Privacy Policy
How we collect, use, and protect your personal data.
Last updated: 29 August 2026
1. Who we are
OpenALaCarte Ltd («we», «our») operates openalacarte.com. This policy explains how we collect, use, and protect personal data when you use our platform.
2. Data we collect
We collect information you provide directly: name, email address, phone number, and payment details. Where you tell us about allergies, intolerances or dietary requirements — on an order, a booking or your diner profile — that is data concerning health, and therefore special-category data under Article 9 of the UK/EU GDPR. Giving it is your choice; we pass it to the venue so they can prepare your order safely. We also collect usage data (pages visited, features used) and technical data (IP address, browser type, device identifiers) automatically via cookies and similar technologies. If you send us feedback through the site, we store your rating, the topics you pick, any comment you write, and the page you were on — linked to your account if you are signed in. Where you have accepted non-essential cookies we also record which campaign or referring site first brought you to us, and which A/B test group you were placed in. Giving us your name, email and payment details is a contractual requirement: without them we cannot create your account or complete an order or booking. Everything else — allergen and dietary information, a phone number, marketing preferences — is optional, and declining costs you nothing beyond the feature it powers.
3. How we use your data
We use your data to provide and improve the platform, process bookings and orders, send transactional communications (booking confirmations, order updates), and — with your consent — promotional messages. We do not sell your personal data to third parties. We also keep a record of no-shows and late cancellations, so a venue can decide whether to accept a future booking. Some of that record is shared across venues on the platform rather than held by the one you did not turn up to. A person makes that decision, not a computer, and you can ask us about an entry or object to it at privacy@openalacarte.com.
4. Legal bases (GDPR)
Our processing relies on: contract performance (to fulfil bookings and orders), legitimate interests (platform security, fraud prevention, product improvement), consent (marketing emails, non-essential cookies), and legal obligation (tax and accounting records). Allergen and dietary information is special-category data, so it additionally relies on your explicit consent under Article 9(2)(a): supplying it is optional, supplying it is your explicit consent to share it with the venue, and you may withdraw that consent at any time by removing it from your profile or emailing privacy@openalacarte.com — though we cannot withdraw it from an order already sent to a kitchen.
5. Data sharing
We share your data with restaurants you book or order from (necessary to fulfil your reservation), our payment processor (Stripe), and messaging, error-monitoring and infrastructure providers. Where you use location-based search, your browser sends your approximate coordinates to the OpenStreetMap Foundation's geocoding service to turn them into a place name. Analytics is self-hosted and cookieless — no third-party analytics provider receives your data. The full list of providers, what each one processes and where, is published at /legal/dpa.
6. International transfers
Some of the providers we rely on are based outside the UK and the European Economic Area, principally in the United States: our payment processor, our messaging and error-monitoring providers, and the AI provider behind assisted features. Where personal data is transferred to a country not covered by UK adequacy regulations, the safeguard relied on is the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum. We maintain a register recording, for each provider, what it processes, where it processes it, and which safeguard applies — and, where an instrument has not yet been executed, recording that too rather than implying otherwise. You can ask for the current position, and for a copy of the safeguards, at privacy@openalacarte.com.
7. Retention
We retain account data for as long as your account is active, plus 3 years after closure for legitimate interest purposes. Transaction records are kept for 7 years to comply with applicable tax law. You may request deletion at any time subject to these legal obligations. Feedback you submit through the site is kept for as long as it remains useful for product decisions; if you close your account it is unlinked from you and retained only in anonymous form.
8. Your rights
Under GDPR you have the right to access, rectify, erase, restrict, and port your personal data, as well as to object to certain processing. To exercise any right, email privacy@openalacarte.com. You may also lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk). Where we rely on your consent — allergen and dietary information, non-essential cookies, marketing — you can withdraw it at any time, and withdrawing is as easy as giving it: from your account settings, the cookie preferences link in the footer, or the unsubscribe link in any marketing email. Withdrawing does not affect processing carried out before you withdrew.
9. Security
We use TLS encryption in transit and AES-256-GCM at rest for sensitive credential fields, and follow OWASP security guidelines. Access to personal data is restricted to authorised personnel on a need-to-know basis.
10. Contact
Data controller: OpenALaCarte Ltd · Registered in England and Wales, company no. 17391898 · Registered office: 128 City Road, London, EC1V 2NX, United Kingdom. Email: privacy@openalacarte.com.
Questions about this document? Email legal@openalacarte.com