How your data is used when you book through MenuSmart
This notice applies when you book a table at a restaurant through MenuSmart and the restaurant does not link its own privacy policy on its booking page. The restaurant decides what your data is used for; MenuSmart provides the booking system and processes the data on its behalf.
- Controller
- The restaurant you book with
- Processor
- MenuSmart
- Bookings
- Deleted 30 days after the date
- Updated
- October 24, 2026
Who is responsible
The controller is the restaurant you book with. Its name and contact details appear on the booking page, next to the form.
MenuSmart is the processor: it processes your data only to provide the booking system to the restaurant, on its instructions, under a data processing agreement. MenuSmart is the trading name of Edgar Hugo Cheverier Aguilar, NIF 55644340A, Carrer de la Perdiu, 48, Urb. Can Regasol, 08415 Bigues i Riells del Fai (Barcelona), España, support@menusmart.dev.
Read the data processing agreement.
What data is used and for how long
Only the data you give when you book, and the data the booking itself produces, is processed.
| Processing | Data | Retention |
|---|---|---|
| Booking | Name, email address, phone number, party size, date, time, area and tables, language, and booking status (confirmed, reconfirmed, cancelled, attended) | Unconfirmed bookings are deleted 30 to 40 minutes after they are made; all others 30 days after the booking date |
| Booking emails | Name, email address, and booking details, to send you the confirmation request, the confirmation, a reconfirmation request 24 hours before, and cancellation notices | Sending records, 30 days; cancellation receipts, 7 days |
| Review | If the restaurant marks your visit as attended, you receive a review request by email, unless you refuse it when booking or from an earlier email, or the restaurant turned requests off. If you submit a review, your name, the rating, the comment, and the visit details are kept; your email address and phone number are removed when you submit it. If you opt out, a pseudonymous code derived from your email address and the restaurant is kept | Unanswered requests, 30 days; submitted reviews, without your name after 24 months, for as long as the restaurant’s account exists, and the restaurant can delete them; opt-outs, for as long as the restaurant exists |
Purposes and legal bases
The restaurant decides the legal basis. Usually it is the following:
- Managing your booking, sending you emails about it, and calling you if needed, for example when something changes: the booking you request (GDPR Article 6(1)(b)).
- Asking for a review after your visit: the restaurant’s legitimate interest in its guests’ feedback (GDPR Article 6(1)(f)). You can refuse it when booking, and object at any time from the link in the email, which opens the review page, or by contacting the restaurant. Please keep health details and other sensitive information out of your comment: the restaurant sees it with your name.
- Protecting the booking form against bots with Google reCAPTCHA: the legitimate interest in keeping the service secure (GDPR Article 6(1)(f)).
Who receives the data
Your booking goes to the restaurant and to the members of its team who have access to its MenuSmart account. The restaurant’s staff can also look up bookings through the dashboard AI assistant.
MenuSmart uses these sub-processors: Google Cloud and Firebase (database and functions in the European Union; App Check and reCAPTCHA also in the United States), Vercel (page hosting, in Paris and the United States), Amazon Web Services (email delivery, in Ireland), and Anthropic (the dashboard AI assistant, in the United States). Transfers outside the European Economic Area rely on the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.
Booking pages and the links in the emails load no advertising or analytics tags.
Read the list of sub-processors.
Your rights
You can access, correct, or delete your data, restrict or object to its use, and ask for a portable copy. Contact the restaurant, which decides on your request. You can cancel your booking from the link in the emails.
If you cannot reach the restaurant, write to support@menusmart.dev and we will pass your request on to it without delay.
Complaints
If you think your rights are not respected, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority of the EU country where you live.
For the processing MenuSmart does for its own purposes, read its privacy policy.