1. Introduction

Welcome to Reseffi. Reseffi SIA ("we," "our," or "us") runs the Reseffi website and restaurant reservation management platform. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our platform.

Our privacy contact is info@reseffi.com. We have not appointed a Data Protection Officer; our privacy contact handles all privacy questions.

We have two roles. For restaurant accounts and for our website, Reseffi SIA is the controller: we decide how that data is used. When a guest books a table through a restaurant's booking widget, the restaurant is the controller and we process the guest's details on its behalf. Guests should contact the restaurant about their booking data. If a guest writes to us, we will pass the request on to the restaurant.

2. Information We Collect

Personal Information

We may collect personal information that you voluntarily provide to us, including:

• Name and email address

Automatically Collected Information

When you visit our website, we may automatically collect certain information, including:

• IP address and browser information
• Device information and operating system
• Usage data, analytics, and sampled session recordings
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the information we collect for various purposes, including:

• Sending important updates about our service
• Responding to inquiries
• Improving our platform and developing new features
• Analyzing website usage patterns

Legal basis

We rely on these legal bases under the GDPR:

• Your account and our service: to perform our contract with you.
• Invoices and tax records: to meet our legal obligations.
• Security, such as protecting logins and blocking abuse: our legitimate interest in keeping the service safe.
• Website analytics: your consent, which you can withdraw at any time.
• Product analytics in the dashboard: our legitimate interest in understanding how the product is used, so we can improve it.
• Replying to messages you send us: to answer your request.

4. Information Sharing and Disclosure

We do not sell your personal information. We share it only with the service providers listed below, and only the information each one needs to do its job for us. They act on our instructions under data processing agreements. We may also disclose information when the law requires it. When a guest books through a restaurant's booking widget, we process the guest's details on the restaurant's behalf, using DigitalOcean, Cloudflare and Brevo from the list below.

• DigitalOcean (servers in Frankfurt, Germany): hosts our application and databases, so it stores all account, restaurant and booking data.
• Cloudflare: protects and speeds up our booking widget, dashboard and API. It sees IP addresses, browser details and the pages requested, to block attacks and deliver pages.
• Vercel: hosts this website. It sees visitors' IP addresses and browser details, to deliver pages.
• Brevo: sends our emails and text messages. It receives the recipient's name, email address or phone number and the message content, such as booking confirmations and account emails.
• Stripe: handles subscription payments. It receives the billing contact's name, email address, country and tax details. Card details are entered directly with Stripe; we never see them.
• PostHog (EU hosting): product and website analytics. It receives usage events, device and browser details, approximate location based on IP address and, for a random 10% of website visits, session recordings. In the dashboard, usage is linked to an account id only.
• Google Analytics 4: website analytics. It receives page views, device and browser details and approximate location based on IP address.
• Google Gemini: powers our free schema generator. It receives the public content of the website you ask the tool to check.

Messages submitted through the contact form are processed by Formspree and used only to reply to your request.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is 100% secure.

6. Data Retention

We keep personal data only as long as we need it:

• Account data: until the account is deleted.
• Restaurant data: until the account is deleted, or 12 months after the restaurant's subscription lapses.
• Invoices and billing records: 5 years, as Latvian accounting law requires.
• Guest booking data: the guest's name, email address and phone number are anonymised 90 days after their last visit. A new booking restarts this period. Booking records are kept without identity.
• Backups: kept for 7 days, then overwritten.

You may request account deletion in your account settings. We email a confirmation link that remains valid for 60 minutes; nothing is deleted unless you follow it. Once confirmed, access ends, subscriptions are cancelled, and the account, owned restaurants, reservations, guests, and settings are permanently deleted. This cannot be undone. Invoices and billing records are kept for the period above.

7. Your Rights

Depending on your location, you may have certain rights regarding your personal information, including:

• The right to access your personal information
• The right to correct inaccurate information
• The right to delete your personal information
• The right to restrict processing
• The right to data portability

Right to object

Where we rely on our legitimate interest (security and product analytics), you have the right to object at any time, on grounds relating to your particular situation. Write to info@reseffi.com. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims.

8. Cookies and Tracking Technologies

We use Google Analytics and PostHog on this website to understand how it is used and to improve the Service. These tools may use cookies and local storage and collect page views, clicks, submissions, device and browser details, IP-derived location, and technical events. PostHog also records a random 10% sample of sessions; form inputs are masked and mouse movements are not recorded. PostHog data is sent to its EU service endpoint.

Analytics cookies are only set after you accept them. You can change your choice any time: clear this site's cookies in your browser, and the choice appears again.

The dashboard uses no analytics cookies. It measures usage with PostHog without storing anything on your device.

9. International Data Transfers

Some of our service providers are based in the United States. Where a provider is certified under the EU–US Data Privacy Framework, we rely on that framework (Commission Decision (EU) 2023/1795). Otherwise, we use the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914). You can ask for a copy of these safeguards at info@reseffi.com.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If you have an account, we will notify you of material changes by email. We will also update the "Last updated" date on this page.

11. Contact Us

If you have any questions about this Privacy Policy, or want to use any of your rights, please contact our privacy contact at:

info@reseffi.com