are sent only with consent.
- Customer payment proofs: if a customer pays the business by GCash, the screenshot and reference number they upload so the business can confirm it. The money goes directly to the business; we never receive or hold it.
- Subscription payments: GCash payment screenshot, reference number, sender name and GCash mobile number of the owner paying for a plan.
- Serbiz Queue link: if a business connects Serbiz Queue, the queue ticket each order gets (ticket ID, number and link). What we send to Serbiz Queue is listed under Service providers below.
- Logs: audit logs of account and admin actions, and logs of notifications we send (SMS and email).
How we use it
- To run the service: create accounts, sign you in, show menus, take orders and pass them to the business's staff.
- To send SMS updates (such as "your order is ready") to customers who gave a number and agreed to SMS, and to send account emails to owners.
- To verify subscription payments and activate plans.
- To keep the service secure and to investigate problems.
We do not sell personal data. We do not use it for advertising.
Legal bases
Under the Data Privacy Act of 2012 (RA 10173), we process personal data because:
- it is needed to provide the service under our contract with you (Sec. 12(b));
- we must meet a legal obligation, such as keeping tax records (Sec. 12(c));
- we have a legitimate interest in keeping the service and its users secure (Sec. 12(f)).
SMS updates are sent to a customer only with the customer's consent, which is collected when they place the order.
Google sign-in
If you sign in with Google, we use your Google user data only to sign you in and identify your account. We do not sell it or share it with others, and we do not use it for any other purpose.
Cookies
We use cookies only to keep you signed in (session cookies). We do not use advertising or tracking cookies.
Service providers
We share data only with providers that help us run the service:
- Google — sign-in with Google (United States).
- Cloudflare — Turnstile bot check on forms, if enabled (United States and global edge locations; may process device and browser data).
- Hostinger — hosting (servers in Singapore, backups in India) and SMTP email.
- Semaphore — SMS delivery (Philippines).
- Serbiz Queue — our own queue service. When you link Serbiz Queue, each order that gets a queue ticket sends Serbiz Queue only: the queue you chose, the order's public reference token (the code in the customer's order-status link, so the same order never gets two tickets), the customer's name if they gave one, and whether the customer agreed to receive SMS updates (yes or no). The customer's mobile number is not sent, and neither are the order's items, totals, notes or payment details. When an order is marked Ready, we ask Serbiz Queue to call its ticket, which sends only the ticket ID Serbiz Queue gave us. Both run under the same controller/processor terms.
Because of these providers, your data is transferred to and stored outside the Philippines. We remain accountable under RA 10173 Sec. 21 and use providers bound by confidentiality and security obligations.
How long we keep data
- Subscription payment records and screenshots: 12 months, or for as long as tax laws require (up to 10 years).
- Live data: kept while your account is open. When a paid plan expires, your Live workspace falls back to the Free plan limits; nothing is deleted.
- Orders (including customer payment proofs), customer data, menus and store settings: while the account is active. When an account is closed or deleted, its orders, customer data and settings are erased within 30 days. Backups roll off within a further 30 days.
- Audit and notification logs: 12 months.
Your rights
Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to:
- be informed about how your data is used;
- access your data;
- correct wrong or incomplete data;
- object to processing, and ask us to delete or block your data;
- withdraw your consent at any time, where we rely on consent;
- get a copy of your data in a usable format (data portability);
- claim damages if you are harmed by misuse of your data; and
- file a complaint with the National Privacy Commission.
To use these rights, email contact@serbiz.io (Attn: DPO). We respond within 30 days.
Order and customer data belongs to the business that collected it. If you ordered from a business that uses Serbiz Menu, contact that business directly; requests about this data that reach us are forwarded to the business.
Children
You must be at least 18 to create an owner account. If we learn that a minor has created an owner account, we will close it and delete its data.
Order data may include minors (for example, a child ordering at a family table). This data belongs to the business, and requests about it are forwarded to the business. Businesses should not ask for more data than they need from minors.
Security and data breaches
We protect personal data with organizational, physical and technical security measures as required by RA 10173.
If a personal data breach is likely to cause serious harm, we will notify the National Privacy Commission and affected individuals within 72 hours of becoming aware of it. Where we act as processor, we will notify the affected business without undue delay.
Changes
We may update this policy. We will change the "Last updated" date above when we do. For material changes, we will notify owners by email and with an in-app notice at least 15 days before the change takes effect.
Contact
Sereno Labs · contact@serbiz.io
Data Protection Officer: Carlo Sereno, contact@serbiz.io (Attn: DPO)
Complaints: we acknowledge within 2 business days and aim to resolve within 15. You may also file a complaint with the National Privacy Commission.