Privacy notice

Last updated 12 November 2026

Who's responsible

The restaurant you're ordering from is the data controller — they decide why your data is collected. Klevra is the processor that runs the ordering software on their behalf. If you have questions about how a specific restaurant uses your data, contact them directly. The free event planner is different: there is no restaurant in between, so for a saved plan and the answers to its invitations Klevra is the controller.

What we collect

• Pickup orders: your name, phone number, optional email, the items you ordered, and (for online payments) the masked payment confirmation we receive from Stripe. We never see your full card details.
• Dine-in table tabs: the nickname you enter to join the table, the items you order, and a temporary guest ID stored in a cookie so split-bill and live order tracking work. No phone or email is requested.
• Table bookings: your name, email address, a phone number if you give one, the date, time and size of your party, and anything you write in the notes box — people often mention an allergy or a pushchair there. We email you a link, and opening it is what confirms the address is yours; a booking nobody opens within fifteen minutes is cancelled on its own and the table goes back. After that the details go to the restaurant, so they can hold the table and reach you if something changes. If the restaurant asks for a card against no-shows, the card itself is handled by our payment processor and never reaches us or them — we keep only what was agreed, when it was held, and whether it was ever charged.
• Event requests: if you ask a venue to host an event from its page, we pass the venue your name, email address, phone number if you give one, the kind of event, its date, the number of guests and your message — only once you have confirmed your address by the link we email you. The venue answers you from its own email.
• Proposals for an event: a venue can send you its offer for your event — what is included, the prices, the deposits and its terms — by an email only you receive. We keep the offer with the name and email address the venue typed for you. When you accept, we record the address that accepted and when, the venue sees that you did, and your plan is shared with that venue; when you decline, the venue is told. Deposits you pay for the event by card go to the venue through our payment provider; we record what was paid, how, and what was given back.
• Regulars: a restaurant that asks for a card against no-shows can let its regulars book without one. When you open the link that confirms your address, that address is checked once against the restaurant's own earlier bookings, at any of its venues — whether you were seated, and whether you missed a booking in the last few months. Nothing is compared between different restaurants, no score is kept, and nothing about it is shown to anyone; we only note on that booking that it did not need a card.
• Reviews: if you rate your visit after paying, we keep your rating, your comment and the name you gave at the table or at checkout, and the restaurant sees all three. If the restaurant shows reviews on its public page, your rating and comment appear there with your first name only, beside any reply from the restaurant, and search engines can index that page. You can delete your review from the screen where you left it, for as long as you can open that screen. Anyone can report a review to [email protected], and we remove reviews that break the law. A review is not tied to an account, so we cannot tell who wrote it: an email asking us to remove one as its author is handled as a report.
• Event plans: until you save it, a plan stays in your browser and never reaches us. If you save it, we keep the plan — your guests by household with the names, age bands and seats you listed, the event’s name, date, time and venue as you typed them, and your words to your guests — and the email address of each host, proven once by a link we email you; a device you sign in on keeps a cookie for it. We send your guests nothing: each household gets a link you share yourself. A guest who answers from it gives us the answer, the names and age bands of who is coming, a menu choice each where you offered one, any allergies they enter — only with their consent, given where they type them — and a note; the hosts see the answer, and the allergies also reach the venue you send the plan to. The link you send a venue shows numbers only: how many are coming and by age band, menu totals, allergies by kind, tables and seats, never a name. A venue that opens that link signed in to its own Klevra account — the venue you named, or one you approve from your plan — also sees your guests’ names and seats, and its kitchen each seat’s menu and allergies without names; you can take that access back from the plan at any time. A plan you start from a venue’s own link is shared with that venue, the same way, once you confirm your email. Anyone can report an invitation or a shared plan to [email protected], and we remove plans that break the law.
• Restaurant accounts (staff/owners): your email, password (hashed), and team role. Covered separately by the cookie policy for the dashboard session. When you sign up from klevra.co or from a link of ours, we also keep the page you arrived on, the site that sent you and any campaign tag the link carried, so we know which of our pages and messages bring restaurants to us (our legitimate interest, GDPR Article 6(1)(f)).
• Restaurants we contact: when we write to a restaurant about Klevra, we keep its business contact details (name, city, website, business email and phone), what we sent and when, and the times the link in our message was opened, with nothing about the device or the person who opened it. This rests on our legitimate interest in offering our service to businesses (GDPR Article 6(1)(f)). We delete these details within 12 months of the last contact. If you ask us not to write again, we keep only the restaurant's name, email address and website, so that we never do.

Why we can process it

We rely on contract performance (GDPR Article 6(1)(b)) — your data is needed to prepare your order or hold your table, and to contact you if something goes wrong. We don't ask for consent because the data is essential to the order or booking itself; without it we can't take it. Reviews are one exception: leaving one is optional, and showing it on the restaurant's page rests on the restaurant's legitimate interest in showing what its guests say (Article 6(1)(f)). That is why only your first name appears, and why you can delete it. The other is a restaurant letting its regulars book without a card: checking your address against its earlier bookings rests on the same legitimate interest — protecting its tables without asking guests it already knows for a card — and can only ever spare you a card that other guests are asked for. The event planner is a service you use directly: keeping your plan and your guests’ answers rests on our contract with you (Article 6(1)(b)). A guest’s allergies are health data, and we store them only with the guest’s explicit consent (Article 9(2)(a)), asked for where they are typed; a guest can change or withdraw their answer until the day you set.

How long we keep it

Order data is retained as long as required for accounting and tax (typically 5–10 years depending on local law). Your name, phone number and email on a pickup order are erased automatically 90 days after the order is collected or cancelled; the order itself stays for the accounts. At a table, the name you entered and the temporary guest ID that went with it are erased automatically 30 days after the tab is closed: the bill then shows "Guest 1", "Guest 2" in their place, and nothing on it leads back to your phone. A review keeps the first name it was left under, as described above. Booking details — name, email, phone and your notes — are erased automatically 24 months after the sitting, whatever became of the booking; what survives is the shape of it, meaning when, how many people and which table. Cancelling a booking does not delete it: the restaurant keeps it as history until that same 24 months is up. A review is kept until you delete it or we remove it after a report, and it stops being shown as soon as the restaurant switches reviews off or leaves Klevra. An account that is opened but never set up, with no venue ever added, is deleted 90 days after it was opened, after two reminder emails. A saved event plan — the plan, its hosts and every answer — is deleted automatically 90 days after the event, or 90 days after it was last edited if that is later; a plan whose first host never confirms their address within fifteen minutes is deleted then. A host can delete the plan at any time from its menu, and everything goes with it at once, including every link. An event request you do not confirm within fifteen minutes is deleted then; a confirmed one is deleted twelve months after the event’s date, or after you sent it if that is later. A venue’s proposal you never accepted is deleted twelve months after the event’s date, or after it was sent if that is later. An accepted one stays with its event and its payments, which the venue keeps as a record: 24 months after the event’s date your name, email address and the messages on it are erased, with the event’s name, and what remains is when it was, the prices and what was paid.

Who else sees it

We use a small set of sub-processors to run the service, each bound by contract to act only on our instructions. Where a provider is described as EU below, that data is processed inside the EU. Where a provider is outside it, the transfer relies on the European Commission's standard contractual clauses. Specific provider names are available on request.

• EU cloud database provider — stores your order securely.
• EU cloud object storage provider — holds menu images uploaded by the restaurant. No customer personal data is stored here.
• Payment processor — handles online checkout. They see your card details directly; we only receive a confirmation and the masked summary.
• EU real-time messaging service — powers live order updates.
• Email delivery service — sends the messages the service has to send you: an order or booking confirmation, the link for changing a booking, and the reminder before your table. It handles the address we send to and what that message says, which for a booking includes your name and any note you left. Mail is dispatched from within the EU (Ireland), but this provider stores the message content and its delivery records in the United States under the safeguards described above.
• AI text-processing service — used by the restaurant to translate or extract menu copy. Never receives customer order data.
• EU error-monitoring service — receives automatic technical reports when something in the app breaks (the error, the page address, and the browser/device type). Sign-in details are redacted before reports leave your device; no names, order contents, or payment data are included. Reports are deleted automatically after 90 days.

Your rights

Under GDPR you can:

• Ask the restaurant for a copy of the personal data they hold about you.
• Correct anything that's wrong (typo in your name, wrong phone number).
• Ask the restaurant to delete your data, subject to accounting retention obligations.
• Receive your data in a structured, machine-readable format.
• Complain to your national data-protection authority if you think your rights have been breached.

Updates

We'll update this page if how we process data changes. The date at the top reflects the most recent change.

Contact

For privacy questions about Klevra as a processor, email [email protected]. For questions about a specific order, contact the restaurant directly. For a saved event plan or an invitation, write to the same address: Klevra holds those, not a restaurant.