Privacy Policy

1. Purpose of This Privacy Policy

This Privacy Policy is intended to inform users, business customers, and any person interacting with EatNow’s services (“EatNow,” “we,” “us,” “our”) about how their personal data is collected, used, protected, and processed.

EatNow operates a booking and customer-relationship management platform for hospitality businesses (restaurants and hotels). EatNow’s services include, in particular:

• the online booking system;
• the sending of transactional communications and notifications (email, WhatsApp Business API);
• the possible handling of card holds or prepayments via approved payment providers;
• operational management and improvement tools;
• features to prevent no-shows.

EatNow is committed to complying with:

• the General Data Protection Regulation (GDPR) for users located in the European Union;
• Moroccan Law No. 09-08 and CNDP guidance for users located in Morocco;
• internationally recognized data protection best practices for users located in other countries.

This Policy reflects EatNow’s commitment to a high level of transparency, compliance, and security aligned with SaaS industry standards and the needs of hospitality professionals.

2. Territorial and Legal Scope

This Policy applies to all users and business customers accessing EatNow’s services, including:

• users making a booking;
• partner businesses (restaurants, hotels, guesthouses);
• visitors to EatNow websites and interfaces;
• users of integrated email and WhatsApp features;
• teams using EatNow’s management tools.

2.1 Covered territories

This Policy covers processing carried out:

• in Morocco, in accordance with Law 09-08 and CNDP decisions;
• in the European Union, in accordance with the GDPR;
• and in other countries, where EatNow applies internationally recognized personal data protection principles when no stricter local regulation applies.

2.2 Rules based on location

• For users and businesses located in Morocco, Law 09-08 and CNDP oversight apply.
• For users located in the European Union, the GDPR applies.
• For users located in other countries, EatNow applies GDPR-inspired standards to ensure a high level of protection.

2.3 Covered platforms and services

This Policy covers:

• the EatNow website;
• booking interfaces;
• the merchant dashboard;
• the EatNow mobile applications for iOS and Android (professional application for establishment teams);
• APIs and webhooks;
• transactional notification systems (email, WhatsApp);
• internal management and support tools.

2.4 Exclusions

Not covered:

• third-party sites accessible via EatNow;
• payment solutions selected and operated directly by a business outside of EatNow integrations;
• any external service not operated by EatNow.

3. Definitions

For the purposes of this Policy, the following terms have the meanings set out below. These definitions clarify each party’s role and the nature of data processed when using EatNow’s services.

4. Responsibility for Processing

This section defines the roles of EatNow and partner establishments with respect to personal data processing, in accordance with Moroccan Law No. 09-08 and CNDP implementing decisions, and with the GDPR where applicable.

4.1 Partner establishment as controller

The partner establishment is the controller for end-customer data collected in the context of reservations (including identity, contact details, special requests, visit history, and booking date/time). It determines the purposes and means of processing, ensures compliance with applicable regulations, informs data subjects where required, and guarantees the lawfulness of data it provides to EatNow.

4.2 EatNow as processor

EatNow acts as processor for end-customer data, in accordance with the partner establishment’s documented instructions and the service contract. EatNow processes this data solely to provide the service, including reservation management, sending transactional communications, and operational support.

4.3 Limited access to customer data

EatNow does not access reservation content relating to end customers unless such access is strictly necessary for proper service operation, for example in connection with a technical incident, a support request, or for security reasons. Any access, when it occurs, is limited, controlled, and performed exclusively for diagnostics, maintenance, or security, in accordance with CNDP and GDPR requirements.

4.4 Data processed by EatNow as controller

EatNow is the controller for certain categories of data that do not form part of partner establishments’ customer files, including professional contact details of establishment representatives, information necessary for contract management, billing, abuse prevention, security maintenance, and browsing data from EatNow websites.

4.5 Partner establishment instructions and obligations

The partner establishment undertakes to provide EatNow with lawful instructions compliant with applicable regulations, to fulfill its own data protection obligations, and to inform end customers of its use of EatNow for reservation management where this information obligation lies with the establishment.

4.6 Contractual documentation (DPA)

The allocation of responsibilities between EatNow and each partner establishment is set out in the service agreement and, where applicable, a Data Processing Agreement (DPA) compliant with CNDP requirements and, where necessary, the GDPR.

4.7 No joint controllership

Unless expressly agreed otherwise, there is no joint controllership between EatNow and the partner establishment for reservation data: the establishment is the sole controller, and EatNow acts exclusively as processor.

5. Categories of Data Collected

In providing its services, EatNow collects only the data necessary for the purposes described in this Policy and in the contractual framework with partner establishments. The data processed depends on the user type (end customer, professional representative, website visitor, or user of EatNow interfaces).

5.1 End-customer data (reservations)

For reservations made via channels provided by EatNow (online form, embedded widget, WhatsApp Business API, EatNow booking pages, digital entry points operated by EatNow, and any other channel supported by the platform), EatNow processes on behalf of the partner establishment: identity (first and last name), contact details (phone, email), booking details (date, time, party size, optional preferences), submitted comments, booking history, attendance status (confirmed, canceled, no-show), and interactions necessary to process the booking. EatNow does not collect special categories of data within the meaning of applicable law.

5.2 Payment data (card hold or pre-authorization)

When a business requires a card hold or pre-authorization to secure a booking or prevent no-shows, EatNow never processes or views card data. Such data is processed exclusively by approved payment providers in compliance with applicable regulations. EatNow does not store or access this data.

5.3 Data on representatives of partner establishments

For professionals using EatNow interfaces, the following data may be collected: identity (first and last name), professional contact details (email, phone), account identification information, billing data, information related to platform usage, and exchanges with EatNow support during onboarding or operational follow-up.

5.4 Technical and security data

For service operation, security, and improvement, EatNow collects technical data such as session identifiers, browser type, device information, IP address, access logs, error logs, and timestamps.

In the mobile applications, this also includes a device identifier generated by the application and stored on the device, together with a push notification token. Both are linked to the staff member's account in order to deliver notifications to the right device and to identify authorised devices, in particular for ticket printing. They are not, and do not contain, any advertising identifier.

Audience-measurement and diagnostic tools also derive an approximate location (country, region, city) from the IP address. EatNow does not collect precise geolocation data and never requests access to the device's location.

This data is used to ensure platform reliability, security, diagnostic capability, and performance, as well as for the usage analysis described in section 14.4. It is not used to track end customers for marketing or commercial profiling, nor shared with third parties for advertising purposes.

5.5 Communications and support data

When support is requested, EatNow may process data and exchanges necessary to handle the request (message content, provided screenshots or files, technical elements useful for diagnosis), strictly to respond to the inquiry.

5.6 Browsing data on EatNow websites

For visitors to the public site eat-now.io and related information areas, EatNow may collect browsing data (pages viewed, time spent, essential cookies, analytics data). This data is processed in accordance with valid consents and used only to optimize site performance and user experience.

6. Purposes of Processing and Legal Bases

EatNow processes personal data only for specified, legitimate, and explicit purposes, in compliance with Moroccan Law No. 09-08, CNDP decisions, and, where applicable, the GDPR. EatNow commits to never using end-customer data for purposes other than those necessary to provide the service.

7. Methods of Data Collection

EatNow collects personal data lawfully, fairly, and transparently, directly from data subjects or via partner establishments when bookings are made through their channels. Data is collected only to the extent strictly necessary for the defined purposes.

7.1 Data provided directly by the end customer

Some data is collected directly from end customers when they use EatNow’s services, including when they make a booking via a channel provided by EatNow (widget, dedicated page, WhatsApp Business API, or any other supported channel), when they confirm or modify a booking, or when they provide specific information to organize their visit.

7.2 Data provided by the partner establishment

The partner establishment may enter or transmit data via its EatNow interface as part of reservation and customer-relationship management. This may include adding a booking made through another channel (e.g., walk-in, external phone, direct messages), updating existing information, or tracking visits. In this context, EatNow acts strictly as processor.

7.3 Automatically generated data

Certain technical data is collected automatically when using EatNow’s services, including connection information, device used, access logs, timestamps, and elements strictly necessary for security, continuity, and performance.

7.4 Support and communications data

When assistance is requested, EatNow may collect information necessary to handle the request (messages, screenshots, technical logs), voluntarily provided by the user or generated for diagnostic purposes.

7.5 No opaque indirect collection

EatNow does not collect personal data by covert, opaque, or unfair means. EatNow does not purchase or obtain third-party contact files and does not use data from unauthorized sources.

8. Data Retention Periods

EatNow retains personal data only for as long as necessary for the purposes for which it was collected, in compliance with Moroccan Law No. 09-08, CNDP requirements, and, where applicable, the GDPR. The periods below apply unless a longer legal obligation exists or a dispute requires temporary retention.

9. Processors, Hosting, and Data Transfers

EatNow uses technical providers selected for their security, compliance, and reliability. These providers act solely for service needs and in accordance with EatNow’s instructions. All are subject to strict contractual commitments on confidentiality, protection, and data security in line with Law 09-08, CNDP decisions, and, where applicable, the GDPR.

9.1 Data location

Data is primarily hosted within the European Union. Some providers may be located outside the EU (notably in the United States) or operate international support centers. Where transfers outside the EU are necessary, they are governed by appropriate safeguards compliant with the GDPR (Standard Contractual Clauses, reinforced contractual commitments, technical and organizational measures) and in accordance with CNDP requirements for processing concerning users located in Morocco.

9.2 Technical providers used

EatNow relies on the following providers for service operation:

• – Vercel (hosting / CDN – EU & USA) – contractual clauses & technical measures
• – Supabase (database & authentication – EU, US support) – contractual clauses & technical measures
• – Hetzner (hosting – EU) – EU-compliant hosting
• – Upstash (Redis / message queues – EU & USA) – contractual clauses & technical measures
• – AWS (complementary cloud infrastructure – EU & USA) – contractual commitments & security compliance
• – Trigger.dev (technical orchestration – USA) – contractual clauses & technical measures
• – Sentry (monitoring & logs – EU & USA) – contractual clauses & technical measures
• – PostHog (product analytics – EU & USA) – contractual clauses & technical measures
• – Expo (Expo Application Services) (mobile application distribution, updates and push notifications – USA) – contractual clauses & technical measures
• – Vercel AI Gateway (technical routing of artificial intelligence model calls – EU & USA) – contractual clauses & technical measures
• – Google (Gemini artificial intelligence models, via Vercel AI Gateway – EU & USA) – contractual clauses & technical measures
• – Anthropic (Claude artificial intelligence model used as a fallback, via Vercel AI Gateway – USA) – contractual clauses & technical measures
• – Brevo (transactional emailing – France) – EU-compliant hosting
• – Meta / WhatsApp Business API (customer notifications – EU & USA) – enterprise API & contractual commitments
• – CMI (card holds & payments – Morocco) – provider approved by Bank Al-Maghrib
• – Payzone (payments – Morocco) – provider approved by Bank Al-Maghrib
• – Stripe (optional international payments) – PCI-DSS & GDPR compliance; used under the client’s responsibility

9.3 No direct access to card data

EatNow never processes or stores card data. Such data is handled exclusively by approved payment providers in compliance with applicable security rules (including PCI-DSS).

9.4 Safeguards for transfers outside the EU

Where data may be processed outside the European Union (e.g., technical support or distributed infrastructure), EatNow implements appropriate safeguards, including:

• European Commission Standard Contractual Clauses;
• additional technical measures (encryption, pseudonymization, access restrictions);
• strict confidentiality agreements and contractual limitations;
• data minimization for any transfer.

9.5 Notice of changes

EatNow may update its list of processors for technical or operational reasons, while ensuring an equivalent level of protection. Partner establishments will be informed of any material change affecting data protection.

10. Data Security

EatNow implements technical and organizational measures to ensure a level of security appropriate to the risks, in accordance with Law 09-08, CNDP decisions, the GDPR where applicable, and SaaS best practices. These measures protect personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure, unauthorized access, or any other unlawful processing.

10.1 Organizational measures

EatNow notably applies:

• strict role-based access control and least privilege;
• admin access control and logging of sensitive actions;
• internal confidentiality undertakings by authorized staff and providers;
• an internal incident-management and escalation policy;
• ongoing staff awareness on security and confidentiality.

10.2 Technical measures

EatNow implements, in particular:

• encryption in transit (TLS);
• encryption at rest via cloud providers where available;
• environment isolation (production / test);
• secure authentication for system and admin-interface access;
• regular backups and data-integrity monitoring;
• monitoring, alerts, and technical logging to detect anomalies and suspicious behavior.

10.3 Limited data access

Access to personal data is limited to authorized EatNow personnel who require it for technical reasons, maintenance, support, or service operation, and only according to documented instructions where end-customer data of the partner establishment is concerned.

10.4 Testing, audit, and continuous improvement

EatNow regularly performs checks, technical verifications, and security improvements. External audits and additional testing may be carried out as needed based on service requirements and evolving risks.

10.5 Security incident management

In the event of a security incident that could affect personal data, EatNow will implement its internal incident-response procedure and notify the partner establishment as soon as possible, providing necessary information in accordance with applicable regulatory requirements.

10.6 Communication confidentiality

Communications between users, partner establishments, and EatNow services are protected by appropriate security protocols, including TLS encryption for Internet exchanges.

10.7 Secure hosting

Data is hosted by cloud providers recognized for reliability, regulatory compliance, and security. EatNow ensures that relevant processors implement adequate safeguards.

11. Rights of Data Subjects

In accordance with Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data, CNDP decisions and authorizations, and the GDPR where applicable (users located in the EU), data subjects have rights concerning their personal data.

Any request to exercise these rights may be addressed to EatNow as described in this Policy. EatNow undertakes to respond within applicable legal timeframes and to assist partner establishments in meeting their own obligations toward end customers.

12. Exercising Rights and Contact

Data subjects may exercise their rights regarding their personal data with EatNow under Law 09-08, CNDP decisions, and, where applicable, the GDPR. EatNow has internal procedures to handle such requests securely, traceably, and within legal deadlines.

12.1 Contact methods

For any question or request regarding personal data, data subjects may contact EatNow at:

(The email address is dedicated to handling personal data requests.)

12.2 Response time

EatNow will respond within a reasonable period and in accordance with applicable legal obligations.

• – Morocco (CNDP – Law 09-08): a reasonable legal timeframe depending on the request type
• – EU (GDPR): within one month, extendable within regulatory limits in case of complexity or numerous requests

If extended, EatNow will inform the data subject of the additional time and the reasons.

12.3 Requests requiring establishment involvement

For data processed on behalf of a partner establishment (customer reservations, history, internal notes, etc.), EatNow acts as processor. In such cases, any request from an end customer will be forwarded to the relevant establishment, which remains solely responsible for handling data subject rights. EatNow will assist the establishment as needed.

12.4 Identity verification

To ensure data security and confidentiality, EatNow may request additional information to verify the requester’s identity before fulfilling a request.

12.5 Right to lodge a complaint with supervisory authorities

Data subjects have the right to lodge a complaint with the competent data protection authority:

• – Morocco: Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP)
• – European Union: the competent local supervisory authority in the country of residence or the relevant Member State (e.g., the CNIL in France)

EatNow nonetheless encourages users to contact it first to attempt an amicable resolution.

13. Processing Roles and Responsibilities

In providing its services, EatNow acts both as controller and as processor, depending on the nature of the data processed and the purpose pursued.

13.1 EatNow acting as controller

EatNow acts as controller for data necessary for:

• – managing partner establishment accounts;
• – billing, contract management, and business relationship;
• – technical support, incident management, and service improvement;
• – information-system security and fraud-prevention;
• – service-related communications (security notices, product updates, contractual information).

In this context, EatNow determines the purposes and means of processing.

13.2 EatNow acting as processor

EatNow acts as processor on behalf of the partner establishment where data concerns end customers and is processed for:

• – reservation management;
• – operational communications with end customers (confirmation, modification, reminder, card pre-authorization where applicable);
• – tracking visits, cancellations, and no-shows;
• – the establishment’s customer-relationship management;
• – data entered by establishment staff (e.g., walk-ins, customer history, stated preferences).

In this context, the partner establishment remains solely responsible for ensuring lawful collection and for informing end customers.

13.3 Partner establishment obligations

The partner establishment undertakes to:

• – collect data lawfully and transparently and inform its customers in accordance with the law;
• – submit to EatNow only accurate, relevant data necessary for reservation management;
• – comply with all applicable legal obligations regarding personal data;
• – respond to end-customer rights requests, with EatNow providing technical assistance if necessary.

13.4 Documented instructions

EatNow processes end-customer data only on the partner establishment’s documented instructions and to the extent necessary to perform the service. Any request to use data for other purposes requires a specific agreement.

13.5 Limitation of liability

Each party remains responsible for its respective obligations. EatNow cannot be held liable for the partner establishment’s failure to meet its legal or contractual obligations, including customer information duties or the handling of rights requests.

14. Cookies and Similar Technologies

When using the EatNow platform, cookies and similar technologies may be placed on the user’s device to ensure proper service operation, secure access, improve user experience, and perform audience measurement.

EatNow favors a proportionate and responsible use of these technologies, in compliance with applicable legal requirements, including Law 09-08, CNDP decisions, and, where relevant, the GDPR.

14.1 Types of cookies used

EatNow may use the following categories:

• – Strictly necessary cookies: essential for service operation, security, and authentication. They cannot be disabled.
• – Functional cookies: improve browsing comfort (e.g., preference retention).
• – Audience-measurement cookies: analyze service use and optimize performance (configured with limited tracking and data minimization). They are only set with the user’s consent.
• – Advertising cookies: set by Google, Meta (Facebook, Instagram) and OpenAI (ChatGPT) to measure how EatNow’s advertising campaigns perform, for example how many demo requests they generate. They are only set with the user’s consent.
• – Security and anti-abuse technologies: protect the service against fraudulent use and attacks.

EatNow does not sell personal data and does not use these cookies to serve advertising on behalf of third parties. Google, Meta and OpenAI process the data collected by their cookies in accordance with their own privacy policies.

14.2 Consent

Where required by law, a clear information mechanism and, where applicable, prior consent is implemented before placing non-essential cookies.

On the eat-now.io website, this choice is collected through a banner on the first visit. Analytics and advertising cookies are only set once the corresponding category is accepted, and rejecting is as easy as accepting. The choice is kept for 6 months, then asked again.

Users can manage their preferences or withdraw consent at any time, where applicable.

14.3 Retention period

Cookie and similar technology lifespans are limited to what is strictly necessary and, where consent is required, do not exceed durations recommended by supervisory authorities (notably 13 months for audience-measurement cookies under GDPR regimes).

14.4 Analytics and performance tools

EatNow uses audience-measurement and product-analytics tools (notably PostHog) to understand how the interfaces are used, diagnose incidents, and improve the service. These tools record pages viewed, interactions with the interface, performance measurements, and the associated technical logs. Information is transmitted only to the authorized providers listed in section 9.2, to the extent necessary for service operation and improvement.

On the eat-now.io website, PostHog is only enabled once the “Analytics” category of the cookie banner is accepted.

These tools include a session recording feature, which allows a working session to be replayed for diagnostic and improvement purposes. On professional interfaces (the merchant dashboard and the web surfaces embedded in the mobile application), such recordings may show the content displayed and entered in the interface, including booking information.

These recordings are kept for a maximum of 90 days, are accessible only to authorised EatNow personnel with a need to know, and are used neither for advertising nor for commercial profiling of end customers. They are not shared with any third party.

14.5 Cookie management

Users can change their choices at any time using the “Manage cookies” link in the website footer. They can also configure their browser or device to restrict or block certain cookies. However, disabling essential cookies may affect service operation.

15. Changes to This Policy

This Policy may be updated to reflect legal, regulatory, technical, or organizational developments affecting personal data processing by EatNow.

Any material change affecting users’ rights or obligations will be communicated appropriately, by any suitable means (e.g., in-service notice, direct communication to partner establishments, or a visible website update).

The applicable version is the one in force at the time of service use. Partner establishments are encouraged to review this Policy regularly to stay informed of updates.

16. Supervisory Authorities and Complaints

Data subjects have the right to lodge a complaint with the competent data protection authority if they believe their rights have not been respected or that the processing of their personal data does not meet legal requirements.

16.1 Morocco – CNDP

For users and businesses located in Morocco, the competent authority is:

Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP)

Website: https://cndp.ma

EatNow declares its processing activities to the CNDP in accordance with Law 09-08 and applies the relevant authorizations and decisions regarding storage, hosting, and, where applicable, international data transfers.

16.2 European Union

For users located in the European Union, complaints may be submitted to the competent local data protection authority in the country of residence or where the relevant processing takes place.

For example, in France: Commission Nationale de l’Informatique et des Libertés (CNIL) – https://cnil.fr

16.3 Prior contact recommended

Before approaching an authority, data subjects are encouraged to contact EatNow to seek an amicable solution:

📧 privacy@eat-now.io

EatNow undertakes to examine and handle any request or complaint as promptly as possible, in accordance with legal obligations.