Privacy Policy

Last updated: March 23, 2026

This policy describes how Rezervatio.AI collects, uses, stores, and protects your personal data, in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679).

1. Data Controller

2. What Data We Collect

2.1 User Data (business owners)

2.2 End Customer Data (callers)

3. Legal Basis for Processing

• Performance of a contract (Art. 6(1)(b) GDPR) — for providing services to Users
• Legitimate interest (Art. 6(1)(f) GDPR) — for service improvement and fraud prevention
• Consent (Art. 6(1)(a) GDPR) — for marketing communications (optional)
• Legal obligation (Art. 6(1)(c) GDPR) — for tax and accounting compliance

4. How We Use the Data

• Providing and improving the AI reservation service
• Essential communications related to your account and the service
• Technical support and issue resolution
• Aggregated analysis for platform improvement (without personally identifiable data)
• Legal and tax compliance

5. Data Sharing

We do not sell or rent your data. We share data only with:

All providers are GDPR compliant or have standard contractual clauses (SCCs) for international transfers.

6. Data Retention

7. Your Rights (GDPR)

You have the following rights under the GDPR:

• Right of access — you may request a copy of your data
• Right to rectification — you may correct inaccurate data
• Right to erasure ("right to be forgotten") — you may request the deletion of your data
• Right to data portability — you may receive your data in a structured format (JSON/CSV)
• Right to restriction of processing — you may limit how we process your data
• Right to object — you may object to the processing of your data in certain situations
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact: privacy@rezervatio.ai

We will respond within a maximum of 30 days of receiving your request.

8. Data Security

We implement technical and organizational measures to protect your data:

• Encryption in transit (TLS/HTTPS) on all connections
• Password encryption with modern algorithms (bcrypt)
• Role-based access (RLS — Row Level Security) at the database level
• Firewall and DDoS protection via Cloudflare
• Encrypted daily backups
• Servers located in the European Union (Hetzner, Germany)
• Two-factor authentication available

9. Security Incidents

In the event of a security breach affecting personal data, we will:

• Notify the supervisory authority (ANSPDCP) within 72 hours at most
• Inform affected individuals without undue delay
• Document the incident and the measures taken

10. Contact

Cookie Policy

Last updated: March 23, 2026

1. What Are Cookies?

Cookies are small text files stored on your device by your browser. They allow websites to retain information between visits.

2. What We Use

Rezervatio.AI uses exclusively browser local storage (localStorage), not traditional HTTP cookies. This means that:

• We do not send cookies via HTTP headers
• Data remains only on your device
• We do not use tracking or advertising cookies
• We do not use analytics services (Google Analytics, Facebook Pixel, etc.)

3. What We Store in localStorage

4. Third-Party Services

The following external services may set their own cookies:

5. How You Can Control Cookies

• Via our banner: On your first visit, you can choose "Accept" or "Essential only"
• Via your browser: You can delete localStorage from your browser settings (Developer Tools > Application > Local Storage)
• Full deactivation: You can disable JavaScript in your browser, but the site will not function correctly

6. Contact

For questions about cookies: office@rezervatio.ai

GDPR Compliance

Last updated: March 23, 2026

1. Our Commitment

Rezervatio.AI fully complies with the General Data Protection Regulation (GDPR — EU Regulation 2016/679). Protecting the personal data of our users and their end customers is a fundamental priority.

2. GDPR Roles

3. Data Processing Agreement (DPA)

By using Rezervatio.AI, the User and Rezervatio.AI implicitly enter into a Data Processing Agreement that establishes:

• The types of data processed
• The purpose and duration of processing
• The obligations of both parties
• The security measures implemented
• The incident notification procedure

For a formal customized DPA, contact: office@rezervatio.ai

4. Technical and Organizational Measures

• Servers in the European Union (Hetzner, Germany)
• End-to-end encryption (TLS 1.3) for all data transfers
• Row Level Security (RLS) — each user can only see their own data
• Passwords encrypted with bcrypt (cost factor 10+)
• Audit logging for sensitive actions
• Daily backups with 7-day retention
• Data minimization principle — we only collect what is strictly necessary
• Role-based access — employees have limited access to necessary data only

5. Data Subject Rights

End customers (persons making reservations) have the following rights:

Right of Access (Art. 15)

They may request a copy of all stored personal data. The User can export data from the dashboard or by contacting support.

Right to Erasure (Art. 17)

They may request the deletion of their data. The User can delete reservations from the dashboard or by contacting support.

Right to Data Portability (Art. 20)

They may receive their data in a structured format (JSON or CSV).

Right to Rectification (Art. 16)

They may request the correction of inaccurate data.

6. International Transfers

Data is stored predominantly in the EU. For services operating outside the EU (for example, ElevenLabs — USA), we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The EU-US Data Privacy Framework, where applicable

7. Data Protection Officer

8. Updates

This page will be updated periodically. Significant changes will be communicated by email.