Privacy Policy

• Data controller: Diana Muresan-Serban
• NIF/NIE: Z4052574W
• Address: Calle de la Niña 1, puerta 4, 46113 Moncada (Valencia), España
• Contact: support@koaladish.com

If you booked a table or an event on a restaurant's website, that restaurant is responsible for your data and KoalaDish processes it on the restaurant's behalf. Please contact the restaurant first; we will help it answer your request.

• Account data: your email address, your password (stored encrypted by our authentication provider) and technical login data such as dates and IP addresses.
• Restaurant information you enter: name, address, phone, email, opening hours, social media links, menus, photos, logos and, if you connect one, your domain name.
• Billing data for paid plans: Stripe collects your payment details. We receive your Stripe customer reference, plan, subscription status and invoice information, never your full card number.
• Messages you send us, for example support requests.
• Guest data, on behalf of restaurants: name, email, phone, number of guests, date and time and any notes given when booking a table or an event.
• Technical data recorded by our hosting providers in server logs, such as IP address, browser and device type.

• To create and run your account and your restaurant website: performance of our contract with you (Art. 6.1.b GDPR).
• To process payments, issue invoices and keep accounting records: performance of the contract and our legal obligations (Art. 6.1.b and 6.1.c GDPR).
• To send service emails such as account confirmation, password resets and important changes: performance of the contract (Art. 6.1.b GDPR).
• To keep the service secure, prevent abuse and fix errors: our legitimate interest (Art. 6.1.f GDPR).
• To answer your questions and requests: performance of the contract or our legitimate interest in replying.

We do not sell personal data, we do not use it for advertising and we do not send marketing emails without your consent.

We use trusted providers that process data on our behalf under data processing agreements:

• Supabase: database, user accounts and file storage.
• Vercel: website hosting and connection of custom domains.
• Stripe: payment processing. For some purposes, such as fraud prevention, Stripe acts as an independent controller.
• Resend: sending account emails.
• Google (Google Analytics): visit statistics, only if you accept analytics.
• Unsplash: some sample photos in template previews are loaded from its servers.

We may also share data when the law requires it, for example with tax authorities or courts.

Some of these providers are based in the United States or may process data there. When that happens, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

• Account and restaurant data: while your account is active. If you ask us to delete your account, we do so without undue delay and within 30 days at the latest, apart from backups, which are overwritten over time.
• Billing and accounting records: for as long as Spanish commercial and tax law requires (generally up to 6 years).
• Guest data: for as long as the restaurant keeps it in its account. It is deleted when the restaurant deletes it or closes its account.
• Server logs: for the limited period set by our hosting providers.

You can ask to access, correct or delete your data, to restrict or object to its processing and to receive it in a portable format. Write to support@koaladish.com. We may need to confirm your identity, and we will reply within one month.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Strictly necessary storage: your login session, so you stay signed in, your language choice and your answer to the analytics question. Under Article 22.2 of the LSSI-CE, this does not require consent.

Analytics, only if you accept it in the banner: we count how visitors move from our homepage to creating an account, which pages and “Start free” buttons are used, the type of any sign-up error (never what you typed), the type of device, and the campaign that brought you (for example utm parameters or an ad click ID). To link the steps of one visit we use a random ID that is kept only in that browser tab. We never record your name, email address, password or IP address. If you accept and then create an account, the campaign is saved with your account. The data is stored in KoalaDish's own database (Supabase), is not shared with advertising networks and is deleted after 13 months. Legal basis: your consent (Article 6.1.a GDPR), which you can withdraw at any time under “Cookie settings” at the bottom of every page.

If you accept analytics, we also use Google Analytics 4, provided by Google Ireland Limited, to measure the same visits and sign-ups. It sets the cookies _ga and _ga_Z05085KD9Q, which identify your browser with a random number and last up to 13 months. Google receives your IP address in order to provide the service, but Google Analytics 4 does not store it. We have switched off advertising features and Google signals, so this data is not used for advertising or personalisation, and we only send page addresses with campaign parameters, never your name, email address or password. Google may process this data in the United States under the EU-US Data Privacy Framework. Legal basis: your consent (Article 6.1.a GDPR). If you withdraw it under “Cookie settings”, Google Analytics stops and its cookies are deleted. More information: https://policies.google.com/privacy

Stripe's payment pages use their own cookies, governed by Stripe's privacy policy.

We protect data with encrypted connections (HTTPS), access controls that keep each restaurant's data separate, and restricted access to our systems.

KoalaDish accounts are for adults acting for a business. We do not knowingly collect data from children.

We will update the date at the top of this page whenever we change this policy, and tell account holders by email about significant changes.