Privacy policy
How we process your personal data (GDPR Art. 13).
Data controller
Controller: DataFoxy
Privacy contact: [email protected]
What data we process
Customers: the name and contact details given in a reservation request, reviews, favourites and the chosen location (recent locations stay on your device only). Restaurant owners: login email, hashed password and restaurant details. Everyone: technical data needed for the site to work and, only with your consent, usage statistics.
Purposes and legal bases
Handling reservation requests and restaurant accounts: performance of a contract (Art. 6(1)(b)). Service security and abuse prevention: legitimate interest (Art. 6(1)(f)). Usage statistics with Google Analytics and PostHog: consent (Art. 6(1)(a)), which you can withdraw at any time.
Recipients
The restaurant you send a reservation request to receives the data needed to handle it. Providers processing data on our behalf: hosting, Google (Google Analytics) and PostHog, the last two only with your consent. We do not sell your data. Technical providers: netcup (hosting, Germany) and Cloudflare (DNS, network and security). The restaurant receiving your request processes that data as an independent controller, to handle the reservation.
Transfers outside the EU
PostHog is used on its EU infrastructure. Google may process data in the United States under the EU-US Data Privacy Framework and standard contractual clauses. Cloudflare may process network data outside the EU under the same safeguards.
How long we keep data
Reservations and their history: 24 months after the reservation date. Customer contact details: as long as their latest reservation. Reviews: until deleted or the account is closed, then anonymised. Restaurant accounts: until closure plus 30 days. Session tokens: until they expire. Server logs: 30 days. Analytics: 14 months.
Your rights
You can request access, correction, erasure, restriction and portability, object to processing, and withdraw consent at any time without affecting earlier processing. Write to the privacy contact above: we reply within one month.
Complaints
You have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or your local authority.
Changes
We may update this policy; the version in force is always this page.