Data and security

Your own sign-in is protected from your account page; the restaurant's rules are under Settings, "Data and security".

Two-step verification on your account

Under your name in the header, open your account, then "Two-step verification". Press "Turn on" and scan the code with an authenticator app on your phone, or type the "Key". Enter the "Code from the app" and press "Confirm". Keep the "Recovery codes" somewhere safe: each works once, if you lose your phone, and they are shown only now. From then on, signing in asks for a code from the app after your password.

Require it for your team

On Settings, "Data and security", "Two-factor sign-in" sets who must use it. Under "Require it for", tick "Owners", "Managers" or "Everyone with access to billing", then "Save the policy". People it newly covers get a few days to set it up, with a reminder and a "Set it up now" button on every page; after that they are sent to set it up before anything else. "Covered, without two-factor yet" lists who still has to do it. A restaurant in a group also follows the group's policy, which the card names.

Export everything

"Export everything" prepares one ZIP with every record the restaurant holds: menus, guests, orders, payments, bookings, gift cards, loyalty, the team, shifts, invoices and more, each as JSON and CSV, with a README describing every file. We email you a download link when it is ready, and the export is listed on the page until its link expires. Your data stays yours, whether you stay or leave.

Support access

Our support team can open your account only while you allow it. Under "Support access", press "Allow support for 72 hours" before you ask for help with something they need to see; "Close support access" ends it early. Every support session appears under "Support sessions and decisions" and in the activity log. If support ever has to get in without your permission, in an emergency, every owner is emailed the reason.

A guest's own data

A guest who asks what you hold about them, or asks to be forgotten, is answered from their profile, as the Guests and CRM guide explains.