Privacy Policy
Last updated: 23 October 2026
This policy explains what personal data AVA handles, and why. AVA is provided by SIA "AVA Systems", reg. no. 40003309926, VAT no. LV40003309926, Stopiņu iela 22, Rīga, LV-1035, Latvia ("we"). Contact for anything privacy-related: ava@avareservations.com.
Two different roles – please read this first
- For restaurants using AVA, their staff, and visitors to this website, we decide how the data is used. We are the controller.
- For guests who book a table, join a waitlist or buy a gift card at a restaurant, the restaurant is the controller. We process that data for the restaurant, on its instructions, as its processor. If you are a guest, the restaurant's own privacy notice applies and the restaurant is who to contact first; we help it answer you.
1. Restaurants and their staff (we are the controller)
- What: name, email address, the restaurant you belong to, your role, a hashed password (never the password itself), your sign-in sessions, an activity log of the changes you make, and messages you send us through Settings → Support. For the account owner, billing details: the business's name, address and VAT number. Cards are held by Stripe, never by us.
- Why: to provide the account and the service (contract); to keep it secure and show who changed what (legitimate interest); to invoice and keep accounting records (legal obligation).
- How long: while the account exists. Invoices are kept for as long as Latvian accounting law requires.
2. Visitors to this website (we are the controller)
- No analytics, no advertising and no tracking cookies. The site loads nothing from other companies' servers – even its fonts are AVA's own.
- Your chosen language is remembered in your browser (see the Cookie Policy).
- Our servers keep ordinary technical logs – IP address, time and page requested – for security and fault-finding. They are kept briefly, then deleted.
- "See a live demo" makes a private pretend restaurant for you, deleted after 24 hours. We count how many demos were opened – the count holds no personal data.
3. Guests of restaurants (the restaurant is the controller, we are its processor)
- Booking details: name, phone, email, party size, date and time, notes, the area or table, the language you booked in, and which of the restaurant's links you came from.
- History: visits, no-shows and notes the restaurant's staff add.
- Payments: whether a deposit, prepayment or card guarantee was taken or charged, and the exact terms you agreed to. Card numbers are handled by Stripe in the restaurant's own Stripe account and are never seen or stored by AVA.
- Waitlist: name, phone, email, party size and the times you can come.
- Gift cards: the buyer's name and email, the recipient's email if given, a company's name, registration number and address if an invoice is asked for, the code and its balance, and the country of the paying card.
- Marketing consent, and the emails AVA sends in the restaurant's name: confirmations, reminders, changes, cancellations and, if the restaurant switches it on, one review request the morning after a visit (at most once every three months, with a one-tap opt-out).
4. Who else handles data
We use these providers to run AVA. Each processes data only as needed for its part:
| Provider | What it does for AVA | Where |
|---|---|---|
| Render | Hosts the AVA server. | region being confirmed |
| Neon | The database. | region being confirmed |
| Resend | Sends the emails (confirmations, reminders, gift cards, campaigns). | United States (Standard Contractual Clauses) |
| Stripe | AVA's own subscription billing, and the payments taken in each restaurant's own Stripe account. | EU / United States (Standard Contractual Clauses) |
| Cloudflare | The network in front of the site, for speed and protection against attacks; on the sign-up page, a check that stops bots (Turnstile), when switched on. | Global network (Standard Contractual Clauses) |
| OpenStreetMap (Nominatim) | Looks up a restaurant's street address when staff search for it in Settings. Only the typed address is sent. | United Kingdom (adequacy decision) |
Where a provider processes data outside the European Economic Area, this is covered by the European Commission's Standard Contractual Clauses or an adequacy decision. We never sell personal data and never use it for advertising.
5. Security
Connections are encrypted (HTTPS). Passwords are stored as one-way hashes; payment keys are stored encrypted. Access is split by role, every change is logged, and each restaurant's data is kept apart from every other restaurant's.
6. Cookies and browser storage
Only what AVA needs to work – see the Cookie Policy for every item.
7. Your rights
Under the GDPR you can ask for access to your data, a correction, deletion, a copy to take elsewhere or a restriction of processing, and object to processing based on legitimate interest. Write to ava@avareservations.com. If you are a restaurant's guest, we pass your request to that restaurant, which decides on it, and help it reply. You can also complain to Latvia's Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv).
8. Deletion
When a restaurant closes its account down, its guests', bookings' and gift cards' data is permanently deleted from AVA, not just hidden.
9. Changes
We update this page when what we do changes, and say so at the top.