Privacy Notice

Marques Holdings B.V. (KvK 90484460) controls account, website and its own business data. Restaurants normally control their guests’ booking and CRM data; AlpineTable processes that data on their behalf. For privacy questions or rights requests, email hey@pedromarques.io.

We collect account identity and login data; restaurant profile, ownership-claim and operational data; booking and guest contact details; menus, photos and messages submitted to the service; integration activity; consent and email-delivery records; and technical information such as IP address, browser, referrer and security events.

We use data to create and secure accounts, verify restaurant ownership, provide restaurant pages and bookings, deliver transactional emails, operate requested integrations, prevent abuse, support users, improve the service, and meet legal obligations. Our legal bases are performance of a contract, legitimate interests in operating and protecting the service, consent where requested, and compliance with law.

Restaurants use AlpineTable to manage their own guests. The restaurant decides why guest booking and CRM data is processed and is normally the controller for that data; AlpineTable acts as its processor. Restaurants must provide their own guest-facing notice and use marketing features only where they have a valid legal basis.

We use service providers only where needed to run AlpineTable. These currently include Railway for application and database hosting, Resend for email, Cloudflare for image storage and bot protection, Anthropic and OpenAI for requested AI features, and Kapso, WhatsApp and Telegram for integrations a restaurant chooses to connect. Some providers may process data outside the EEA using applicable transfer safeguards. With your consent, PostHog (hosted in the EU) provides website and product analytics.

With your consent, we use PostHog analytics cookies to understand how the website and backoffice are used. PostHog only loads after you accept analytics in the banner, and you can change your choice at any time on this page. When you are signed in to the backoffice, we link this usage to your account (user ID, name and email). We never send guest names, emails, phone numbers or booking notes to PostHog, and we remove access tokens from booking links. PostHog also receives technical records of AI feature use (model, timing and token counts) linked to the staff account that used the feature, without prompts or replies. Cloudflare Turnstile is used as an essential security measure on signup, not for advertising.

Each restaurant sets and discloses how long it keeps guest data after a visit; AlpineTable follows its documented instructions. When a restaurant account closes, our standard maximum for its guest data is six months from closure, allowing export and orderly deletion, unless law requires longer retention. Seasonal Pause Mode does not close an account. Verification tokens expire after 30 minutes. Security, audit, transaction and legal records may be retained longer where necessary.

Depending on your location, you may ask to access, correct, export, restrict, object to, or delete your personal data, and withdraw consent at any time. Email the address above. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or your local supervisory authority.

Passwords are hashed. New restaurant listings remain private until email and restaurant-ownership checks are complete. No internet service can guarantee absolute security; please report suspected account misuse immediately.

We may update this notice as AlpineTable changes. Material changes will be shown on the service and the effective date above will be updated.

If you choose to provide booking notes, they may include allergy or other health information. The restaurant and AlpineTable acting on its behalf use these details to handle the booking only with your explicit agreement. You can leave notes blank or withdraw consent by contacting the restaurant. New booking notes are not automatically copied to a long-term guest profile.

Some restaurants ask for a card to secure a booking against no-shows. You enter your card in a form provided by Stripe, the restaurant’s payment provider, and Stripe stores it in the restaurant’s own Stripe account; AlpineTable never receives your card number. No money is taken when you add a card. AlpineTable keeps the card brand and last four digits, the policy you accepted, and when and from which IP address you accepted it, so the restaurant can show what was agreed. The restaurant may charge the amount shown before you booked if you do not come or cancel late, and it decides each charge. Saved cards are removed once they are no longer needed, at the latest 7 days after the booking. Stripe processes payment data under its own privacy policy (stripe.com/privacy).