Privacy Policy
This policy explains how Gastavo(“we”, “us”) collects and uses personal data when you use our website, our dashboard, or leave feedback through a Gastavo stand in a restaurant. Gastavo is operated by [legal entity name], registered in the Netherlands (KVK: [number]), [registered address]. You can reach us at hello@gastavo.nl.
1. If you are a restaurant guest
Guest feedback is anonymous by design. When you tap a stand or scan a QR code and leave feedback, we store: your star rating, the topics you select, your written comment (optional), the table identifier of the stand, and a timestamp. We do not ask for your name, email address, or account, and we do not use advertising trackers or fingerprinting on feedback pages.
Please do not include personal details (names, phone numbers) in your written comment. If you do, you can ask the restaurant or us to delete the comment at any time.
Written comments are processed by an AI service (OpenAI) solely to categorize the feedback for the restaurant (for example “service” or “waiting time”). Comments are not used to train AI models.
2. If you have a restaurant account
We process the following data to provide the service (legal basis: performance of a contract):
- Account data: your name, email address, and password hash — or your Google account name and email if you sign in with Google. We receive no other data from your Google account.
- Restaurant data: restaurant name, address, branding choices, Google review link, and notification email.
- Billing data: handled by Stripe. We never see or store your full card details.
- Service emails: weekly reports and feedback alerts sent to your notification email (you can switch these off in Settings).
3. If you request a demo
We store the name, email address, and restaurant link you submit, and use them only to contact you about Gastavo (legal basis: your consent, which you may withdraw at any time).
4. Processors we use
We share data only with the processors needed to run the service, under data processing agreements:
- Supabase — database and authentication (data hosted in the EU)
- Vercel — website hosting
- OpenAI — categorization of feedback comments and report summaries (US-based; safeguarded by EU Standard Contractual Clauses)
- Stripe — subscription payments
- Resend — transactional email delivery
- Google — optional sign-in (OAuth)
We never sell personal data, and we do not share it with advertisers.
5. Cookies
We use only strictly necessary cookies: a session cookie that keeps restaurant users logged in. We use no analytics, advertising, or cross-site tracking cookies, which is why we do not show a cookie banner.
6. Retention
- Guest feedback: kept while the restaurant’s account is active, deleted within 30 days after account deletion.
- Account data: kept while your account exists, deleted within 30 days of deletion.
- Invoices and payment records: kept 7 years, as required by Dutch tax law.
- Demo requests: deleted within 6 months if no relationship follows.
7. Your rights
Under the GDPR you may request access to, correction of, deletion of, or a copy of your personal data, restrict or object to processing, and withdraw consent. Email hello@gastavo.nl and we will respond within 30 days. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
8. Changes
If we change this policy in a meaningful way, we will notify restaurant accounts by email and update the date at the top of this page.