Privacy Policy

The controller of your personal data is Melvyn Mollard-Grech, sole trader operating the service under the trade name RestoAll (“RestoAll”, “we”), located at 19 Les Balcons de la Save, 31530 Montaigut-sur-Save, France.

Contact: support@plate.center

• Identity and account: email address, display name, password (hashed, never stored in plain text), language.
• Where your sign-up came from: when you create your account on the website, the page you arrived on, the page from which you opened the sign-up form, the domain name of the site you came from (never the full address) and, if any, a campaign name. This is recorded without any cookie or storage on your device, and is used only to know which pages of the site are useful.
• Establishment: name, address, phone number, opening hours, social links, Google review link, location (if you set it), logo, cover photo.
• Menu: dishes, prices, descriptions, photos, categories, allergens, options, and, if you use stock tracking, your items, movements, purchase orders and suppliers (business name, e-mail and phone).
• Table reservations: your shifts, rooms, tables, offers, form fields, memos and saved replies; the data of your guests who book is described in section 3.
• Team: if you give a member of your team access, their first name, role and last sign-in date. Their phone gets a technical account, with no real e-mail address or password to remember, which disappears when you remove the access or delete your account.
• Subscription and payments: Stripe, Apple or Google customer and subscription identifiers (the App Store and Google Play for a subscription bought in the app). RestoAll never sees or stores a card number.
• QR kit delivery: postal address, format and quantity.
• Mobile app: notification token (to alert you of a new order or reservation).
• Point of sale: if you connect HubRise, an encrypted access token (AES-256-GCM), unreadable without a key kept outside the database.

When a guest uses a restaurant's menu, the data they leave is collected on behalf of that restaurant, which is the controller. RestoAll acts as a processor within the meaning of Article 28 of the GDPR: we only use this data to run the restaurant's service, we never sell it and never use it for advertising.

• Loyalty programme (if the guest joins): phone number, optional first name, optional birthday (day and month, never the year), number of visits and rewards earned.
• Table or takeaway ordering: order contents, the notes written on a dish (“no onions”, an allergy), table number, first name and phone number for pickup, and the e-mail address given when paying for a takeaway order, for the confirmation and the “your order is ready” message. Payment is processed by Stripe; RestoAll never sees the card.
• Table reservation: title, first name, last name, e-mail address, phone number, language, party size, date and time, the comment left (preferences, dietary restrictions), the answers to the questions the restaurant asks on its form, and whether the box for its offers was ticked. The restaurant may complete its guest's record in its book: company, date of birth, floor notes. This data is used to carry out the reservation (confirmation, change, cancellation, table assignment), to send a reminder and a confirmation request, to offer a table that frees up to the waiting list, and to ask for a review the day after the visit; the legal basis is the contract between the guest and the restaurant. If the guest ticks the offers box, that choice is noted on their record and the restaurant knows it may write to them; they can change their mind by telling the restaurant or by writing to us. RestoAll sends no commercial message of its own. When the restaurant asks for a card guarantee or a deposit, payment takes place at Stripe, on the restaurant's account: Stripe records the guest there with their e-mail address; RestoAll keeps only the amount, the payment status and Stripe references, never the card number.
• Private feedback: the message a guest chooses to send to the restaurant and, if they wish, an e-mail address to receive the restaurant's reply. An e-mail asks them to confirm that address: until they do, the restaurant doesn't see it, and an unconfirmed address is deleted after 7 days. Nothing is published; the address is used for that reply only and is deleted with the message. After a reservation, the review left from the next-day e-mail (rating out of five, comment) goes to the restaurant's book.
• Anonymous statistics: when the menu was opened and which dishes were viewed, with no identifying data. On the demonstration menus we prepare for restaurants we approach, a random identifier is stored in the browser to count distinct visitors; it carries no information about the person.
• On the guest's device: the chosen language and, so they don't have to type it again, their loyalty number (deleted automatically after 12 months without a visit).

No location is requested: a visit is counted when the guest opens the menu from their table's QR code during service hours, or when they pay for an order with RestoAll and enter their loyalty number.

To exercise your rights (access, rectification, erasure…), contact the restaurant: it can delete your loyalty record from its account in one step, and correct your reservation record in its book. You can also write to us at support@plate.center, naming the restaurant and your number or e-mail address: we will forward and carry out the request.

These periods are enforced automatically, every night, by the service itself:

• Restaurant owner account: as long as the account exists. When it is deleted, everything is erased immediately (menu, photos, loyalty and reservation guests, team, suppliers, stock, point-of-sale access, revoked at HubRise), except accounting records of paid sales (amounts, dates), kept without any personal data.
• Accounting records (paid orders, transaction log, reservation deposits paid or charged): at least 10 years, the length of the accounting obligation, without phone number, first name or e-mail address. No automatic purge touches them.
• Phone number, first name, e-mail address and notes left on an order: deleted after 12 months.
• Reservation: 36 months after the reservation date, name, contact details, comment, notes and answers are erased and the reservation is detached from the guest's record; messages exchanged, history, the review left after the visit and book notifications of the same age are deleted.
• Reservation guest record: deleted after 3 years without any reservation, or at any time at the guest's request to the restaurant.
• Loyalty guest: deleted after 3 years without any visit, or at any time on request.
• Private feedback: 24 months.
• Statistics (menu opens, dishes viewed, visits): rolling 24 months.
• IP addresses used against abuse: 7 days.
• Unpaid carts: 7 days.
• Photos: deleted with the dish or the account.
• Restaurants we approach without them knowing us (prospecting, described in full in the French version): the preview prepared for a restaurant that did not reply is deleted after 90 days; its contact details and the messages sent after 12 months without reply or interest. A request not to be contacted again is kept indefinitely.

Your data may be shared with the following sub-processors, in strict compliance with the GDPR:

• Supabase Inc. — database, authentication and photo storage (servers in Europe, Stockholm)
• Vercel Inc. — web app hosting, server processing in Europe (Stockholm), cookieless audience measurement
• Stripe Payments Europe, Ltd — payment processing (Ireland, PCI DSS Level 1 certified); for a reservation guarantee or deposit, on the restaurant's Stripe account, with the guest's e-mail address
• Resend — transactional emails (United States)
• Photoroom — background removal for dish photos (French company, servers in the United States)
• Crisp — support chat on the website and dashboard (France)
• Sentry — technical error monitoring (servers in Germany)
• Expo — delivery of mobile app notifications (United States)
• Apple and Google — sign in with an Apple or Google account, app distribution; Apple for subscriptions purchased in the iOS app
• RevenueCat — management of subscriptions purchased in the iOS app (United States)
• Anthropic — at the restaurant's request: drafting a dish description from its name and category, translating dish names and descriptions, reading a photographed or PDF menu to import it, and suggesting a reply to a review from the rating and the review text only, never the guest's name or contact details (United States)
• Google Maps Platform — looking up a restaurant's public listing and rating, at its request when it creates its account, then re-reading its rating every week as long as the link to its listing is in place
• HubRise — only if you connect your point of sale: sending orders to it

We never sell your data to third parties for advertising purposes.

Your data is hosted and processed in Europe. Some sub-processors are, however, based in the United States (Resend, Expo, RevenueCat, Anthropic, Apple, Google, and the parent companies of Supabase and Vercel). These transfers are governed by Standard Contractual Clauses approved by the European Commission, ensuring a level of protection equivalent to that required by the GDPR.

Under the GDPR (Articles 15 to 22), you have the following rights:

• Right of access: obtain a copy of your personal data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion of your data (“right to be forgotten”).
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Right to restriction: temporarily suspend processing.
• Right to withdraw consent: at any time, free of charge.

To exercise these rights, contact us at support@plate.center. We will reply within 30 days at most.

You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the supervisory authority of your country.

From your account, without writing to us: export all your data in a machine-readable file (Account → Export my data) and delete your account (Account → Delete my account), on the web and in the app. Deletion is immediate; only accounting records of paid sales are kept, without any personal data.

Restaurant guests: see section 3 — the restaurant can delete your record itself.

• TLS encryption in transit (HTTPS everywhere)
• Encryption at rest via Supabase (AES-256)
• Row-Level Security (RLS): each restaurant owner only accesses their own data
• JWT authentication with token expiry and rotation
• Hashed passwords (bcrypt) — never stored in plain text
• APIs protected by mandatory authentication, request origin checks and rate limiting
• Point-of-sale tokens encrypted (AES-256-GCM) with a key kept outside the database
• Append-only transaction log, chained by hash: a recorded sale can be neither modified nor deleted
• Full security and compliance audit carried out on September 26, 2026

RestoAll only uses what the service needs. No advertising cookies, no social media trackers.

• Session (sb-…-auth-token): keeps you signed in to your account. Until you sign out.
• Preferences (plate_theme, NEXT_LOCALE): light or dark theme, website language. 1 year.
• Digital menu, on the guest's device: chosen language; loyalty number so it doesn't have to be typed again (deleted after 12 months without a visit).
• Demonstration menus: a random identifier (plate_demo_visitor_id) in the browser, to count distinct visitors of a preview. No data about the person.
• Error monitoring (Sentry): a script loaded on the website and menu pages reports technical errors, with no cookie or identifier; e-mail addresses, phone numbers and tokens are masked before sending.
• Support (Crisp): nothing is loaded until you open the help bubble. If you open it, Crisp sets a cookie to keep your conversation — the service you just asked for.
• Payment (Stripe): only on the Stripe payment page, for transaction security and fraud prevention.
• Audience measurement (Vercel Web Analytics, marketing pages only): no cookie and no persistent identifier.

All of these are exempt from consent, so no cookie banner is needed.

We may update this policy to reflect changes in our practices or in applicable regulations. For any material change, we will inform you by email at least 30 days before it takes effect. The date of the last update is shown at the top of this page.