Privacy policy
Panolo — order fresh bread where you are staying
Last updated: 20 October 2026
Who we are: Johannes Nevels, trading as Panolo, KVK 42139085,
Verlengde J.A. Feithstraat 11, 9725 AS Groningen, the Netherlands —
privacy [at] panolo.eu
Who is responsible for what
Panolo is used in two ways, and that changes who is responsible.
- If you are a guest ordering bread at a campsite, holiday park, B&B or rental: the venue you are staying at decides to offer the service and uses your data to take and hand over your order. The venue is the controller. Panolo runs the software on the venue's behalf as its processor, under the data processing terms in our terms of service.
- If you run a venue and have a Panolo account: Panolo is the controller for your account, billing and contact data.
- Panolo is also the controller for the little it processes for its own purposes for everyone: keeping the service secure, error reports, and server logs (see Technical data).
This policy describes all of it, so a venue can point its guests here. For questions about your stay, the venue is the quickest route; you can always write to us as well, and we will deal with it or pass it to the venue.
What we process about guests
You are not asked to create an account. Scanning the code on the venue's poster signs you in anonymously — no password, no account to remember.
| What | Why | Required? |
|---|---|---|
| An anonymous account identifier | Links your orders to your phone so you can see, change and cancel them | Created automatically |
| The pitch, berth or room you are staying in | So the venue knows whose bread is whose | Yes |
| Your surname | Registers the pitch to your party, so a second phone can join by typing the same name and nobody else can order on your pitch. The venue sees it next to the pitch | Yes |
| Your arrival and departure dates | Set which mornings you can order for, and mean only guests actually on site get reminders and messages | Yes |
| Your language | So reminders reach you in your language | Set automatically |
| Your email address | Optional. Used only for the evening reminder when push notifications cannot reach you. It stays with Panolo and the mail service that delivers the reminder, and is never passed to Stripe or the venue | No |
| A notification token, if you allow notifications | Sends the evening reminder, the message that your bread is ready, and the venue's announcements (see below). Removed as soon as the push service tells us it no longer reaches your phone or browser | No |
| Your orders — items, quantities, prices, which morning, whether paid, and whether you came from a reminder | The order itself, the order list the venue and its baker work from, and the venue's own records | Yes |
| A repeat order, if you set one | Places the same order every morning of your stay | No |
If your venue uses the optional guest-list check, the venue gives Panolo the surnames booked per pitch, and the name you type is compared against that list. The list is used only for this check, is never shown to other guests, and is replaced whenever the venue updates it.
We do not collect your first name, phone number, home address, card or bank details, location, advertising identifiers, contacts or photos. The camera, if you use it to read the poster, works on your device only: no image is stored or sent. Panolo contains no advertising, no analytics and no third-party trackers, and does not follow you across other apps or websites.
Messages you may receive
- The evening reminder, before ordering closes, if you have no order for the next morning. By push notification, or by email if you gave an address and push cannot reach you.
- "Your bread is ready", by push notification, when the venue marks your order ready.
- Announcements from the venue, by push notification, such as a changed opening time. The venue writes them; they go only to guests whose stay includes that day, and they are also shown in the app under your orders.
You decide: switch the evening reminder off in the app's settings, which also removes that phone's notification token, or turn notifications off for Panolo in your phone's or browser's settings. Either way, ordering keeps working.
Dietary information
Some items are marked gluten-free, vegan or vegetarian. If you order one, that choice is part of your order and is visible to your venue so they pack it correctly. We do not build a dietary profile about you, we do not ask you to declare allergies, and it is never shared beyond the venue you are staying at.
What we process about venues
For a venue account: your email address and password (the password is stored only in hashed form by our sign-in provider), your venue's name, the contact details you choose to show guests, your settings, menu and prices, and, optionally, your baker's email address so the daily order list can be sent there, and the email addresses of colleagues you invite. For your Panolo plan: your billing details, VAT number and invoices, which Stripe collects and holds for us. If you take online payment, Stripe also collects the identity and bank details it requires by law, under its own terms; we see only whether your account is ready. We also note which of our pages and buttons you signed up through — no cookie or tracking is involved — and the language you use.
We email you about your service: verification and password mails, warnings before your free orders run out or your price step changes, invoices, the weekly summary, and the baker's list if you send it to yourself. We send no newsletters.
When you ask for help, Panolo can open your venue's admin to see what you see. Every such session is recorded, and nothing can be sent to your guests or your baker in your name during it.
Payment
Venues choose whether guests pay at pickup or online.
Where a venue takes online payment, the payment is made on a page hosted by Stripe, and the money goes to the venue's own Stripe account; the venue is the seller. Stripe sees your card or bank details; Panolo never receives or stores them. Stripe's page asks for an email address of its own for your receipt; Panolo does not give Stripe the address you gave us for the reminder. We keep the amount, whether it was paid or refunded, and Stripe's reference for it. Because Panolo is the platform the payment runs through, the payment record (amount, date and the kind of payment method) is also visible to us at Stripe, and we use it only to settle, refund or resolve a problem with your order. If you dispute a payment with your bank, we answer the dispute for the venue and give Stripe, for your bank, what we hold about that order: what was ordered, for which pitch and morning, and whether it was collected. Stripe's own privacy notice covers what Stripe holds: stripe.com/privacy.
Technical data
Like any online service, Panolo's servers see your device's IP address and browser or device type when you connect, and its sign-in service records them. If the app hits an error, it sends us a report with your anonymous identifier, the error message, the type of device and the app version. We use this only to keep the service working and secure, and to stop misuse (for example, limits on how often an action can be repeated).
In the iPhone and Android apps, Apple's App Attest and Google's Play Integrity confirm to our servers that requests come from the genuine app.
Cookies and storage on your device
Panolo sets no tracking or advertising cookies and uses no analytics. Our website and these pages set no cookies at all. The app stores on your device only what it needs to work: your sign-in, so you stay signed in for your stay; on the web, the venue you last joined, so it can offer you the way back; and a short record of the current page load, which is removed when you close the tab. This is strictly necessary for the service you asked for, so it needs no consent.
Why we are allowed to use it
- Performing the service you asked for — taking your order and having it ready; the pitch, surname, stay dates and order contents are necessary for it. For venues: our contract with you.
- Your consent — the optional email address and push notifications. Withdraw it at any time, as described above.
- Legitimate interest — the venue's interest in making sure only the guests on a pitch order for it, and ours in keeping the service secure and working (error reports, logs, misuse limits).
- Legal obligation — keeping invoices and payment records as tax law requires.
Who else sees it
- Your venue, and only your venue. Guests at one venue cannot see another venue's data, and a guest cannot see another guest's orders. This is enforced by server-side security rules, not only by the app. The venue does not see your email address or notification tokens.
- Panolo, only to run the service, answer a support question, or carry out a deletion a guest or venue asked for.
- The venue's baker, if the venue has the order list emailed there: pitch numbers and items, no names.
- Our service providers, each under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Google (Firebase and Google Cloud) | Sign-in, database, server functions, hosting, push notifications, logs | Database in the Netherlands, functions in Belgium; sign-in runs from the US; hosting, push and app checks run on Google's worldwide network |
| Brevo (Sendinblue SAS, France) | Delivers our emails: reminders, the baker's list, account and billing mails | EU |
| Stripe (Stripe Payments Europe, Ireland) | Guest payments to venues that take them online, and venue billing. For some purposes, such as fraud prevention and its legal duties, Stripe acts as a controller in its own right | EU, with transfers to the US |
| Apple, Google, or your browser's maker | Carry a push notification to your phone or browser | Their own networks |
We do not sell your data and never will.
Where it is stored, and transfers outside the EU
The database, which holds profiles, pitches and orders, is in the
europe-west4 region (the Netherlands), and our server functions run
in europe-west1 (Belgium). Some services cannot be pinned to the EU:
Google's sign-in service runs from US data centres, and hosting, push
notifications and app checks run worldwide; Stripe may transfer payment data to
the US. Where data leaves the EU, it is protected by the EU-US Data Privacy
Framework, under which Google and Stripe are certified, and by the European
Commission's standard contractual clauses in their data processing terms.
How long we keep it
| What | How long |
|---|---|
| Guest profile — pitch, stay dates, language, optional email, notification tokens — and the anonymous account | Deleted once the day after your departure date is over, automatically, by a nightly job |
| Your surname on the pitch registration | Removed by the same nightly job as your profile; if someone from your party is staying longer, when their stay ends instead. Removed at once when the venue releases the pitch, or when you use Delete my data or sign out on this phone in the app and no one else from your party is on it |
| Orders and payment records | Kept for the venue as its trading records for as long as it uses Panolo. They are stored against the pitch number, and once your profile is deleted they no longer link to you in Panolo |
| Emails we send | The address and the message are removed from our systems as soon as the email is sent; a record that an email was sent stays for 7 days. An email that could not be delivered keeps its address for those 7 days so we can see what went wrong. Brevo keeps its own delivery logs for a limited period |
| Error reports | 30 days |
| Server logs | 30 days |
| Venue accounts and their data | For as long as the account exists, and deleted within 30 days after it is closed (see our terms). Invoices are kept for 7 years, as Dutch tax law requires |
Deleted data can remain in our database backups for up to 7 days before it is gone for good.
You do not have to wait for your departure date. Delete my data, in the app's settings, immediately deletes your profile, email address, stay dates, notification tokens and anonymous account, takes you off the pitch, and cancels the upcoming orders you placed. If no one else from your party is still on the pitch, it also removes the surname from the pitch and stops the pitch's repeat order and the orders it placed; otherwise those stay, because they are your party's. If you no longer have your phone, ask the venue or write to us, and we will do it for you.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, receive it in a portable form, and withdraw consent at any time. Contact your venue or privacy [at] panolo.eu; we answer within a month. Because guests have no account, we may ask you for your pitch, venue and stay dates to find your data. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in the country where you live.
How to delete a venue account, a colleague's login or a guest's data, in the app or by email: Delete your account or data.
Children
Panolo is meant for adults ordering for their party. If you are under 16, please ask the adult you are staying with to order. A parent ordering bread for a family gives us no data about the children.
Changes
We post changes here and update the date above. If a change affects how we use data you have already given us, we tell you in the app or by email before it applies.