Privacy Policy

Last updated: July 1, 2026

This policy explains what Mesa (operated by Cortana Tech Solutions) collects, why, and your choices. We handle personal data in line with the Philippines’ Data Privacy Act of 2012 (RA 10173). “You” means a café owner using the dashboard; “guest” means a diner viewing a café’s menu.

What we collect

From café owners

• Account data — your email address and a securely hashed password (handled by our auth provider).
• Café content — your café name, menu items, prices, descriptions, photos, branding, and settings.

From guests

• Order details — when a café enables ordering, the items, options, quantities, an optional table number, and any note a guest adds. Guests browse and order without creating an account.

Automatically

• Technical data — basic logs (e.g. IP address, browser type, timestamps) needed to run and secure the service.

Cookies

We use strictly necessary cookies to keep café owners signed in and to operate the service. We do not use advertising or cross-site tracking cookies.

How we use data

• To provide the service — show menus to guests and let owners manage them;
• to authenticate owners and keep accounts secure;
• to provide support and respond to your messages; and
• to maintain, debug, and improve Mesa.

We do not sell your personal data.

Who we share it with

We use a small number of trusted providers (“sub-processors”) to run Mesa:

• Supabase — database, authentication, and file storage.
• Hostinger — application hosting.

We may also disclose data if required by law. A café’s own content (its menu) is, by design, shown publicly to that café’s guests.

Where data is stored

Data is stored with our providers, which may process it on servers outside the Philippines. We rely on these providers’ safeguards to protect it in transit and at rest.

How long we keep it

We keep account and café content while your account is active. If you delete your café or ask us to close your account, we remove the associated data, except where we must retain limited information to meet legal obligations. During the beta, data may also be reset.

Your rights

Under the Data Privacy Act you may request to access, correct, update, or delete your personal data, or object to certain processing. Owners can edit most data directly in the dashboard; for anything else, contact us below and we’ll help.

Security

We protect data with measures such as encrypted connections (HTTPS) and per-café access controls so one café cannot see another’s private data. No system is perfectly secure, but we work to keep your data safe and to address issues promptly.

Children

Mesa is intended for café businesses and is not directed at children.

Changes

We’ll post any updates to this policy here with a new date.

Contact

For privacy questions or requests, email support@cortanatechsolutions.com.