Privacy Policy

Last updated: November 1, 2026

This Privacy Policy describes how RESTOBOT ("we", "us", or "our") collects, uses, and protects personal data when you use our platform, website, and services (collectively, the "Service").

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Polish data protection laws.

The analytics and advertising tools described in this Policy are used only on our own website, www.restobot.pro. Websites of individual establishments built on the Service have their own privacy and cookie policies, available on those websites.

1. Service Provider

The Service is provided by:

RESTOBOT Yaroslav Baran
Śląska 6, m. 14, 02-472 Warsaw, Poland
NIP 1133092409
REGON 524951267

For any privacy-related inquiries, please contact us at: [email protected]

2. Data We Collect and Our Roles

RESTOBOT is the controller for its own business customer relationships, account administration, support, security and marketing website. When processing guest orders, reservations, loyalty or customer records on an establishment's instructions, the establishment is the controller and RESTOBOT is its processor under the data processing agreement. The venue's privacy notice describes that processing. Personal worker profiles and tip payments are also covered by the Worker Privacy Policy and Tips Privacy Policy; their specific disclosures prevail for those services.

We process information you supply and technical request, account and security information needed to operate the Service, including identifiers, IP addresses and log records where generated by the Service or its hosting providers. Optional analytics and advertising processing is separate and requires the permissions described in Section 4.

2.1 Order Data

When you place an order through the Service, we collect:

email address
phone number
first and last name (optional)
delivery address (street, building, entrance, floor, apartment, city, postal code, geographic coordinates)
order comments
tip amount
promo code (if used)

2.2 Reservation Data

When you make a reservation, we collect:

email address
phone number
first name
preferred date, time, guest count, and duration
comments (optional)
reservation status and status history, attendance, cancellations, no-show history, venue-specific booking restrictions and relevant staff notes
prepayment and refund records, amounts, currency, payment status, Stripe customer and payment-method identifiers and payment/setup identifiers; for a card guarantee, the authorisation text, version and timestamp, and the IP address where recorded

2.3 Authentication Data (Administrators)

Owners, managers and workers may authenticate using Telegram, email/password or Google where offered. Email authentication involves contact details, password hashes, email verification/reset records and session tokens. Google sign-in supplies an account identifier, email and available profile information. For Telegram sign-in, profile data may include:

Telegram user ID
first and last name
username
profile photo URL

Authentication data is used for access control, account linking and security. Telegram also processes technical requests when its login tools or bots are used under its own policy. In the mobile app, we process device push tokens for notifications and photos you choose to upload; QR scanning and image selection depend on the requested device permissions.

2.4 Business Inquiries (Contact Form)

When you contact us through the form on www.restobot.pro, we collect:

the name and address of your establishment (optional)
phone number, email address and/or Telegram username
your preferred contact channel and message (optional)

Together with the inquiry, we record how you reached us, so that we know which page and which advertising campaign the inquiry came from:

the page where you sent the form, the page you viewed before it, and the page through which you first entered our website
the website language and your browser language
the external website you came from (its address without query parameters)
campaign parameters contained in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and advertising click identifiers (gclid from Google Ads, fbclid from Meta)

Information about your first visit is remembered in your browser for up to 90 days only if you have consented to analytics or advertising cookies. Without such consent, it is kept only until you leave or reload the page. Inquiries are stored in our database and forwarded to an internal Telegram chat used by our team.

3. How We Use Your Data

We use the collected data exclusively for the following purposes:

processing and fulfilling orders
managing reservations
authenticating administrators
providing and maintaining the Service
responding to business inquiries and knowing which pages and campaigns they come from
with your consent, measuring traffic on our website and the effectiveness of our advertising campaigns

Apart from measuring and optimizing our own advertising with your consent (Section 4), we do not use your data for marketing purposes. We do not send promotional emails, SMS campaigns, or newsletters.

3.1 Legal Bases

Data needed to perform a contract with an individual account holder is processed under Art. 6(1)(b) GDPR. Data of a business customer's representatives and staff is processed under Art. 6(1)(f), for our legitimate interest in managing that relationship and authorised access. Billing records required by law rely on Art. 6(1)(c); security and proportionate claims handling rely on Art. 6(1)(f).
Business inquiries are processed to take steps at your request before a contract with you (Art. 6(1)(b) GDPR), or to respond to a representative of a business under our legitimate interest (Art. 6(1)(f)). Recording where an inquiry came from is based on our legitimate interest in understanding which channels bring us customers (Art. 6(1)(f) GDPR).
Analytics and advertising cookies and similar technologies are used only on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Cookies and Local Storage

We use browser storage technologies that are strictly necessary for the operation of the Service. On our website www.restobot.pro we also use analytics and advertising cookies, but only after you agree to them in the cookie banner. Until you make a choice, or if you decline, these tools are not loaded at all.

You can change or withdraw your consent at any time using the "Cookie settings" link in the footer of our website. When you withdraw consent, we delete the cookies these tools have set on our domain.

4.1 Cookies

Authentication cookies (robot_auth_token, robot_worker_auth_token, robot_partner_auth_token) — contain a JSON Web Token (JWT) used to keep you signed in and are set with a maximum lifetime of 30 days. Server-side token validity is checked separately; logout or browser settings may remove the cookies earlier.

4.2 Local Storage

Authentication token copy — supports account sign-in as a fallback to the corresponding cookie. It remains until removed by the application, for example on logout, or when browser site data is cleared. Local storage does not itself apply the cookie's 30-day expiry; server-side token validity is checked separately.
Shopping cart — stores the contents of your current cart for each establishment
Language preferences — stores your selected display language
Feedback status — records whether you have already submitted feedback to avoid duplicate submissions
Cookie consent — stores your choice made in the cookie banner
Traffic source — the first page and campaign parameters of your first visit (see Section 2.4), kept for 90 days; stored only with your consent to analytics or advertising cookies

4.3 Session Storage

UI state — temporary data for interface elements (e.g., whether a banner has been shown), cleared when you close the browser tab
Pages visited — the current and previous page on www.restobot.pro, used to show where a business inquiry was sent from; stored only with your consent to analytics or advertising cookies

4.4 Analytics Cookies (only with your consent)

Google Analytics 4 (_ga, _ga_*) — distinguishes visits and measures how our website is used; kept for up to 2 years
Contentsquare (Hotjar) (_cs_*) — shows how pages are used (for example, clicks and scrolling) so that we can improve the website; kept for the period set by the provider

4.5 Advertising Cookies (only with your consent)

Google Ads (_gcl_*, set through Google Analytics) — links your visit to a click on our Google ad so that we can measure our campaigns; kept for 90 days
Meta Pixel (_fbp, _fbc) — measures visits and results of our ads on Facebook and Instagram; kept for 90 days

With your consent, we send these providers information about page views and about the following actions on our website: sending a business inquiry, clicking our contact links (Google Analytics only), creating an account, and purchasing a subscription. We do not pass your name, email address or phone number to these providers.

5. Third-Party Services

To provide the Service, we integrate with the following third-party providers. Each of these providers may process certain data as described below:

5.1 Payment Processing

Stripe — processes online card payments. Stripe receives your payment card information directly; we do not store full card details. Stripe's privacy policy: stripe.com/privacy
LiqPay — an alternative payment processor. Payment data is handled directly by LiqPay. LiqPay's privacy policy: liqpay.ua/en/privacy

5.2 Delivery

Wolt Drive — when Wolt Drive is selected as the delivery method, your delivery address and phone number are shared with Wolt to fulfill the delivery. Wolt's privacy policy: wolt.com/en/privacy

5.3 Maps and Address Autocomplete

Google Maps — used for delivery address autocomplete. When you type a delivery address, your input is sent to Google Maps to provide suggestions. Google's privacy policy: policies.google.com/privacy

5.4 Image Storage

Cloudinary — stores images uploaded by establishment administrators (e.g., menu item photos). Uploaded images can include personal data, such as worker profile or personal goal photos. Cloudinary also receives technical requests when images are uploaded or displayed. Cloudinary's privacy policy: cloudinary.com/privacy

5.5 Authentication and Notifications

Google provides account authentication where you choose that method and processes the associated sign-in requests under its Privacy Policy.

Telegram — used for login, optional account linking, guest and staff bots and notifications. Depending on the feature, Telegram receives message content and chat identifiers and supplies account identifiers and profile data. Telegram's privacy policy: telegram.org/privacy
Telegram— business inquiries sent through the contact form on our website are forwarded to our team via a Telegram bot.

Mobile push notifications are delivered using Expo and the device platform's push infrastructure (Apple or Google), using a device token and notification payload. Hosting, email delivery and support providers process information needed for their functions. The applicable data processing agreement and provider list govern processing on a venue's behalf.

5.6 Analytics and Advertising (www.restobot.pro, only with your consent)

Google Analytics and Google Ads (Google Ireland Limited) — website analytics and measurement of our advertising campaigns. Google's privacy policy: policies.google.com/privacy; how Google uses data from websites: policies.google.com/technologies/partner-sites
Meta Pixel (Meta Platforms Ireland Limited) — measurement of our advertising on Facebook and Instagram. For collecting and transmitting data through the Meta Pixel, we and Meta are joint controllers; further processing is Meta's own responsibility. Meta's privacy policy: facebook.com/privacy/policy
Contentsquare (Hotjar) — analysis of how our website is used. Contentsquare's privacy center: contentsquare.com/privacy-center

6. Data Storage and Security

Core application hosting uses Heroku; images, payment records, notifications, email and integrations are also handled by the providers described above. The location of the main database does not mean that every recipient or every processing operation is confined to the EU.

Technical security and operational logging is distinct from optional analytics and advertising. We use the data described in this notice only for the relevant purposes and restrict access according to those purposes.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

7. International Data Transfers

Some providers and their affiliates, including payment, image hosting, communications and analytics providers, may process data outside the EEA. A transfer requires an applicable adequacy decision or other lawful GDPR Chapter V mechanism, such as Standard Contractual Clauses with any necessary supplementary measures. The EU-U.S. Data Privacy Framework applies only to a recipient and processing covered by a valid certification; it is not a general exemption. Contact [email protected] for information about the recipient, destination and applicable safeguard, or a copy of the relevant safeguards. Independent controllers explain their own transfers in their notices.

8. Data Sharing

We do not sell personal data. Data is shared with the relevant establishment, authorised staff and service providers for the functions described here. Optional analytics and advertising recipients receive data only with the applicable permission. Worker public profile and tip-recipient disclosures are explained in their specific notices.

We may disclose personal data if required by law or in response to valid legal requests by public authorities.

9. Data Retention

Retention depends on the purpose, not merely on whether an establishment account remains active. Contract and account records are needed during the relationship; applicable accounting and tax records are kept for their statutory periods, and evidence needed for claims for the applicable limitation period, extended where proceedings or another legal obligation require it.

Guest data processed for an establishment is retained, returned or deleted under that controller's documented instructions and the data processing agreement, subject to statutory obligations. Closure does not mean every backup, payment-provider record or legally required record disappears immediately. No-show histories, restriction lists, reusable payment-method identifiers and security logs require purpose-specific retention and review; they must not be kept indefinitely simply because an account exists.

Business inquiries are kept for as long as needed to handle the inquiry and any resulting cooperation. Data stored in your browser is kept for the periods listed in Section 4.

Individual users may request deletion of their personal data at any time by contacting us at [email protected].

10. Your Rights Under GDPR

Where the GDPR applies, you have the following rights subject to its conditions:

Right of access — you may request confirmation of whether we process your personal data and obtain a copy of it
Right to rectification — you may request correction of inaccurate or incomplete data
Right to erasure — you may request deletion of your personal data
Right to restriction — you may request that we restrict the processing of your data
Right to data portability — you may request your data in a structured, machine-readable format
Right to object — you may object to the processing of your data
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time, including through the "Cookie settings" link on our website

To exercise any of these rights, please contact us at [email protected]. We respond without undue delay and normally within one month of receipt. Where permitted because of complexity or the number of requests, this can be extended by two further months; we explain the extension within the first month. For venue-controlled guest data, contact the venue; we assist it in responding.

You also have the right to lodge a complaint with a supervisory authority. In Poland, the relevant authority is the President of the Personal Data Protection Office (UODO): uodo.gov.pl.

10.1 Providing data and booking restrictions

Required account and transaction details are needed to provide the requested service; without them we may be unable to register an account or process a request. Optional fields and marketing choices are not required for the core service. A venue can use attendance records and configured no-show thresholds to automatically restrict online bookings. The venue's notice explains the criteria and consequences; contact it to contest an inaccurate record or request human review. A restriction is not proof of a debt or automatic authorisation to charge a card.

11. Children

Business and personal worker accounts are intended for adults. Guest-facing venue services may be subject to different eligibility rules and can receive information relating to minors, for example in a family booking. Please avoid unnecessary information about children and contact the relevant controller if such data has been submitted improperly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Updated versions will be published on this page with a revised "Last updated" date.

This notice provides information and does not seek blanket consent. Changes do not create a new lawful basis or retrospectively authorise processing. We provide any additional notice and obtain separate consent where the law requires it.

13. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at:

[email protected]