Privacy policy
Informative translation. In case of any discrepancy, the Spanish version prevails.
Last updated: 27 October 2026
This policy explains what personal data Tavolly processes, why, for how long, who it is shared with and how to exercise your rights. It applies to the tavolly.com website, the app and the booking service. It complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Tavolly is booking software for restaurants. We do not sell personal data and we do not use it for third-party advertising.
1. Data controller.
The controller of the data of client restaurants, their team, the waitlist and people who write to us is:
- Controller: Benito Escat Vélez, self-employed
- Tax ID (NIF): 47948769W
- Contact: hello@tavolly.com
We have not appointed a Data Protection Officer. For any privacy matter, write to hello@tavolly.com.
2. Tavolly's two roles.
- As controller we process the data of the restaurants that subscribe to Tavolly, of the members of their team, of people who join the tavolly.com waitlist and of people who ask us for information. Sections 3, 5 and 6 describe this case.
- As processor we process the data of guests who book at a restaurant that uses Tavolly. The controller of that data is the restaurant: it decides what it is used for, and Tavolly processes it only on its instructions, under the Data Processing Agreement (in Spanish). If you have booked at a restaurant and want to exercise your rights, contact the restaurant. If you write to us at hello@tavolly.com, we will pass your request on to it without delay.
3. Data of client restaurants.
We process the account and contact data you give us when you sign up or invite someone to the team:
- Name of the person, email and phone.
- Name of the restaurant, country, time zone, language and the address of its booking page.
- Address, phone and contact email of the venue, if you fill them in on the dashboard so that they appear in the messages to your guests.
- Name, email and role of each team member (owner, manager or staff).
Billing data: the plan subscribed to, the subscription status and the Stripe customer identifier. The card number, billing address and tax ID are collected by Stripe on its payment page. Tavolly does not see or store the card number. Invoices, card changes and cancelling the subscription are managed in the Stripe portal, from Plan on the dashboard.
Service usage data: the restaurant's configuration (hours, floor plan, booking rules, links), the help conversations on the dashboard and, if the team turns on notifications in the mobile app, the device identifier used to send them.
Technical data: there is no password. Access to the dashboard is via a single-use link sent by email, or a six-digit code in the app. We store a session (30-day cookie) and, to limit abuse, the IP address associated with that limit for about one day.
If you join the website waitlist, we store your email, the restaurant name and the city if you give them, the language and the consent text you accepted.
The Google connection is described in section 9. We do not ask for any other Google account data.
4. Data of guests who book.
When someone books at a restaurant that uses Tavolly, the restaurant is the controller and Tavolly stores, on its behalf:
- Name, phone, email and language.
- The booking details: date, time, number of people, status, channel it came through, table if the restaurant assigns tables, and the visit history of that profile.
- The booking notes. They may include allergies or intolerances. They are only stored if the guest ticks the consent box. They are health data (special category, article 9 GDPR).
- Tags the restaurant adds to the profile (for example, regular or celebration) and the team's internal note, which is not sent to the guest.
- If the guest ticks the news box, the preference to receive emails from the restaurant, and the date they unsubscribe.
- If they accept WhatsApp, that preference on the booking. Section 10 explains what is sent.
- If the restaurant asks for a card guarantee, the reference of the payment method in Stripe (an identifier). The card number is stored by Stripe in the restaurant's Stripe account. Tavolly does not see it.
The restaurant team can enter a booking with the same data. It can also import a list of customers (name, email, phone and language). The marketing box in that import is only ticked if the restaurant confirms that those people have already given it permission. It can download a CSV of the profiles; notes are not included in that download.
The restaurant can delete a guest's personal data from their profile on the dashboard. The name, email, phone, notes and tags are deleted, and past bookings remain without that data.
5. Purposes and legal basis.
We do not take automated decisions that produce legal effects on you.
Data for which Tavolly is the controller:
| Purpose | Legal basis |
|---|---|
| Signing you up, providing the service, giving support and managing the trial and the subscription | Performance of the contract (art. 6.1.b GDPR) |
| Sending you the access link or code, trial notices, team invitations and support replies | Performance of the contract (art. 6.1.b GDPR) |
| Invoicing and complying with accounting and tax obligations | Legal obligation (art. 6.1.c GDPR) |
| Keeping the service secure and limiting abuse, with minimal technical logs | Legitimate interest (art. 6.1.f GDPR) |
| Writing to you if you joined the waitlist, to let you know about the launch and introduce the service | Consent (art. 6.1.a GDPR). You can withdraw it by replying «baja» (unsubscribe) or writing to hello@tavolly.com |
| Answering a query before becoming a client | Pre-contractual measures (art. 6.1.b GDPR) or consent (art. 6.1.a GDPR) |
Guest data, processed on behalf of the restaurant and on its instructions:
| Purpose | Legal basis |
|---|---|
| Managing the booking, the floor and the visit history | Performance of the booking request (art. 6.1.b GDPR) |
| Sending the confirmation, changes, reminder and cancellation by email | Performance of the booking (art. 6.1.b GDPR) |
| Sending those same messages by WhatsApp | Consent (art. 6.1.a GDPR): the box when booking, or the team's tick when entering the booking |
| Storing notes about allergies or intolerances | Explicit consent (art. 9.2.a GDPR) |
| Saving a card as a guarantee for the booking, in the restaurant's Stripe account, and charging it only if the conditions the restaurant shows when booking are met | Performance of the booking (art. 6.1.b GDPR) |
| Sending the restaurant's email campaigns to people who agreed to receive them | Consent (art. 6.1.a GDPR). Every email includes an unsubscribe link |
| Notifying the team's phone of a new, changed or cancelled booking, with the guest's name, number of people and time | Performance of the contract with the restaurant (art. 6.1.b GDPR) |
Tavolly does not use guest data for its own advertising. Campaigns are decided and sent by the restaurant, and only to those who gave their permission.
6. Retention periods.
- Restaurant account: for as long as the account exists. If you close it, we keep the billing documents for the legal periods: six years for commercial documentation (art. 30 of the Spanish Commercial Code) and four years for tax information (art. 66 of the Spanish General Tax Law). The rest of the account data is deleted when you ask, unless the law requires it to be kept.
- Access links: 15 minutes, and the sign-up link, 24 hours. The app code: 10 minutes. The session: 30 days, or until you log out.
- Technical rate-limiting logs, including the IP: about one day.
- Google connection: until the restaurant disconnects it. At that point the permission is revoked and the token deleted.
- Help conversations: for as long as the account lasts, or earlier if you ask us to delete them.
- Waitlist: until you unsubscribe or ask us to delete your email.
- Guest data: for as long as the restaurant keeps its account and does not delete it. When the contract ends, the restaurant has 30 days to export it, as stated in the Data Processing Agreement. It is then deleted, unless a law requires it to be kept.
- Log of WhatsApp messages (phone, type of message and delivery status): the same period as the booking they are linked to.
7. Recipients and processors.
We do not sell personal data. We share it with providers that give us a service, under a contract requiring them to process it only on our instructions, and with the restaurant when the data belongs to its guests. We may also disclose it to a tax or accounting adviser and to the authorities when the law requires it.
| Provider | Purpose | Where |
|---|---|---|
| Railway Corporation | Hosting of the application and the database | European Union (Netherlands, europe-west4 region). The company is based in the United States |
| Stripe Payments Europe, Limited, and Stripe, Inc. | Charging the Tavolly subscription and, in each restaurant's Stripe account, the card guarantee | Ireland, with processing in the United States |
| Google LLC | Sign-in to connect the account and management of the Google Business Profile listing, including the Book button. Section 9 | United States |
| Meta Platforms Ireland Limited (WhatsApp) | Booking messages via WhatsApp Business. Section 10 | Ireland, with possible transfers to Meta Platforms, Inc. (United States) |
| Plus Five Five, Inc. (Resend) | Sending emails: access, bookings, support, trial, team and the restaurant's campaigns | United States |
| Anthropic, PBC | Drafting the reply of the dashboard help assistant and, on the Pro plan, the draft of a campaign based on the idea the restaurant writes. In help, emails and phone numbers are struck out before the text is sent. The guest list is not sent. Under its API terms, Anthropic does not use that content to train its models | United States |
| 650 Industries, Inc. (Expo) | Delivering a booking notification to the team's phone (guest name, number of people, date and time). Phone, email and notes are not sent. Expo forwards it to Apple or Google to display it on the phone | United States |
8. International transfers and safeguards.
The application and database are in the European Union (Netherlands). Even so, several providers process data in the United States. That transfer is covered by one of these safeguards under chapter V of the GDPR:
- The EU-US Data Privacy Framework, when the provider is certified. Google LLC, Meta Platforms, Inc., Stripe, Inc., Plus Five Five, Inc. (Resend) and Railway Corporation are certified. 650 Industries, Inc. (Expo) states in its policy that it adheres to that framework.
- The standard contractual clauses approved by the European Commission (Implementing Decision 2021/914), when the provider is not certified or the certification does not cover that processing. This is the case for Anthropic, PBC, and the fallback for the rest if a transfer fell outside the framework.
You can request a copy of these safeguards at hello@tavolly.com.
9. Google API data.
The restaurant can connect its Google account from the dashboard (Settings, «Links & QR» tab). It signs in with the Google account that manages its listing. Tavolly only asks for these permissions:
openidandemail, for that sign-in: identifying the connected account and showing its email on the dashboard. We store that email.https://www.googleapis.com/auth/business.manage, only to manage that restaurant's Google Business Profile listing and add the Book button. With that permission we read the listings the account can manage (name and address of the venue) and we create, update or remove the booking link (restaurant reservation type) so that the Book button opens the Tavolly booking page. We do not modify the rest of the listing.
We store, encrypted, the token that keeps that connection, the account email, the name and address of the chosen listing and the button identifier.
That data is not sold. It is not used for advertising, to show ads, to measure them or to create advertising profiles. It is not used to train models. It is not shared with advertisers. We do not access email, contacts or any other Google product. It is not used to log in to Tavolly: access to the dashboard is with the email of the Tavolly account.
Tavolly's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke access in either of these two ways:
- From the Tavolly dashboard: Settings, «Links & QR» tab, under Google, «Disconnect» button. Tavolly removes the Book button from the listing, revokes the permission in Google and deletes the token.
- From your Google account: https://myaccount.google.com/permissions. If you withdraw the permission there, Tavolly can no longer use the listing.
10. WhatsApp.
If the restaurant turns on the messages in Settings, «Online bookings» tab, Tavolly may send the guest WhatsApp Business messages through Meta. They are sent from Tavolly's WhatsApp number and carry the restaurant's name. They are sent in addition to the email, not instead of it.
They are only sent if the guest ticks the box «Receive the confirmation and reminder by WhatsApp» when booking, or if the restaurant team ticks that option when entering the booking. The messages are the confirmation, changes, reminder and cancellation.
Meta receives the guest's name, their phone, the restaurant's name, the date, the time, the number of people and a link to manage the booking or book again. Tavolly stores the phone, the type of message and the delivery status reported by Meta. It does not store the text of those templates.
If the guest writes to that number, Tavolly replies that the number only sends booking messages and forwards the message and the phone number to the restaurant's email, so that the restaurant can reply.
To stop receiving them, do not tick the box on your next booking. If you already have a booking and want to stop receiving the messages, write to hello@tavolly.com or to the restaurant and we will stop sending them. You can also block Tavolly's WhatsApp number from the WhatsApp app.
11. Your rights.
You can request access to your data, its rectification or erasure, object to processing based on legitimate interest, request restriction of processing, request portability and withdraw your consent at any time. Withdrawing it does not affect processing already carried out.
Write to hello@tavolly.com stating which right you want to exercise. We will reply within one month. If necessary, we will ask you for some information to check that it is you. If you are a client, write to us from the account email.
If you are a guest, the controller is the restaurant. You can ask it directly: on the dashboard it can correct the profile, download it and delete your personal data. If you write to us, we will pass the request on to the restaurant without delay.
You can also lodge a complaint with the Spanish Data Protection Agency (AEPD), at www.aepd.es. We would be grateful if you wrote to us first so we can try to resolve it.
12. Security.
We use encrypted connections (HTTPS), we separate each restaurant's data in the database, access to the dashboard does not use passwords and session tokens are stored hashed. The Google token is stored encrypted. Card data is processed only by Stripe. Access to the dashboard depends on the role (owner, manager or staff).
13. Minors.
Tavolly is a service for restaurants. It is not aimed at children under 14 (art. 7 LOPDGDD).
14. Cookies.
The session cookie keeps you logged in to the dashboard. Another cookie remembers the language chosen on the website. When connecting Google, a technical cookie lasting a few minutes is used to complete the permission. Stripe may use its own cookies on the payment page and on the card guarantee page. The details are in the Cookie policy.
15. Changes.
If we change this policy, we will publish the new text here and change the date above. If you are a client and the change is important, we will let you know by email.
16. Contact.