Privacy Policy

Last updated: 28 August 2026

1. Who handles your data

Salvatore Manzella — data controller

RistoMaind is operated by an individual. The controller's full postal address is provided on written request to the email above, and will be published on this page once the business is formally registered.

2. Who this applies to

This policy covers two different groups of people, because the data we collect differs for each:

The Customer — the restaurant owner or manager who subscribes to RistoMaind.
The End User — the restaurant's own customer: someone booking a table, ordering from the QR menu, or receiving an automated message.

3. What we collect

3.1 Customer data (restaurant owner)

First name, last name and email address, obtained through Google sign-in
Venue details: name, address, opening hours, menu, prices, photographs
Billing data, handled by Stripe — we never store your card details
The content of conversations with the dashboard's AI assistant
Voice recordings, if you use dictation or voice conversation (see 3.4)

3.2 End User data (restaurant's customer)

Bookings: name, phone number, email, party size and free-text notes
QR menu orders: dishes, quantities and table number. We do not ask for identifying details in order to place an order
WhatsApp: phone number and the content of messages exchanged with the venue

3.3 Allergies and intolerances

Information about allergies and intolerances is health data under Article 9 GDPR. We process it only where the End User provides it voluntarily — for example in a booking note — and solely so that the restaurant can prepare service safely. We do not use it for any other purpose, neither profiling nor marketing.

3.4 Voice

The dashboard lets a restaurant owner speak instead of typing. When you use that feature, the recording of your voice is sent to OpenAI to be transcribed, and replies may be read back to you aloud by the same service. We do not retain the recordings: they exist to produce the text and are then discarded. If you do not use the microphone, nothing is sent.

4. Why we process this data

Purpose	Legal basis
Providing the service: dashboard, menu, bookings, AI assistant	Performance of a contract (Art. 6.1.b)
Sending reminders and confirmations over WhatsApp	Explicit consent (Art. 6.1.a)
Handling allergies and intolerances	Explicit consent for special category data (Art. 9.2.a)
Invoicing and tax obligations	Legal obligation (Art. 6.1.c)
Service security and abuse prevention	Legitimate interest (Art. 6.1.f)

5. Who we share data with

To run the service we rely on the providers listed below, which process data on our behalf as data processors. This list is the real one: it describes the services the system actually sends data to, not ones we might use some day.

Provider	What it does	Data involved
Cloudflare, Inc.	Hosting, storage, login sessions	All service data
Google Ireland Ltd.	Dashboard sign-in; bookings and orders register on Google Sheets	Sign-in email, booking and order data
Anthropic PBC	AI assistant, menu chatbot, text generation	Conversation content, menu data
OpenAI, L.L.C.	Voice transcription and text-to-speech	Owner's audio recordings, text read aloud
Meta Platforms Ireland Ltd.	WhatsApp messaging	Phone number and message content
Stripe, Inc.	Payments and subscriptions	Billing data — never card details
Make.com (Celonis SE)	Automation between services	Booking data, generated content
Ideogram AI, Inc.	Image generation for social posts	Prompt text — no personal data

Some of these providers are established outside the European Union, in particular in the United States. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission, or an equivalent adequacy framework.

We do not sell your data and we do not pass it to third parties for their own marketing.

6. How long we keep it

Incoming WhatsApp messages: 30 days, after which the system deletes them automatically. This is not a promise — it is how the software is built.
Customer and venue data: for the duration of the subscription, and up to 12 months after cancellation. If you ask for deletion sooner, we delete sooner.
Bookings and orders: these stay in the restaurant's own register for as long as the owner keeps them, because that register belongs to them. On an End User's request we act to delete them.
Invoicing records: for the period required by tax law.

7. Your rights, and how to have your data deleted

You have the right to access your data, correct it, erase it, restrict its processing, receive it in a portable format, object to processing based on legitimate interest, and withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.

To exercise them, write to info@nevermaindagency.com. You also have the right to lodge a complaint with the data protection supervisory authority in your country.

8. Security

All connections are encrypted (HTTPS/TLS). Dashboard access goes through Google, and the session travels in a technical cookie that JavaScript cannot read. Each venue sees only its own data. No system is invulnerable: in the event of a breach posing a risk to your rights, we will notify you as required by the GDPR.

9. Cookies

This marketing site uses no cookies and carries no analytics or tracking tools. The dashboard reserved for restaurant owners uses a single, strictly technical cookie that keeps the session open after sign-in: without it you could not stay logged in. It requires no consent and does not follow you across sites.

10. Minors

The service is not intended for independent use by anyone under 16. If an adult makes a booking that includes details relating to a minor, those details are processed solely to fulfil the booking.

11. Changes

We may update this policy. Where changes are substantial we will notify you by email or through a notice in the dashboard, and the date at the top of this page will change.