Privacy Policy

The protection of personal data is of great importance to waitrAI. We process personal data exclusively in accordance with the applicable data protection requirements, in particular the General Data Protection Regulation (GDPR) and the national provisions that apply in addition in each case.

Personal data is any information relating to an identified or identifiable natural person, such as name, email address, telephone number, customer histories, communication content, order details, invoice data, IP address or location and address data.

These details relate to the data processing for which waitrAI itself is the controller. Where waitrAI processes data exclusively on behalf of a restaurant, the respective restaurant is primarily responsible under data protection law for that part of the processing.

• We process personal data only to the extent necessary to provide our website and our SaaS services, to communicate with you or to fulfil legal obligations.
• We generally receive data directly from you, from the use of our systems, from the respective connected restaurant or from technically necessary responses from integration and payment providers.
• In the case of a restaurant’s end-customer data, waitrAI receives information in particular from WhatsApp messages, order and reservation processes, address and payment details and status responses.
• Special categories of personal data under Art. 9 GDPR are in principle not intended to be processed via waitrAI. Where such information is exceptionally contained in free texts, we process it only if this is legally permissible in the individual case and necessary for the specific purpose.
• We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Our AI functions only prepare content, for example an order in the chat or a menu that has been read in; it is accepted and approved by humans.

When you access our website, technically necessary access data is processed, in particular IP address, date and time of access, requested URL, browser and device information, language settings and referrer information. This processing is necessary in order to deliver the website securely, prevent misuse and ensure the stability of the systems.

Demo request: We store name, restaurant, email, telephone and message if you wish, and a referral code if you come via a referral. We use the information to contact you and arrange a demonstration (Art. 6(1)(b) GDPR). Internally, we record who is handling the request. If no contract is concluded, we delete the request 12 months after the last contact.

Waitlist: We store your email address and the name of your restaurant in order to inform you about the launch (Art. 6(1)(a) GDPR). The registration only becomes valid once you confirm it via the link in our confirmation email (double opt-in); as proof, we record the time of registration and confirmation and the version of the consent text. We send the emails via Resend. We delete unconfirmed registrations after 7 days. You can remove yourself at any time, for example by replying to one of our emails or by writing to hello@waitrai.app. We delete the list 3 months after the launch.

We do not use any analytics or advertising cookies and no tracking. We store only what is necessary for the website and the app (Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG):

If you come via a referral link, we keep the referral code only in the working memory of the open tab and without a cookie, so that it can be transmitted with a demo request. Once the page is reloaded or closed, it is gone.

When the waitrAI product is used, we process in particular account, contract, restaurant, menu, communication, order, reservation, billing, usage and support data. This includes, for example, details of restaurant profiles, menus, opening hours, delivery zones, customer messages, order contents, reservation requests, customer contacts, delivery addresses, payment status, tickets and system usage.

During onboarding and product configuration, files and media can be uploaded, for example menus, logos or other restaurant documents. This content is processed in order to extract master data, speed up the product configuration and technically provide your account or the restaurant profile.

Where end-customer data is processed via waitrAI for a restaurant, this is generally done to receive and process orders, reservations, status enquiries, follow-up questions, marketing opt-ins, loyalty or campaign responses, and to document the communication and make it traceable. In this context, waitrAI typically acts as the restaurant’s processor.

In addition, waitrAI processes its own contract and billing data of restaurant customers, for example for registration, authentication, plan management, Stripe subscriptions, the billing portal, invoice retrieval, DATEV exports, support and general customer care.

We use Google Places to search for restaurants that might be a good fit for waitrAI. In doing so, we store publicly stated business data: name of the business, address, telephone number and website. At trade fairs or visits, we sometimes photograph business cards; we read out the text with a language model from OpenAI. Our staff record notes of conversations, including as voice notes, which OpenAI converts into text.

The legal basis is our legitimate interest in presenting our offer to restaurants (Art. 6(1)(f) GDPR). We only write by email or WhatsApp if you have given your consent beforehand. We only get in touch by telephone where there is a specific reason. When we contact you for the first time, but at the latest after one month, we inform you of the source of the data.

You can object to this use at any time, for example by email to hello@waitrai.app. We then delete your data and only note that you no longer wish to be contacted. If no contract is concluded, we delete the data 12 months after the last contact.

waitrAI processes data via various communication channels and API interfaces. These include in particular website forms, email communication, authentication and product APIs, WhatsApp and messaging interfaces, support tickets and responses from payment and platform providers.

In live restaurant operations, waitrAI may process text, voice, status and interaction data from messaging channels. This includes in particular incoming WhatsApp messages, buttons, list interactions, audio content, metadata, delivery or status notifications and order and reservation information derived from them.

When voice content is processed, audio files or audio tracks may be transmitted to technical service providers for transcription. For voice input in the dashboard, your browser transmits it directly to OpenAI for this purpose. We also use APIs for billing, for sending transactional emails, for the AI-assisted structuring of content and for the technical processing of files, restaurant and usage data.

• Master and contact data, e.g. name, restaurant name, telephone number, email address, role, login and account information
• Contract and billing data, e.g. plan, subscription status, Stripe customer number, invoice retrieval, payment and transaction information
• Restaurant and product data, e.g. menu content, prices, extras, variants, opening hours, delivery zones, logos, uploaded files
• Communication data, e.g. chat content, WhatsApp messages, support requests, opt-in/opt-out details, status notifications
• Order and reservation data, e.g. order items, times, customer name, telephone number, delivery address, reservation details and notes
• Marketing and referral data, e.g. waitlist data, referral codes, broadcast opt-ins, campaign responses and preference data
• Technical usage and log data, e.g. IP address, device and browser data, access data, error and trace information
• Address and geodata, to the extent necessary for delivery zones, delivery logic, route or availability checks
• Sales data, e.g. publicly stated business data of restaurants, details from business cards and notes of conversations

• Provision and secure operation of the website and SaaS platform
• Registration, authentication, account management and performance of the contract
• Set-up and management of restaurant profiles, menus, uploads and product configurations
• Receipt, processing and documentation of orders, reservations, status notifications and customer communication
• Provision of AI-assisted support functions such as structuring, transcription, text generation, classification and retrieval support
• Performance of billing, payment, refund, reporting and export processes
• Support, error analysis, prevention of misuse, stability monitoring, logging and IT security
• Approaching restaurants in sales on the basis of publicly stated business data
• Sending product-related information, optional marketing communications, waitlist updates or referral-related communications, to the extent legally permissible or consented to
• Fulfilment of statutory documentation, retention and compliance obligations

For each purpose, we state the legal basis. Where we rely on legitimate interests (Art. 6(1)(f) GDPR), the interest is stated alongside.

Where waitrAI processes data on behalf of a restaurant, the processing is additionally based on a processing relationship under Art. 28 GDPR. In these cases, the legal basis under data protection law for the primary purpose in relation to the end customer concerned generally lies with the respective restaurant.

For the account and the contract, we need your email address and a password, the details of the restaurant required for orders (such as name, address and WhatsApp number) and the payment details that Stripe requests. Without this information, we cannot conclude a contract or provide waitrAI. For a demo request, we need your name, restaurant and email address in order to reply to you. All other information is voluntary. You are not legally obliged to provide us with data.

Personal data is only transmitted to recipients who need it to fulfil the respective purpose. In doing so, we distinguish between controllers, processors and sub-processors.

• Hosting, database, authentication, storage and edge infrastructure, in particular via Supabase
• Hosting of the website and web app via Vercel
• Messaging and communication providers, in particular Meta or the WhatsApp Business API for message and status processing
• AI and transcription providers, in particular OpenAI for text, audio, transcription, embedding and structuring tasks
• Payment and billing providers, in particular Stripe for SaaS subscriptions and the billing portal, and PayPal for end-customer payment processes and refunds
• Transactional email service providers, in particular Resend for sending certain report or system emails and the confirmation and launch emails of the waitlist
• Map, address or geocoding services, to the extent used for delivery zones, address validation or cartographic functions, such as Google Maps or OpenStreetMap/Nominatim
• Google (Places API) for searching for publicly stated business data of restaurants, such as name, address, telephone number and website, as part of our sales activities
• The respective integrated restaurant, to the extent that communication, order, reservation or status data is assigned to that restaurant
• Advisers, authorities, courts or other bodies, to the extent that we are legally obliged to do so or this is necessary to enforce rights

Payment providers such as Stripe or PayPal process certain data partly as controllers in their own right, in particular to the extent that they are subject to regulatory, billing-related or anti-money laundering obligations.

Some recipients are located outside the EU or transfer data to third countries. For each of these recipients, we state the basis of the transfer:

You can request a copy of the safeguards at the addresses given in the Contact section.

We store personal data only for as long as is necessary for the respective purpose or as statutory retention obligations exist. The data is then deleted, anonymised or restricted in its processing, where deletion is not immediately possible for legal or technical reasons.

• We store marketing consents and proof of opt-in/opt-out until withdrawal or objection and beyond that, to the extent that statutory proof of the lawfulness of the communication remains necessary.
• We generally store restaurant-related uploads, menu and configuration data until they are deleted by the restaurant, until they are replaced by updated content or until the end of the contractual relationship.
• We generally store a restaurant’s end-customer data on its behalf in accordance with its instructions, within the scope of the contractual relationship and taking into account any statutory retention obligations of the restaurant.

Subject to the statutory requirements, data subjects have in particular the following rights:

• Right of access under Art. 15 GDPR
• Right to rectification of inaccurate data or completion of incomplete data under Art. 16 GDPR
• Right to erasure under Art. 17 GDPR
• Right to restriction of processing under Art. 18 GDPR
• Right to data portability under Art. 20 GDPR
• Right to object to certain processing under Art. 21 GDPR
• Right to lodge a complaint with a data protection supervisory authority under Art. 77 GDPR

The authority competent for us is the Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland. However, you can lodge a complaint with any data protection supervisory authority, in particular in the country in which you live or work or in which the infringement took place, for example with the data protection authority of your German federal state (Art. 77 GDPR).

If waitrAI processes data exclusively as a processor for a restaurant, we may have to forward requests to the responsible restaurant so that the rights concerned can be fulfilled properly and completely.

You can withdraw any consent you have given at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected. The withdrawal can be sent informally to the addresses given in the Contact section, unless a more direct way of withdrawing is provided within the respective channel.

Marketing communication is to be distinguished from operational service and contract communications. Operational communications concern, for example, registration, login, product use, order or reservation status, billing, support or security-related notices. We send such communications to the extent that they are necessary for the performance of the contract or for secure operation.

If you sign up for waitlist updates, product-related information, referral programmes or other optional marketing communication or give corresponding consent, we process the data required for this on the basis of your consent or another applicable legal basis.

If restaurants use marketing-related broadcast or campaign functions via waitrAI, the respective restaurant is generally the controller for the specific sending to end customers. In this respect, waitrAI typically processes consent and communication data on behalf of the restaurant and documents opt-in, opt-out or preference signals to the extent necessary for execution or proof.

waitrAI uses appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure, alteration or destruction. These include in particular:

• encrypted transmission of data, in particular via TLS
• role- and permission-based access concepts
• separation of product, administration and integration access
• backups, redundancies and measures to restore availability
• logging, monitoring and misuse detection
• principles of data minimisation, purpose limitation and need-to-know access

More on this can be found on the page Data protection & security.

We reserve the right to amend this privacy policy with effect for the future if legal, technical or organisational conditions change, new functions are introduced or this is necessary to describe our data processing more precisely. The version published on this page at the relevant time is authoritative.

This is version 2026-11.

If you have any questions about data protection at waitrAI or wish to assert rights under the GDPR, you can contact us at any time:

Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority. The authority competent for waitrAI is in particular Prezes Urzędu Ochrony Danych Osobowych (UODO), Poland. You can also contact the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.