Privacy Policy
Last updated: 30 October 2026
DRAFT – replace all placeholders in [SQUARE BRACKETS] and have this reviewed by a lawyer before publication.
This Privacy Policy explains how Mesamia processes personal data when you use the website mesamia.app, the Mesamia apps for iOS and Android or the restaurant software. It is based on the Swiss Federal Act on Data Protection (FADP / revDSG, in force since 1 September 2023), the EU General Data Protection Regulation (GDPR) and the UK GDPR together with the UK Data Protection Act 2018.
1. Controller
Mesamia [RECHTSFORM] [STRASSE NR], [PLZ ORT], [LAND] Email: [DATENSCHUTZ-E-MAIL: privacy@mesamia.app] Phone: [TELEFON]
[If appointed: Data Protection Officer: [NAME, CONTACT]]
Representative in the EU (Art. 27 GDPR): [EU-VERTRETER nach Art. 27 DSGVO – name, address, email] Representative in the UK (Art. 27 UK GDPR): [UK-VERTRETER nach Art. 27 UK GDPR – name, address, email]
Note for completion: If the operator is based in Switzerland (with no establishment in the EU or UK), it will generally need to appoint a representative in the EU and in the UK because it offers its service to guests and restaurants there. If the operator is based in the EU, no EU representative is needed; a Swiss representative (Art. 14 FADP) should then be checked.
2. Who is responsible for which data
- Mesamia is the controller for your guest account, the guest website and apps, passing your table requests to restaurants, notifications, the technical handling of the reservation fee via Stripe, and for restaurant accounts and billing restaurants.
- The restaurant is an independent controller for the data it receives from your booking and uses in its business, and for its own guest book notes. The restaurant is the merchant for the no-show fee.
- Mesamia as processor: Where Mesamia operates the restaurant software (inbox, table plan, guest book) for a restaurant, Mesamia processes the data on the restaurant's behalf under a data processing agreement. Questions about how a restaurant uses your data are best sent to the restaurant directly; we will also forward requests.
3. What data we process
Guests
- Account data: name, phone number, email address; if you sign in with Apple or Google, the details they provide (for example name, email, account ID);
- Booking data: restaurant, date, time, party size, children, high chair, dog, note, request status (requested, accepted, alternative time suggested, declined, cancelled, arrived, no-show);
- Allergy information (optional, health data – see section 5);
- Visit history per restaurant and the guest statuses calculated from it;
- Reservation fee: consent (timestamp), payment status, disputes, Stripe references. Only Stripe receives full card details, not Mesamia;
- Device and usage data: device push token, app version, operating system, technical logs and error reports;
- Website analytics data, only with your consent (see section 9);
- Communication with our support team.
Restaurants
- Business details (name, address, opening hours, images), possibly from Google Places during onboarding;
- Names and contact details of owners and staff, logins, roles;
- Contract and billing data, Stripe Connect account reference;
- Content of the restaurant software (table plan, rules, guest book).
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Creating an account, sign-in (SMS code, Apple, Google) | Account data | Contract (Art. 6(1)(b)) |
| Sending table requests to restaurants, passing on replies | Account and booking data | Contract (Art. 6(1)(b)) |
| Passing allergy information to the restaurant | Allergy information | Explicit consent (Art. 6(1)(a), Art. 9(2)(a)) |
| Notifications (push, SMS, email) about requests and bookings | Contact data, push token, booking data | Contract (Art. 6(1)(b)) |
| Reservation fee: saving a card, no-show, dispute, charge, refund | Booking and payment data | Contract (Art. 6(1)(b)) |
| Calculating guest statuses and perks per restaurant | Visit history | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Operation, security, abuse prevention, error analysis (Sentry) | Technical data, logs | Legitimate interests (Art. 6(1)(f)) |
| Website usage analytics (PostHog EU) | Usage data | Consent (Art. 6(1)(a)) |
| Contracts with restaurants, billing | Restaurant data | Contract (Art. 6(1)(b)) |
| Setting up a restaurant profile with Google Places | Public business data | Legitimate interests (Art. 6(1)(f)) |
| Support | Communication | Contract or legitimate interests (Art. 6(1)(b), (f)) |
| Retention obligations (e.g. accounting), enforcing claims | Billing and payment data | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Our legitimate interests are a secure, working and improving service and the prevention of misuse.
Under the Swiss FADP, processing generally does not require a legal basis as long as the processing principles are respected. Where the FADP requires consent (for example explicit consent for health data), we obtain it.
5. Allergy information (health data)
- Allergy information is health data (sensitive personal data under the FADP, special category data under Art. 9 GDPR).
- We only process it if you provide it voluntarily and give explicit consent.
- It is visible only to you and to the restaurant of the booking concerned, and only for that booking.
- It is deleted automatically 30 days after the visit.
- You can withdraw your consent at any time by deleting the information from the booking or by writing to us. Withdrawal applies to the future.
- Important: Mesamia only passes the information on. Whether and how the restaurant takes it into account is the restaurant's responsibility. If you have a severe allergy, please also speak to the restaurant directly.
6. Recipients
Restaurants: When you send a request, the restaurant receives the data it needs for the booking: your name, the booking details, your note, any allergy information, your visit history and status at that restaurant, and [CHECK: which contact details – phone/email – the restaurant sees]. A restaurant cannot see which other restaurants you visit.
Processors and other service providers:
| Provider | Purpose | Location |
|---|---|---|
| Supabase [check contracting entity, e.g. Supabase, Inc.] | Database, authentication, hosting, backend functions | Provider in the USA; data stored in the EU (Frankfurt, Germany) or Switzerland (Zurich) [CHOOSE REGION] |
| Vercel [check contracting entity, e.g. Vercel Inc.] | Website hosting | Provider in the USA; served from the EU region |
| Stripe [check contracting entity, e.g. Stripe Payments Europe, Ltd., Ireland; UK: Stripe Payments UK Ltd.] | Payment processing (saving cards, 3-D Secure, charges, refunds, TWINT/Bizum) | Ireland/UK; transfers to the USA possible |
| Twilio [check contracting entity] | Sending SMS (sign-in codes, notifications) | USA; delivery via mobile carriers |
| Resend [check contracting entity] | Sending emails | USA |
| Expo [check contracting entity, e.g. 650 Industries, Inc.] | Push notifications (via Apple Push Notification service or Google Firebase Cloud Messaging) | USA |
| Sentry [check contracting entity, e.g. Functional Software, Inc.] | Error tracking | USA [CHECK EU DATA REGION] |
| PostHog [check contracting entity] | Website analytics, only with consent | EU cloud (Frankfurt, Germany) |
| Google [check contracting entity, e.g. Google Ireland Ltd. / Google LLC] | Sign in with Google; Google Places only during restaurant onboarding | Ireland/USA |
| Apple [check contracting entity, e.g. Apple Distribution International Ltd. / Apple Inc.] | Sign in with Apple | Ireland/USA |
Stripe, Google and Apple also process certain data as independent controllers (for example fraud prevention, legal obligations, account management). Their own privacy policies then apply in addition.
Other recipients: authorities and courts where we are legally required; advisers (for example lawyers, accountants) bound by confidentiality; an acquirer in the event of a business transfer.
7. International transfers
We store the main data in the EU or Switzerland. Some service providers are based in the USA or may access data from there. Switzerland and the EU recognise each other as providing adequate data protection; adequacy decisions also exist for the United Kingdom [CHECK CURRENT STATUS].
For transfers to countries without adequate data protection (for example the USA) we rely, depending on the recipient, on:
- the recipient's certification under the EU-US Data Privacy Framework, its UK Extension or the Swiss-US Data Privacy Framework, where the recipient is certified; or
- the European Commission's Standard Contractual Clauses (for Switzerland with the adaptations recognised by the FDPIC; for the UK with the International Data Transfer Addendum).
[CHECK PER PROVIDER BEFORE PUBLICATION which basis applies.] You can request a copy of the safeguards from us.
8. Retention
- Account: until you delete your account. We then delete or anonymise the data unless we are required to keep it.
- Allergy information: 30 days after the visit.
- Booking data and visit history: [SET RETENTION PERIOD, e.g. until account deletion]; guest statuses only take visits from the last 12 months into account.
- Payment and billing data: as long as statutory retention obligations require (in Switzerland and Germany generally up to 10 years).
- Technical logs and error reports: [SET PERIOD, e.g. 30–90 days].
- Analytics data: [SET PERIOD].
- Restaurant data: for the term of the contract; after it ends the restaurant can export its data, which is then deleted unless retention is required by law.
- Data in a restaurant's guest book: the restaurant, as controller, decides how long it is kept.
9. Cookies, local storage and analytics
To keep you signed in, we store a session in your browser or in the app (strictly necessary). On the website we only use PostHog EU for analytics if you consent. You can withdraw your consent at any time in the cookie settings. [CHECK: analytics in the apps – if used, describe consent or opt-out.] Details: Cookie Notice.
10. Automated decisions
We do not make automated individual decisions within the meaning of Art. 22 GDPR or Art. 21 FADP. For transparency: restaurants can set rules under which requests are accepted automatically, and guest statuses are calculated automatically from the number of visits. Declines and no-show markings are made by restaurant staff.
11. Your rights
Depending on the applicable law, you have the right to:
- access your data;
- have incorrect data corrected;
- erasure (delete your account in the app or at mesamia.app/account/delete);
- restriction of processing;
- data portability (receive your data in a common format);
- object to processing based on legitimate interests;
- withdraw consent at any time with effect for the future.
Write to [DATENSCHUTZ-E-MAIL: privacy@mesamia.app]. We may ask you to verify your identity.
You can lodge a complaint with a supervisory authority, for example the Swiss Federal Data Protection and Information Commissioner (FDPIC), the supervisory authority of your EU country of residence, or the Information Commissioner's Office (ICO, United Kingdom).
12. Security
We protect data with technical and organisational measures, such as encrypted transmission (TLS), access restrictions at database level, a role and permission concept and logging. Payment cards are stored only by Stripe.
13. Children
Mesamia is intended for people aged 16 and over. We do not knowingly process data of younger people as account holders. Information about accompanying children is limited to number and needs (for example a high chair).
14. Whether you must provide data
Without account and booking data we cannot send a request to a restaurant. Allergy information and analytics consent are voluntary.
15. Changes
We update this Privacy Policy when our service or the law changes. The version published at mesamia.app applies. We will inform you of material changes in the app or by email.