Privacy Policy

Reservato is a restaurant reservation service. This policy explains what personal information the Reservato mobile app and website collect, why we collect it, who we share it with, and the choices you have. It is written to describe what our software actually does.

1. Who we are

Reservato.ai ("Reservato", "we", "us") operates the Reservato app for diners and the Reservato partner portal for restaurants. We are the controller of the personal data described in this policy.

2. Information we collect

2.1 Information you give us

• Account details: your name, email address and mobile phone number. Phone numbers are verified with a one-time passcode sent by SMS.
• Profile details: first and last name, and an optional profile photo you choose from your device's photo library or camera.
• Reservation details: the restaurant, date, time, party size, and any note or special request you add to a booking.
• Reviews: your rating, written review text, and your response to the "how was the food" prompt, for restaurants where you had a booking.
• Support messages: the subject, category and message text of any support request you send us.

2.2 Information collected automatically

• Device and app information: your device platform (iOS or Android) and the app version, used to deliver push notifications and app updates to the right devices.
• Push notification token: an identifier issued by Apple or Google for your device, stored against your account so we can send you booking notifications. It is removed when you sign out or disable notifications.
• Server logs: our servers record standard request information, including IP address and timestamps, for security, rate limiting and abuse prevention.
• Payment records: the amount, currency and status of a booking payment, and the payment reference issued by our payment processor.

The Reservato app contains no third-party analytics, tracking or advertising software. We do not build advertising profiles and we do not track you across other apps or websites.

2.3 Information from third parties

• Google or Apple sign-in: if you sign in with Google or Apple, we receive your name and email address from that provider. We never receive your password.
• Payment processor: we receive confirmation of whether a payment succeeded, together with a customer reference. We never receive or store your full card number. Card details are entered into, and held by, our payment processor.
• Restaurants: the restaurant you booked with tells us whether you arrived and were seated. This is what allows a review to be marked as verified.

3. Location

If you grant location permission, the app reads your device's location while you are using the app only. We never access your location in the background.

Your location is used to show restaurants near you and to display your current area in the app. The coordinates are converted into a place name on your device. If you save a location to your profile, the coordinates and their accuracy are stored on our servers as part of your profile so we do not have to ask again.

You can refuse location permission and keep using the app; you will simply need to choose an area yourself. You can withdraw the permission at any time in your device settings.

4. How we use your information

We do not use your personal information to make automated decisions that produce legal effects for you.

5. What other people can see

• Your reviews are public. A review you publish is shown with your display name and your profile photo, to anyone using Reservato. Your email address, phone number and location are never shown.
• The restaurant you book with receives your name, the details of the reservation, and any note you added, so they can hold your table.
• Your profile photo is stored on a public web address so it can be displayed in the app. Anyone who has that address can view the image. Do not upload a photo you would not want seen.

6. Who we share information with

We do not sell your personal information and we do not share it with advertising networks. We share it only with the service providers that make the app work:

We may also disclose information where we are legally required to, or to establish or defend legal claims.

7. Where your information is stored

Our servers and file storage are hosted in the United States. If you use Reservato from Sri Lanka or elsewhere, your personal information is transferred to and stored in the United States, which may have different data protection rules from your own country. We rely on our providers' contractual data protection commitments for these transfers.

8. How long we keep it

• Account and profile information: for as long as your account exists, and deleted when you delete your account.
• Bookings and payment records: retained after account deletion, with your identity detached from them, because restaurants and we need a record of past reservations and payments for accounting and dispute purposes.
• Reviews: remain published unless you ask us to remove them, or you delete your account and request their removal.
• Push tokens: deleted when you sign out, disable notifications, or delete your account.
• Server logs: kept for a limited period for security purposes.

9. Your choices

• Location: grant or withdraw at any time in your device settings.
• Notifications: turn push notifications off in your device settings; you will still receive essential booking emails and SMS.
• Profile photo: you can change or remove it at any time from Edit Profile.
• Access and correction: you can view and edit your name, email, phone and profile details in the app, or ask us for a copy of your data.
• Objection and restriction: you can ask us to stop or limit a particular use of your information.

To exercise any of these, email info@reservato.ai. We will respond within 30 days.

10. Deleting your account

You can ask us to delete your Reservato account and the personal information held with it at any time.

• By email: write to info@reservato.ai from the email address on your account, or include the mobile number on your account, and ask for deletion.
• Online: submit a request at https://reservato.ai/delete-account.

When your account is deleted we remove your name, email address, phone number, profile details, saved restaurants, notifications and push tokens. Past bookings and payment records are kept as described in section 8, with your identity detached from them. Published reviews are removed on request.

11. Security

Traffic between the app and our servers is encrypted in transit. Your sign-in credential is held in your device's secure storage (the iOS Keychain or the Android Keystore), not in ordinary app storage. One-time passcode requests and verification attempts are rate limited to prevent guessing and to stop your number being flooded with codes. No system is perfectly secure, but we work to protect your information and will notify you as required by law if a breach affects it.

12. Children

Reservato is not directed at children. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We will update this policy when our practices change. The effective date at the top tells you when the current version took effect. If a change is significant, we will tell you in the app or by email before it takes effect.

14. Contact us

Questions, requests or complaints about this policy or your personal information: