How DinnerFlow handles data.

01Who we are

DinnerFlow is a WhatsApp booking assistant for restaurants. It is operated by DinnerFlow, registered with the Dutch Chamber of Commerce (KvK) under number 42141479 and based at Bilderdijkstraat 202-1, 1053 EL Amsterdam, the Netherlands. In this policy “DinnerFlow”, “we” and “us” refer to that business.

This policy applies to guests who message a restaurant that uses DinnerFlow, to the restaurants we work with and their staff, and to visitors of dinnerflow.ai.

02Our role

When you message a restaurant that uses DinnerFlow, the restaurant decides why and how your data is used; under the GDPR the restaurant is the controller. DinnerFlow answers your messages and manages your reservation on the restaurant’s instructions, as its processor. We have a data processing agreement with every restaurant we work for.

For a few things DinnerFlow is the controller itself: running this website, working with the restaurants that are our customers, keeping our systems secure, and meeting our own legal obligations.

03The information we collect

Information you give us. If you are a guest: your WhatsApp phone number and profile name, the messages you exchange with the restaurant, and the details of your reservation (date, time, party size, the name it is under, and any notes such as an allergy). If you work at a restaurant: your name, work email and WhatsApp number, plus the restaurant details you share during onboarding such as opening hours, house rules and reservation-system access.

If you request the 10-day trial on this website. The restaurant’s name, your name, your mobile number, your email address and the reservation system you use, together with the page you arrived on and the campaign it came from (for example a flyer or an Instagram ad). Nothing is sent if you close the form before the last step.

Information collected automatically. Message identifiers, timestamps and delivery status from the WhatsApp Business Platform. Where a restaurant uses missed-call follow-up, the number that called and the time of the call. On this website, standard server access logs.

Please do not send payment card numbers, identity documents or health information beyond what is needed for your booking.

04How we use it

• To answer your messages and make, change or cancel your reservation with the restaurant.
• To follow up a missed call with a single WhatsApp message, where the restaurant has enabled this.
• To pass a conversation to restaurant staff when it needs a person, with the context they need to help you.
• To keep the service secure and reliable, prevent abuse, and fix problems.
• To contact you about a trial you requested on this website, and to see which of our campaigns reach restaurants.
• To support and invoice the restaurants we work with, and to meet our legal obligations.

For guest data we act on the restaurant’s instructions; the legal basis is the reservation you are making with the restaurant and, for missed-call follow-up and escalations, the restaurant’s legitimate interest in answering its guests. For a trial request, we act on your request to be contacted before a contract. For our own activities we rely on our contract with the restaurant, our legitimate interest in running a secure service, and legal obligation where the law requires it. We do not use guest data for advertising, do not sell it, and do not build profiles of guests across restaurants.

05Who we share it with

We share information only where it is needed to provide the service:

• The restaurant you are messaging, which sees your conversation and reservation and stores the booking in its own reservation system.
• Service providers that help us run DinnerFlow: hosting and infrastructure, the WhatsApp Business Platform (Meta), the AI language-model provider that helps us understand and draft messages, the restaurant’s reservation system, and email delivery for staff notifications. Each is bound by a data processing agreement or equivalent terms and may only use the data to provide its service to us. A current list of sub-processors is available on request.
• Authorities, where we are legally required to, or to protect the rights and safety of DinnerFlow, our restaurants or their guests.

06AI and WhatsApp

Your messages are processed by a large language model to understand what you are asking and to draft a reply. Under our agreement with the model provider, your messages are not used to train its models. The model proposes; it never books on its own. Availability is read live from the restaurant’s reservation system, a reservation is only written after you have seen a summary and confirmed it, and anything the assistant cannot safely handle is passed to restaurant staff. No decision with legal or similarly significant effect on you is taken automatically.

Messages travel over the WhatsApp Business Platform and are handled by Meta under the WhatsApp Privacy Policy. DinnerFlow does not send marketing messages: apart from a single follow-up after a missed call, every conversation starts with you. At the start of a conversation you are told that you are talking to the restaurant’s AI assistant. To stop receiving messages, reply STOP or block the number in WhatsApp.

07Storage, retention and security

We keep personal data only as long as needed for the purposes above. Conversation content is deleted after a set period following the last message, as agreed with the restaurant in its processing agreement; reservation records live in the restaurant’s own system under the restaurant’s retention policy. Trial requests from this website are kept for 12 months and then deleted. Restaurant account and invoicing data is kept for the duration of our contract and thereafter as long as Dutch tax law requires. When a restaurant stops using DinnerFlow, we delete its guest conversation data within 30 days unless the law requires us to keep it.

Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it, protected by multi-factor authentication, and logged. Reservation-system credentials are stored encrypted and never included in model prompts. Should a personal-data breach occur, we notify affected restaurants and, where required, the Dutch Data Protection Authority without undue delay.

08International transfers

Some of our service providers process data outside the European Economic Area, including in the United States. Where that happens we rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. Copies of the relevant safeguards are available on request.

09Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interest. Because the restaurant is the controller for guest data, the fastest route is to contact the restaurant. You can also email us at hello@dinnerflow.ai from the phone number the conversation was held on, and we will handle your request together with the restaurant. We answer within one month.

You can also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your own EU country.

The service is not directed at children. If you believe a child has provided us with personal data, contact us and we will delete it.

10Cookies and this website

dinnerflow.ai sets no cookies and loads no third-party analytics or tracking scripts. Our hosting provider keeps standard server access logs (IP address, user agent, requested page) for a short period to keep the site secure. The trial form keeps the campaign link you arrived with in the page’s memory while you browse and stores nothing on your device; what you enter is sent to our own servers only when you submit the last step. Email links open your own mail client; nothing is sent to us until you send the email.

11Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the latest version. For material changes that affect guests, we inform restaurants so they can update their own privacy information.

12Contact

DinnerFlow
Bilderdijkstraat 202-1
1053 EL Amsterdam, the Netherlands
KvK 42141479
hello@dinnerflow.ai