Version 0.3, 26 October 2026. The Polish version is binding. This English version is a translation.

Privacy Policy

This policy explains how ResTable ("we") processes personal data for its own purposes: when you visit our website, use a ResTable account, sign up, try our demo, or are a business we would like to work with.

If you booked a table at, or called, a restaurant that uses ResTable, the restaurant is responsible for your data and ResTable processes it on the restaurant's behalf. The restaurant's guest privacy notice explains that processing. You find it linked from the booking form, from the messages you receive, and at the start of the call.

1. Who is responsible

Tomasz Rusin, trading as ResTable, ul. Ozimska 47, 45-057 Opole, Poland. Privacy contact: hello@restable.net. ResTable will be transferred to ResTable GmbH once it has been established; we will update this policy and tell account holders then.

2. What we process, why, and on what basis

2.1 Visiting restable.net

• What: the pages you request, the time, your browser type, and the referring website (reduced to its domain). Our website server does not log your IP address. If one of our scripts fails in your browser, it sends us an error report: the error message, the page, the language and your browser type. No IP address is stored with it.
• Why and basis: to run, secure and fix the website; our legitimate interest (Art. 6(1)(f) GDPR).
• How long: website logs 30 days; error reports 90 days.
• The website uses no tracking, analytics or advertising cookies, and loads no third-party scripts or fonts.

2.2 Restaurant accounts and staff logins

• What:
  • name, e-mail address, password (stored only as a secure hash), language, role and permissions;
  • second-factor settings, devices you have confirmed, and login sessions;
  • actions you take in the dashboard where they are part of a booking's history (for example, "confirmed by Anna").
• Why and basis: to provide the account and the service to the restaurant you work for. Our contract with the restaurant (Art. 6(1)(b)) and our legitimate interest in running and securing accounts (Art. 6(1)(f)).
• How long: as long as the account exists. After the restaurant's contract ends or the account is closed, account data is deleted after 90 days, except contract records we must keep by law.
• Login sessions expire after 30 days of inactivity and are then deleted. Recognised-device records are deleted after one year.

2.3 Restaurants as our customers

• What: the business's name and address, the contact person's name, e-mail and phone number, the contract and its acceptance, support conversations.
• Basis: contract (Art. 6(1)(b)); our legitimate interest in being able to prove what was agreed (Art. 6(1)(f)).
• How long: for the contract, then 3 years (the limitation period for business claims, art. 118 of the Polish Civil Code).

2.4 Signing up

• What:
  • your name, e-mail address, phone number and password;
  • the venue you search for and pick;
  • whether your phone number is valid for SMS (checked with our telephone provider);
  • a one-time code sent to you by SMS or e-mail.
• Why and basis: to create your account and stop fake sign-ups (Art. 6(1)(b) and (f)).
• Providers:
  • Google (Places API) receives the text you type to search for your venue, and returns public business details;
  • Telnyx checks your phone number;
  • Cloudflare Turnstile checks that you are not a bot (see 2.7).
• How long: an unfinished sign-up is deleted after 30 days.

2.5 Trying the demo

• What: if you ask the demo to call you, your phone number. The demo call itself is transcribed (not recorded), and we keep a hashed form of your IP address to limit misuse.
• Basis: your request (Art. 6(1)(b)) and our legitimate interest in preventing misuse (Art. 6(1)(f)).
• How long: transcripts 182 days; phone number and hashed IP 90 days.

2.6 Businesses we would like to work with

• What: we research restaurants that might benefit from ResTable using public sources (the venue's own website, maps and business listings). We record:
  • the business's public details;
  • the name and role of the person we spoke to, and their business e-mail and phone number;
  • notes from our visit or call;
  • the e-mails we sent.
• Basis: our legitimate interest in offering our service to businesses (Art. 6(1)(f)) for the research, visits and notes. We send you marketing e-mails only with your prior consent, and we make marketing phone calls only with your prior consent too (art. 398 of the Polish Electronic Communications Law; for businesses in Germany also § 7 UWG). We write only to business addresses, and only about ResTable.
• Where the data comes from: public sources and our conversation with you (Art. 14 GDPR).
• Your right to object: you can tell us at any time to stop. We then stop contacting you and keep only what we need to respect that.
• How long: 2 years after our last contact, unless you become a customer.
• Providers: Google Places and SerpApi (searching public business listings); Scaleway (drafting e-mails); Amazon SES (sending e-mails).

2.7 Protection against abuse

• What:
  • Cloudflare Turnstile checks, on our booking form and sign-up, that a person and not a bot is using them. Cloudflare receives your IP address and technical signals from your browser.
  • We also keep hashed (irreversibly scrambled) forms of IP addresses, phone numbers and e-mail addresses used on the booking form, to detect automated abuse.
• Basis: our legitimate interest, and the restaurants', in keeping booking forms free of abuse (Art. 6(1)(f)).
• How long: hashed signals 90 days.

2.8 Support, bug reports and error records

• What: what you tell us. If you send a bug report from the dashboard, it includes your e-mail address, your description, the screen you were on, your browser type and, if you add them, a screenshot or voice note. A screenshot can show guest data visible on your screen at the time. When the software fails, we record the error, which can contain text that was being processed.
• Basis: our legitimate interest in providing support and fixing faults (Art. 6(1)(f)).
• How long: screenshots and voice notes 90 days; bug descriptions 1 year; error records 90 days; monitoring logs 30 days.

3. Who receives data

We use these providers for the processing described here:

• Hetzner (hosting, Germany);
• Cloudflare (storage in the EU, bot protection);
• Telnyx (telephony);
• Amazon Web Services (e-mail, Frankfurt);
• Scaleway (language models, France);
• Google (venue search);
• SerpApi (business listings).

Providers that work for restaurants on guest data are listed, with locations, at https://restable.net/legal/subprocessors. We do not sell personal data and do not use it for advertising.

4. Transfers outside the EU

Some providers are established in the USA (Cloudflare, Telnyx, Amazon, Google, SerpApi). Where they can access personal data, the transfer is protected by the EU–US Data Privacy Framework for certified companies, or by the European Commission's Standard Contractual Clauses.

5. Your rights

You have the right to:

• access your data and get a copy (Art. 15);
• correct it (Art. 16);
• have it erased (Art. 17);
• restrict processing (Art. 18);
• receive it in a portable format (Art. 20);
• object to processing based on our legitimate interest (Art. 21), including at any time to direct marketing;
• withdraw any consent you gave, for the future.

Write to hello@restable.net. We answer within one month.

You also have the right to complain to a data protection authority:

• the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl;
• or the authority where you live or work.

6. Cookies

See the Cookie Notice. In short: we set only the cookies needed for logging in and for choices you make, such as language.

7. Changes

We update this policy when our processing changes. The date at the top shows the current version.