Privacy Policy

De La Table acts in two capacities depending on the data involved.

For restaurant owner account data (name, email, authentication credentials, billing information), De La Table is the data controller. For guest personal data (names, emails, phone numbers, booking history, preferences, notes) entered by restaurants or their guests through the platform, each restaurant is the data controller and De La Table is the data processor acting on the restaurant’s instructions.

Guest data (managed by restaurants)

When a guest makes a reservation or is added by a restaurant, the following data may be stored:

• —First name, last name
• —Email address (hashed for privacy-preserving lookups)
• —Phone number (hashed for privacy-preserving lookups)
• —Booking history: dates, party sizes, statuses, special requests
• —Guest profile: dietary restrictions, allergies, preferences, VIP status, internal notes
• —Payment data: Stripe customer ID for deposits and no-show charges (card details are stored by Stripe, not by De La Table)
• —Marketing preferences: email opt-in, unsubscribe records

Restaurant owner data

When a restaurant owner creates an account, we collect:

• —Name, email address, phone number
• —Authentication data (hashed password)
• —Billing information: Stripe customer ID, payment method, subscription details

We process personal data to: provide the reservation and restaurant management platform; send transactional communications (booking confirmations, reminders, follow-ups); process payments via Stripe (guest deposits and restaurant subscriptions); send marketing communications to guests who have opted in (with one-click unsubscribe via RFC 8058 compliant links); maintain guest marketing profiles for restaurants; generate analytics and reports; detect fraud and enforce security; comply with legal obligations. We do not sell personal data.

We share personal data only with service providers who need it to deliver our platform. Each processor handles only the minimum data required for its function.

Payment Processors

Guest payments (deposits, no-show charges) and restaurant subscription billing are processed by Stripe (US).

Email (Resend)

We use Resend (US) to send transactional emails (booking confirmations, reminders). Resend receives only the recipient's email address and the message content.

Hosting & Database

The platform is hosted by Hetzner Online GmbH in Germany (Falkenstein), and its database by Neon, Inc. on Amazon Web Services in Germany (Frankfurt). They process the platform's data and technical data such as IP addresses and server logs.

A complete list of sub-processors is available upon request.

De La Table uses only essential cookies and storage required for the platform to function: a session cookie set by NextAuth.js for authentication (strictly necessary). We use no analytics, no session recording and no cross-site tracking. We do not use advertising cookies, tracking pixels, or third-party marketing scripts. If we ever add such trackers, a consent banner will be introduced before they activate.

Restaurant owner data is retained for the duration of the account and deleted upon account closure or request. Guest data retention is configurable per restaurant, with a default of 365 days. Restaurants can configure anonymization of guest data after 730 days. Payment audit logs are retained as required for PCI-DSS compliance and legal accounting obligations. Email logs and webhook records are retained for operational debugging and compliance.

We implement appropriate technical and organizational measures to protect personal data. These include: hashed storage of email addresses and phone numbers (HMAC-SHA256); encrypted sensitive fields (dietary restrictions, allergies); immutable payment audit logs with actor tracking; rate limiting on API endpoints and webhooks; HTTPS for all data in transit. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

NICKLAS SARL is established in France, so the General Data Protection Regulation applies to our processing wherever you are. You have the following rights:

• —Right of access
• —Right to rectification
• —Right to erasure
• —Right to restrict processing
• —Right to data portability
• —Right to object

To exercise any of these rights, contact us at auguste@delatable.com

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or with the data protection authority where you live.

The platform is hosted in Germany (Falkenstein) by Hetzner Online GmbH and its database in Germany (Frankfurt) by Neon, Inc. on Amazon Web Services. Payments are processed by Stripe (US). Transfers of personal data to providers outside the European Union are covered by Standard Contractual Clauses approved by the European Commission or by the EU–US Data Privacy Framework.

We may update this Privacy Policy. Changes will be posted on this page with an updated effective date. For material changes, we will notify registered users by email.