Privacy Policy

Service ("we", "us", "our") operates the Service mobile application and web platform (the "Platform"), a restaurant reservation management solution. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Platform.

1. Data Controller

The data controller responsible for your personal information is:

Service (SAS)
136 Chemin du Vallon de l'Oriol, 13007 Marseille, France
Email: support@useservice.app

2. Information We Collect

2.1 Restaurant Staff Information

When a restaurant subscribes to our Platform, we collect information about authorized staff members:

• Full name
• Email address
• Role and permissions within the restaurant

2.2 Restaurant Information

We collect business information provided by restaurant operators:

• Restaurant name and address
• Opening hours and service schedules
• Floor plan and table configurations
• Booking rules and policies

2.3 Guest Information

When guests make reservations through the Platform, the following data is collected:

• Full name
• Email address
• Phone number
• Reservation details (date, time, party size, special requests)
• Reservation history

2.4 Technical Information

We automatically collect certain technical data to operate the Platform:

• Device type and operating system version
• Push notification tokens (to deliver reservation notifications)
• Authentication tokens (stored securely in your device's keychain)

2.5 Caller Information (Missed Calls service)

When a restaurant uses the Missed Calls service and you call it without getting an answer, the data described in Section 11 is processed: your phone number, the time of the call, the line type, the messages you exchange with the restaurant and, where applicable, your WhatsApp profile name, the name, email and details you give, and the resulting reservation.

2.6 Visitors to useservice.app

When you browse useservice.app, we collect the pages you view, your clicks, a recording of your visit in which form fields are masked, where your visit came from and, when you are a professional we contacted or who wrote to us, a link between your visits and your establishment or your email address. Details are in Section 13.2.

3. Roles in Data Processing

3.1 Guest Reservation Data

For the processing of guest personal data (names, contact details, reservation details, dietary preferences), including callers' data processed by the Missed Calls service (Section 11),the restaurant is the data controller andService is the data processor within the meaning of Article 28 of the GDPR. This means:

• The restaurant determines the purposes and means of processing guest data
• Service processes guest data solely on behalf of the restaurant and under the restaurant's instructions

The relationship between Service and the restaurant is governed by ourData Processing Addendum, which details sub-processors, security measures, breach notification procedures, and data subject rights assistance.

If you are a guest and wish to exercise your data rights (access, rectification, erasure, etc.), please contact the restaurant where you made your reservation. You may also contact us at support@useservice.app and we will forward your request to the relevant restaurant.

3.2 Restaurant Staff and Account Data

For the processing of restaurant staff personal data, Service is the data controller. We process this data to provide and operate the Platform under the terms of our subscription agreement.

3.3 Website Visitor Data

For the processing of data about visitors to useservice.app, Service is the data controller. We measure this site's audience and follow up on our sales outreach with PostHog, which sets cookies (Section 13.2). It is loaded on useservice.app only: the back office, the app, the booking widget and pages, and restaurants' websites do not use it.

4. Legal Basis for Processing

We process personal data on the following legal bases under Article 6 of the GDPR:

5. How We Use Your Information

We use the collected information to:

• Provide and operate the reservation management service
• Send push notifications about reservations
• Follow up, by WhatsApp or text message, on a call that went unanswered, when the restaurant has turned on the Missed Calls service (Section 11)
• Authenticate users and maintain session security
• Communicate service updates and important notices
• Improve and maintain the Platform

We do not use Platform data for profiling, automated decision-making, or targeted advertising. On useservice.app, we link a professional's visits to their establishment or email address to follow up on our sales outreach (Section 13.2); no automated decision is made from it and it is not used for targeted advertising.

6. Data Sharing

We do not sell your personal information to third parties.

We may share information only in the following circumstances:

• Between restaurant and guest: Guest contact details and reservation information are shared with the restaurant where the reservation was made
• Service providers: We use third-party infrastructure providers to host and operate the Platform and, for the Missed Calls service, a telephony and messaging carrier, WhatsApp and a language model provider (Section 11). These providers process data on our behalf under data processing agreements; their list is published atuseservice.app/en/legal/sub-processors. For useservice.app, we use PostHog (audience measurement and sales follow-up) and Slack (notifying the team of each contact form message), described in Section 13.2
• Legal requirements: We may disclose information if required by law, regulation, or legal process

Any request from a public authority for personal data is handled under a written procedure: its legality and the authority's competence are reviewed before any answer, unlawful or excessive requests are challenged, only the data strictly necessary is disclosed, and each request and its outcome are recorded. The restaurant concerned is informed, unless the law prohibits it.

7. Data Storage and Security

• Authentication credentials are stored using industry-standard encryption (bcrypt)
• On mobile devices, sensitive tokens are stored in the iOS Keychain via secure storage
• We use HTTPS/TLS for all data transmission
• Access to personal data is restricted to authorized personnel
• Our databases are hosted within the European Union

In the event of a personal data breach likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay, in accordance with Articles 33 and 34 of the GDPR.

8. Your Rights Under the GDPR

Under the General Data Protection Regulation, you have the following rights:

• Right of access (Art. 15) — Obtain confirmation that we process your data and request a copy
• Right to rectification (Art. 16) — Correct inaccurate or incomplete data
• Right to erasure (Art. 17) — Request deletion of your data when it is no longer necessary
• Right to restriction (Art. 18) — Request that we limit processing of your data in certain circumstances
• Right to data portability (Art. 20) — Receive your data in a structured, commonly used, machine-readable format
• Right to object (Art. 21) — Object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)) — Withdraw consent at any time

To exercise any of these rights, contact us atsupport@useservice.app. We will respond withinone month of receiving your request.

If you believe your rights have not been respected, you have the right to lodge a complaint with your local supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL):www.cnil.fr.

9. Data Retention

10. International Data Transfers

Our databases are hosted within the European Union. Some sub-processors process data outside the EU/EEA, in particular in the United States: delivering push notifications and, for the Missed Calls service, routing calls and messages (Twilio, WhatsApp) and the assistant's reading of messages (Anthropic). These transfers are covered by appropriate safeguards, listed for each provider on our sub-processors page:

• European Commission adequacy decisions (Art. 45 GDPR)
• Standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR)

For useservice.app, PostHog's data is hosted in the European Union (Frankfurt, Germany); PostHog Inc., a US company, may access it from the United States under its data processing agreement, which incorporates the standard contractual clauses. Contact form messages are stored in our database, within the European Union; the notification that alerts our team goes through Slack (Slack Technologies), which may process it in the United States on the same terms.

11. Missed Calls Service (calls, WhatsApp and SMS)

11.1 How It Works

The Missed Calls service is an option each restaurant turns on itself. When a call to the restaurant goes unanswered, it is forwarded to a number held by Service with its carrier (Twilio). The caller hears a short spoken message, then receives a WhatsApp message or, failing that, a text message (SMS), at most once in any 24-hour period. The caller can then book, change or cancel a reservation in writing, within the restaurant's availability and booking rules. No message is sent to a hidden number or to a landline.

An automated assistant reads the caller's messages to extract what matters (date, time, party size, name, special requests). The assistant never writes free text to the caller: replies are pre-written message templates, filled in with the restaurant's real availability, and the assistant cannot create a time slot or any information the restaurant has not entered. Restaurant staff see the conversation and can take over at any time to reply themselves.

11.2 Data Processed

• The caller's phone number, and the date and time of the call
• The line type (mobile, landline or VoIP), checked with the carrier to know whether a message can be received
• The content of the messages exchanged, and the assistant's reading of them (the details extracted)
• The caller's WhatsApp profile name, when they write on WhatsApp
• Information the caller chooses to give: name, email address, details about their visit (for example an allergy)
• The resulting reservation, and the delivery status of messages

11.3 Roles

For this data, the restaurant is the data controller and Service is its data processor (Article 28 of the GDPR), under Article 13 of our terms of sale and ourData Processing Addendum. To exercise your rights, contact the restaurant you called, or write to us atsupport@useservice.app and we will forward your request.

11.4 The Automated Assistant

The assistant relies on a language model (Claude) provided by Anthropic, called through its API. Only the conversation's messages and what is needed to read them are sent to it. Anthropic's commercial terms prohibit it from using data sent through its API to train its models. This processing may take place outside the European Union (Section 10).

The assistant makes no decision on the caller's behalf: it interprets their request, which is then handled under the same rules as a booking made on the restaurant's widget. The caller receives the actual date and time of their reservation, and the restaurant can correct any reservation from its back office.

11.5 No Commercial Use

Messages are sent only to follow up on the caller's own call to the restaurant. They are not used for prospecting, advertising or profiling. The data is not sold, rented or shared with other restaurants, and is not used to train artificial intelligence models.

11.6 Stopping Messages

The caller can ask at any time to stop receiving messages by replying "STOP", or through the unsubscribe link included in text messages. The request takes effect immediately for that restaurant: a later missed call no longer triggers any message. It is kept so that it keeps applying, and only the caller can lift it, by asking the restaurant. If the caller writes to the restaurant again, they may receive a reply, as well as the confirmation of a reservation they make.

11.7 Retention and Erasure

Conversations, including the assistant's reading of the messages, are kept 24 months after the last message, then deleted. A caller's data is erased at their request. A "STOP" request is kept so that it keeps applying (Section 9). A reservation that results from a conversation follows the retention period of reservation data.

11.8 Recipients

Besides the restaurant concerned, this data is processed by the following sub-processors on our behalf: Twilio (routing of calls, text messages and WhatsApp messages), Meta / WhatsApp (WhatsApp messaging) and Anthropic (the assistant's reading of messages). Their locations and the safeguards for transfers are listed on our sub-processors page.

12. Push Notifications

We send push notifications related to reservation activity. You can disable notifications at any time through your device's Settings app.

13. Cookies and Tracking

13.1 The Platform

The Platform (mobile app, back office, booking widget and pages) does not use advertising trackers, analytics cookies, or cross-app tracking technologies. We do not track your activity across other apps or websites.

13.2 The useservice.app website (PostHog)

useservice.app uses PostHog, an audience measurement tool published by PostHog Inc. The data is hosted in the European Union (Frankfurt, Germany). PostHog is loaded on this site only.

What is collected:

• The pages you view, the page you landed on and the site you came from
• Clicks and interactions with the pages
• Session recordings: a replay of your visit (scrolling, clicks, pages shown). Form fields are masked in them: what you type is not recorded.
• Where the visit came from: campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and ad click identifiers (gclid, fbclid) in the address
• Technical information: device type, browser, operating system, screen size, language, and your IP address, used to estimate your country and city
• Identifying a business contact: when you arrive through a personalised link we sent you (it carries your establishment's identifier), your visits are linked to that establishment; when you send the contact form with an email address, they are linked to that address, with the name and restaurant you give.

Why: to measure and improve the site's audience, to know which campaigns bring enquiries, and to follow up on our sales outreach to restaurant professionals. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Contact form: your message, together with where your visit came from (campaign, referring site, landing page), is stored in our own database, hosted by Google Cloud Platform in Paris (France), like the Platform's. A notification alerts our team in its internal messaging (Slack); it repeats your name, your contact details, your message and where your visit came from.

Cookies and storage: from your first visit, PostHog sets a cookie namedph_<project identifier>_posthog, holding a random identifier for your browser and your session, for 365 days. It keeps the same information in your browser's local storage and session storage, under names starting with ph_. Details are in our cookie policy.

Retention: 12 months for pages viewed, clicks and visit sources; 30 days for session recordings; for an identified business contact, the duration of the business relationship, then 3 years after the last contact.

How to object: write to support@useservice.app: we delete the data linked to your establishment or email address and stop sending you personalised links. You can also delete or block cookies in your browser settings; the site works without them.

14. Children's Privacy

The Platform is not intended for use by individuals under 16 years of age. We do not knowingly collect personal information from children.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the Platform or by email at least 30 days before they take effect.

The current version of this policy is always available atuseservice.app/en/legal/privacy.

16. Contact Us

Service (SAS)
Email: support@useservice.app
Address: 136 Chemin du Vallon de l'Oriol, 13007 Marseille, France