Privacy policy

When you book a table: your name, email address, phone number (optional), party size and any dietary or special-request notes you choose to add. Payment is handled entirely by Stripe, we never see or store your card details.

When you sign in: your email address, used to send a magic sign-in link. No passwords are stored because none exist.

When you join a waitlist or enable notifications: your email and chosen city, or a push-notification subscription tied to your device. We also record your approximate location (country and nearest city, derived from your IP address) at signup — we use it to decide which cities to launch next, nothing else.

When you browse: basic analytics. Google Analytics only runs if you accept cookies. Our product analytics (PostHog) runs without cookies and without building a profile of you unless you book.

To run your booking: confirming it, reminding you before the meal, handling cancellations and refunds. Legal basis: performance of a contract.

To give the restaurant what it needs to seat you: your name, party size, phone number if you provided one, and any notes. Restaurants may keep their own private notes about your visits (for example dietary needs or a preferred table) to look after you better on your next visit. Legal basis: performance of a contract and legitimate interest in good hospitality.

Marketing from a restaurant only if you tick the box. At checkout you can choose to let the specific restaurant you are booking send you their news and what's on. That choice is per restaurant, off by default, recorded with a timestamp, and you can withdraw it at any time by emailing us or using the unsubscribe link in any message. Legal basis: consent.

Our own service messages (booking confirmations, reminders) are not marketing. We will only send you Halfseat marketing if you have opted in, and every email has an unsubscribe link.

The restaurant you book, as described above, and nothing more. We never sell your data, and restaurants are contractually barred from passing it on or using it beyond the purpose you agreed to.

Service providers who process data for us: Stripe (payments), Supabase (database hosting), Resend (email delivery), Vercel (website hosting), Google Analytics (only with your cookie consent) and PostHog (cookieless analytics, EU-hosted). Each is bound by a data processing agreement.

Booking records: 6 years, because tax law makes us keep transaction records. Marketing consents: until you withdraw. Push subscriptions: until you unsubscribe or your device revokes them. Waitlist entries: until we launch in your city and you decide, or you ask us to remove you.

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, object to or restrict how we use it, and take your data elsewhere. Email privacy@halfseat.com and we will respond within one month. Deletion requests remove your personal details from bookings and erase restaurant notes, opt-ins and notification subscriptions; anonymised transaction records are kept for the accounting retention period.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

Essential cookies make the site work (your session, your cookie choice itself). Google Analytics cookies are only set after you choose "Accept" in the cookie banner, choosing "Essential only" means no analytics cookies at all. Our PostHog analytics runs without cookies either way.