Privacy Policy

1. Who we are

Prenotando is an online booking and guest management platform for restaurants and bars, available at prenotando.app. It is operated by Giuseppe Maurizio Facchi, VAT IT04714910165, Via Nicolò Paganini 3, 24040 Boltiere (BG), Italy, who is the data controller. Contact: support@prenotando.app.

2. Data we collect

• Account data: name, email address, mobile phone number, password (stored only as a hash) and, if you use Sign in with Google, the data described in section 10.
• Restaurant data: business name, address, opening hours, tables, events, message templates and settings entered by the restaurant.
• Booking and guest data entered by guests or staff: name, phone number, email, number of people, date and time, notes and allergies, marketing consent.
• Billing data: plan, invoices and payment status. Card details are handled by Stripe and never stored by Prenotando.
• Technical data: IP address, device and browser information, logs and an activity log of actions performed in the app.

3. How we use data

• to provide the service: create accounts, sign users in, manage bookings and send booking confirmations and reminders;
• to verify the manager’s phone number with a code and send service alerts from Prenotando’s WhatsApp number and, if the manager turns them on in Notifications, alerts about the restaurant’s bookings, which they can confirm or decline by replying (never advertising; they can be turned off at any time);
• to manage subscriptions, invoices and support;
• to keep the service secure, prevent abuse and fix problems;
• to comply with tax and legal obligations;
• to send promotional messages on behalf of a restaurant only to guests who gave explicit consent, always with an unsubscribe link.

Legal bases (GDPR art. 6): performance of a contract, legal obligations, legitimate interest in security, and consent for marketing.

4. Restaurants and their guests

When a restaurant uses Prenotando to manage its guests’ data, the restaurant is the data controller and Prenotando acts as its data processor. Guests who want to exercise their rights about a booking should contact the restaurant first; we will help the restaurant answer.

A guest can also book through an AI assistant (ChatGPT, Claude…) using the Prenotando connector: the assistant sends us only the details the guest gave it for that booking (name, phone, optional email and notes), which we process for the restaurant like a booking made on its page. No marketing consent is ever collected through an assistant. See prenotando.app/assistenti-ai.

5. Service providers

We share data only with providers needed to run the service, under data processing agreements, and only the data each one needs:

• Cloudflare: hosting, database, file storage, network and security;
• Stripe: payments and billing;
• Resend: email delivery;
• WhatsApp (Meta): messages sent from the restaurant’s number, when connected, and from Prenotando’s number for service and booking alerts to managers;
• Hetzner Online (Germany): the server that connects WhatsApp numbers;
• Google: Sign in with Google; SocialAPI: optional connection of a restaurant’s Google Business Profile;
• DeepSeek: the optional AI assistant, only when a user uses it;
• Composio and the email marketing or CRM tools a restaurant chooses to connect.

We do not sell personal data.

6. International transfers

Some providers may process data outside the European Economic Area. In that case we rely on the safeguards of GDPR arts. 44-49, such as the EU-US Data Privacy Framework or Standard Contractual Clauses. DeepSeek is based in China; data is sent to it only when a user chooses to use the AI assistant.

7. Retention and security

• account and restaurant data: for as long as the account exists; deleted immediately when you delete the account or the restaurant, and removed from backups within 30 days;
• billing data: 10 years, as required by Italian law;
• proof of acceptance of the Terms: 10 years;
• activity log: 12 months in the app, then archived for 12 more months and deleted;
• WhatsApp alerts sent to staff from Prenotando’s number: 6 months; conversations with the AI assistant: 12 months after last use;
• support emails: 24 months after the last message;
• phone verification codes: a few minutes; server logs: a few days.

We use role-based access control, encryption in transit and at rest, activity logging and backups. No system is completely secure, but we work to protect your data.

8. Your rights

You can ask for access, correction, deletion, restriction, portability or object to processing, and withdraw consent at any time. You can download your data or delete your account yourself in the app (Il mio account), or write to support@prenotando.app; we reply within 30 days. You can also complain to the Italian data protection authority (Garante per la protezione dei dati personali).

9. Cookies

We use only technical cookies needed to sign in and run the service. We do not use advertising or tracking cookies.

10. Google user data

This section explains how Prenotando (prenotando.app, operated by Giuseppe Maurizio Facchi, VAT IT04714910165, Via Nicolò Paganini 3, 24040 Boltiere (BG), Italy) accesses, uses, stores, shares, protects, retains and deletes data received from Google. It applies to the Google OAuth client used by Prenotando for “Sign in with Google”.

Data we access

When you choose “Continua con Google” (Sign in with Google), Google shares with us, after your consent, only the data covered by the scopes openid, email and profile: your Google account ID, name, email address, whether the email is verified, and profile picture URL. We do not receive your Google password and we do not request access to Gmail, Drive, Calendar, Contacts or any other Google data.

How we use it

• to create your Prenotando account, or link Google to an existing account with the same verified email;
• to sign you in securely;
• to show your name and picture inside the app (for example in the account menu and in the team list of your restaurant).

We do not use Google user data for advertising, marketing, profiling, credit or lending decisions, and we do not use it to develop, improve or train generalised AI or machine-learning models. No human reads it except when you ask for support, for security purposes, or to comply with the law.

Sharing

We do not sell Google user data and we do not share it with third parties, except with the infrastructure provider that hosts the service on our behalf (Cloudflare, for hosting and database), under a data processing agreement, or when required by law. The other providers listed in this policy do not receive Google user data.

Storage and protection

The data is stored in our database on Cloudflare. It is encrypted in transit (HTTPS/TLS) and at rest, access is restricted to the operator and protected by authentication, and OAuth tokens are never exposed to the browser or to other users.

Retention and deletion

We keep this data only while your account exists. You can delete your account at any time in the app (Il mio account → Elimina account): your Google data is deleted immediately and removed from backups within 30 days. You can also revoke Prenotando’s access at any time from myaccount.google.com/permissions, or ask us to delete your data by writing to support@prenotando.app; we reply within 30 days.

Google Business Profile

A restaurant can optionally connect its Google Business Profile. Today this connection is handled by the integration provider SocialAPI with its own authorisation, not through Prenotando’s Google OAuth client: we receive from SocialAPI only the profile data needed to show it in the app (business details, hours, photos, posts, reviews, insights) and to perform the actions the restaurant asks for or approves. This data follows the same rules described above: it is never sold, never used for advertising or AI training, and it is deleted when the restaurant disconnects the profile or deletes its account.

Limited Use

Prenotando’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Contact

Questions about this policy or your Google data: support@prenotando.app.

11. Changes

We may update this policy. The current version and its date are always published on this page.