Written from the code rather than from a template. Every claim below is one this product can be checked against.
Last updated: 2026-08-22
arinn is used by two different kinds of person, and what is held about each is different. A GUEST scans a code on a table, orders, books or pays. A VENUE — an owner or a member of their team — runs the room from the console.
A guest's information belongs to the visit and to the venue they visited. arinn holds it in order to run that visit and for no other purpose: it is not sold, not rented, and not used to advertise anything to anybody.
A phone number, when one is needed to confirm a booking, recover a bill or sign in. A name, only if one is typed — a visit name is what the table calls itself and can be anything.
The order itself: what was chosen, what it cost, which table, and when. This is a receipt and a kitchen ticket before it is anything else.
A device key, minted on the handset the first time it is used, which is how a phone proves the bill it is looking at is its own. It is not an account and identifies no person.
A location, only when directions are asked for, and only in the browser.
A card number is typed on the payment provider's own page, on the provider's own domain. arinn is handed a token, a brand, four digits and an expiry month, which is enough to recognise a card and — where a venue has asked for it — to charge it again. The full number and the CVV are never sent here, are in no column, and are in no log.
The provider for card payments is Paymob. What they hold and for how long is theirs to state.
Sign-in codes and expired sessions are deleted by a daily sweep. They stopped working the moment they expired; the sweep is about not keeping a phone number attached to a row that means nothing any more.
Orders, payments and bookings are kept as a business record — a venue has to be able to answer a dispute, reconcile a day, and file its own tax return.
A guest account that is erased takes its personal fields with it. What survives is the anonymous shape of the transaction, because a venue's accounts cannot have a night's takings vanish out of them.
A copy of what is held about them, a correction, or erasure. A guest with an account can start erasure from the account itself; anybody else can write, and a venue can ask on behalf of a guest who asked them.
Ask through the address below. If the request is about a specific visit, the venue and the date make it answerable in one go.
A staff or founder session is a cookie the server sets, readable only by the server and confined to the console's own address. A guest's device key and language choice are stored by the browser on the guest surface and go nowhere else.
There is no advertising cookie, no third-party tracker and no cross-site profiling anywhere in this product.
One location is free, there is no card, and you can have a code on a table this afternoon.