Vilanova Reserva Privacy Policy

Last updated: September 10, 2026

1. What matters, in ten lines

This summary does not replace the rest of the document, but it is what you really need to know:

• Booking is free for you and we do not sell your data to anyone.
• You can book without creating an account. We only ask for your name and phone number.
• When you book, your details go to the restaurant, which can only use them to serve you.
• We do not track you across other websites and we do not use your data for advertising.
• We do not know where you are. The app never asks for your location.
• You sign in with a code we email you, or with your Google or Apple account. Never with a password.
• Your reviews are published under your account name.
• We measure how the app is used, but only if you give us permission.
• You can delete your account from inside the app, without writing to us.

2. Who handles your data

Controller: Emmanuel Godino Arnaldo, trading under the business name Intragents Tax ID (NIF): 48029809J Address: Carrer de la Llibertat 30, 08800 Vilanova i la Geltrú (Barcelona), Spain Contact email: info@intragents.com Website: www.vilanovareserva.com

If you have any question about your data, write to that address. We answer ourselves, not a form.

We have not appointed a Data Protection Officer, because we do not fall into any of the cases that require one. If that changes, we will publish it here.

3. Who this applies to

Three kinds of people:

• Diners. Anyone using the app or the website to browse restaurants and book a table, with or without an account.
• Restaurant staff. Anyone using their venue’s management panel.
• Anyone who writes to us. Even if they never use the service.

Almost all of this document is about the first group. Section 12 is for the second.

4. Where your data comes from

Only four places, and none of them is a purchased database:

• From you, when you book, create an account, fill in your profile or write a review.
• From Google or Apple, and only if you choose to sign in with them. They confirm it is you and give us your email and your name. Nothing else.
• From normal use of the app or the website, which generates technical records.
• From the restaurant, when it marks in its book that a booking did not show up.

5. Exactly what data we handle

5.1 If you book without an account

• Your name.
• Your phone number, in international format.
• Your email, if you give it to us. It lets you retrieve the booking later and lets us ask you for a review afterwards.
• The number of diners, the date and the time.
• The note you write for the restaurant, if you write one.

Booking as a guest does not create an account. If you later create one with that same email address, your earlier bookings are linked to it.

If you left us your email, once your booking is over we may send you a message asking you to review the restaurant. You can ignore it with no consequences.

5.2 If you create an account

• Your email address. It is the only thing we truly need.
• Your display name. The one shown on your reviews.
• Your phone number.
• Your profile picture, if you upload one.
• The app language. It is available in Spanish, Catalan and English.
• The date you accepted these texts. We keep a record of when you accepted the privacy policy and the terms of use, because we have to be able to prove it.

We never use passwords. You can choose between three ways in, and none of them has a password:

• A one-time code we send to your email.
• Your Google account.
• Your Apple account, on iPhone.

If you sign in with Google or Apple, they check that it is you and give us your email and your name. Nothing else: not your contacts, not your calendar, not your photos, not what you do elsewhere. Your Google or Apple password never passes through us, we neither see it nor store it.

Apple lets you genuinely hide your email. If you choose that option when signing in, Apple gives us one of its own addresses that forwards to yours. That is the one we will see and the one the restaurant will see. Everything works the same, your booking confirmation still reaches you, and we still do not know your real email address.

You can sign in one day with the code and another with Google: if it is the same email, it is the same account and nothing is duplicated. And if you started with the code, you can add Google or Apple later from your profile.

5.3 Your preferences, if you fill them in

• Cuisines you are interested in.
• Dietary needs.
• The town where you usually book.
• How many people you usually go with.
• Restaurants marked as favourites.
• Which notifications you want and which you do not.

All of this is optional. The app works just the same if you leave it blank.

A word of warning about allergies, and we will be direct about it. If you write an allergy, an intolerance or a diet for religious reasons in your dietary needs or in the booking note, that is data given special protection by law. We handle it because you choose to write it and because the restaurant needs it to look after you properly, and we pass it to that restaurant and to nobody else. If you would rather not write it down, you can tell them by phone when you arrive. Please do not write any health information there that is not needed for the meal.

5.4 Your bookings

For each booking we keep the restaurant, the date, the time, the number of diners, your contact details, your note, the state it ended in and, if you cancel it, when you cancelled and from where.

We also keep a record if the restaurant marked that you did not show up. That mark is theirs and only they can see it, in their own book. We do not share it with other restaurants and we do not keep any general list of difficult customers.

5.5 Your reviews

• The rating from one to five stars.
• The comment, if you write one and if your review allows comments.
• The booking it relates to.
• The name you signed it with, frozen at the moment of publication.
• Whether it is published or held back, and since when.

Your review is published under your account name. There are no anonymous reviews. That name is frozen when you publish, and you can only change it once every ninety days. Internally we keep the history of the names your account has used, so we can detect fraudulent use of reviews.

How reviews are processed, which ones count towards a restaurant’s rating and which do not, is set out in full in the Terms of Use, under “How reviews work”. We do not repeat it here so as not to tell it twice and in two different ways.

5.6 Technical data

• In the app: the device type, the operating system and the app version, plus an identifier so we can send you notifications if you turn them on.
• On the website: the normal data from any visit, such as the IP address, the browser and the pages viewed. We use it to keep the website working and secure. The website’s forms are protected against bots by a Cloudflare service called Turnstile, which checks that whoever fills the form in is a person. For that, Cloudflare sees your IP address and technical data about your browser. That is not analytics and it is not used to profile you.
• On your own device we store your signed-in session, so you do not have to request a code every time.

When something breaks. We use a system that alerts us to errors and crashes (Sentry). When the app or the website fails, we receive a technical report with the device, the version, the screen you were on and the error. We need it to fix the problem. We do not record your screen or what you type.

5.7 Push notifications

There are two kinds and they work differently:

• Local reminders. They are scheduled inside your own phone. No data leaves your device for these.
• Notifications sent from our server (OneSignal), such as your booking reminder, the request to reconfirm it the day before, or the invitation to leave a review. For these we store a device identifier linked to your account.

Both kinds can be turned on and off whenever you like, from the app settings or from your phone’s own settings. If you book as a guest, without an account, you do not receive push notifications, because there is no device linked to you.

5.8 Product analytics

This works differently in the app and on the website.

In the app we measure how it is used so we know what works and what does not: which screens are viewed, where a booking is abandoned, what fails. We do this with PostHog, on its European Union servers. The important part:

• We only do it if you give us permission, and you can withdraw it whenever you want.
• It ships switched off. Nothing is sent until you say yes. It is not that it turns off when you ask: it does not start until you authorise it.
• We do not record your session. There is no screen replay.
• We do not automatically capture everything you tap. We only measure the specific moments we have decided to measure.
• We do not use it for advertising or to decide which restaurant appears first for you.

On the website we measure nothing. Today there is no analytics tool installed at all: no PostHog, no Google Analytics, no social media pixels, nothing of the sort. If we ever add one, we will ask you first, with a notice where accepting and rejecting cost exactly the same, and nothing will be switched on until you say yes.

What does run without asking your permission, and why. Two things, and neither of them measures how you use the service: the system that alerts us to errors (section 5.6) and the one that sends notifications to your phone if you have them turned on (section 5.7). The first is needed so the app does not stay broken; the second only works if you have turned notifications on. Neither is used to profile you or for advertising.

5.9 Device identity, against fake reviews

So we can tell whether a review comes from a real device, we use the identifier provided by the phone’s own operating system: identifierForVendor on iPhone and ANDROID_ID on Android.

What you should know about this:

• It asks for no permissions and adds no screen.
• That identifier is ours and ours alone. It cannot be used to recognise you in other apps or on other websites, and we do not give it to anyone.
• We do not use it for advertising. We use it so a restaurant’s rating cannot be sunk by someone creating accounts.

We do not use browser fingerprinting. Neither on the website nor in the app.

5.10 What we do NOT do

We say this because it counts as much as everything above:

• We do not know where you are. The app never asks for your location, and it has no map embedded inside it.
• We do not sell or rent your data.
• We do not use your data for advertising, and we do not share it with advertisers or social networks.
• We do not track you across other websites and we do not buy profiles about you.
• We do not record your screen or your keystrokes.
• We do not make any automated decision with legal or similarly significant effects on you. The filter that checks reviews before publishing them acts on a text, not on you, and you can challenge it by writing to us.
• We do not ask for, and do not want, your bank details. Booking is not paid for.

About featured restaurants. A restaurant may pay to appear featured inside the service. When that happens you will see it marked as sponsored, and the Terms of Use explain how the list is ordered. That placement is not decided using your data: it is the same for everyone, and it does not depend on what you have looked at, what you have booked or who you are.

6. What we use each piece of data for, and on what legal basis

You can object to the processing that relies on our legitimate interest. Section 10 explains how.

7. Who else sees your data

7.1 The restaurant you book with

It sees your name, your phone number, the number of diners, the time and your note. It needs this to hold the table for you.

The restaurant may only use that data to handle your booking. It cannot add you to a mailing list, call you to offer you anything, or pass your details to anyone. It has signed a contract with us saying so, and if it breaches that contract it can be removed from the platform.

It only sees bookings made at its own venue. No restaurant sees your activity at another.

7.2 Companies that provide services to us

They work on our instructions, under contract, and cannot use your data for anything else. Some are involved only in the app and others only on the website:

• Supabase. Hosts the database, handles code-based sign-in and stores the photos. It is the central piece and serves the app and the website alike. Real data is on European Union servers, in Frankfurt.
• Contabo. Hosts the website, on European Union servers, in France.
• Cloudflare. Protects the website’s forms against bots. It sees your IP address and technical browser data when you fill one in. It is a United States company.
• Resend. Sends the service emails, such as your booking confirmation or the review invitation.
• OneSignal. Sends push notifications to your phone. App only.
• Sentry. Collects the app’s error reports so we can fix what breaks. It is not installed on the website.
• PostHog. Measures how the app is used, on its European Union servers, and only if you have given us permission. It is not installed on the website.
• Expo. Builds and distributes the app releases, and handles local notifications. App only.
• Apple and Google. Distribute the app in their stores. And, if you choose to sign in with your Google or Apple account, they also check that it is you. In that they are not working on our behalf: they act on their own account, under the terms you accepted with them the day you created that account. We only receive the result.

7.3 If the restaurant uses another booking system

Some restaurants have their own system. In those cases we take you to it to finish the booking, and we tell you before you leave. From that point on, whatever you type there is handled by that company under its own terms, not by us.

7.4 When you tap “directions”

Apple Maps or Google Maps opens with the venue’s address. We send them no data about you and we have no map embedded inside the app, but from that moment you are in their app and their privacy terms apply.

7.5 Nobody else

Beyond the above, we only hand over data if a judge, the police or a public authority with the right to ask requires it.

8. If your data leaves Europe

Everything of ours is in the European Union. The database, in Frankfurt. The website, in France. The app analytics, when you authorise them, on European servers as well.

Some services are provided by United States companies: the Apple and Google stores and their sign-in system, email delivery, push notifications, error reports, the website’s bot protection and the tools the app is built with. Where that means data leaving the European Union, it is done with the safeguards European law requires, which today are the adequacy framework with the United States or the European Commission’s standard contractual clauses.

9. How long we keep things

• Your account and profile: for as long as you keep it open.
• Your bookings: while you use the service, and afterwards blocked for the legal claim periods.
• Your published reviews: while your account exists and the restaurant is on the platform.
• Reviews held back by the filter: they stay stored. You can still see them, and the restaurant sees them in its management panel too, but they are not published: they do not appear on the venue’s page and they do not count towards its rating. We do not delete them.
• The notification identifier: until you turn notifications off or uninstall the app.
• Error reports and technical logs: a short period, as long as is needed for security and for fixing faults.

If you delete your account, and you can do that yourself from inside the app, we delete your profile, your preferences and your reviews, which stop being published. Bookings that have already happened are anonymised: your name is removed, because the restaurant needs to know how many people came through its doors. Future bookings are kept only as long as they are still needed to run the service. And we keep blocked whatever the law requires us to be able to prove, such as the fact that you accepted these texts.

If you used to sign in with Google or Apple, deleting your account also cuts that link: we stop asking them anything about you. Whatever they keep on their side is managed from your Google or Apple account settings, not from here.

10. Your rights

You can ask us, free of charge and at the email address in section 2, to:

• See what data we hold about you.
• Correct anything that is wrong.
• Delete it.
• Take it elsewhere in a file.
• Restrict what we do with it while something is under discussion.
• Object to the processing we carry out on the basis of legitimate interest.
• Withdraw your permission for notifications, analytics or news, whenever you want and without giving reasons. Withdrawing it does not affect what we did before.

We answer within one month. If the case is complicated we will tell you, and we may take up to two months more, which is what the law allows.

You can do almost all of this yourself from inside the app, under Account, Privacy and data, without writing to us. The delete-account button is there too.

If you think we are getting it wrong, you can complain to the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, aepd.es). We would appreciate hearing from you first, but you are under no obligation to do so.

11. Minors

You must be 18 or over to hold an account on Vilanova Reserva and to book. If we find an account belonging to a minor, we close it and delete their data. If you are a parent or guardian and believe a minor in your care has an account, write to us and we will sort it out.

A minor can of course come and eat as part of a booking. What they cannot be is the holder of the account that makes it.

12. If you work at a restaurant

If you use your venue’s management panel, we handle your name, your work email, your role and a record of what you do inside the panel. We do this to provide the service your company has contracted and so we can tell who did what.

The diner data you see in your panel is not yours or your restaurant’s to use for anything else: it is there to handle those bookings and nothing more. Your company signs the contract with us that governs that use.

If you apply for your restaurant to join the platform. The website’s sign-up form collects the business’s tax details, a contact, the address, the town and who will administer the account. We use them to check the business exists and decide whether it joins. A restaurant is not published automatically: the application waits for us to review it. The form is protected against bots and a box has to be ticked accepting these texts; if it is not ticked, the application is not sent. If the restaurant does not join in the end, we keep the application only as long as we need it to justify the decision, and then we delete it.

13. Cookies and storage

In the app there are no cookies. We store your signed-in session and your settings on your phone, in the system’s secure storage. It is erased when you uninstall.

On the website there are only necessary cookies: two to keep you signed in and one to remember which town you are looking at. They cannot be switched off, because without them there is no service, and that is why the law does not require us to ask your permission for them. On top of those there may be cookies set by the system that protects the forms against bots, which are also security cookies.

There are no analytics or advertising cookies on the website today. That is why you will not see a cookie banner: there would be nothing to accept or reject. The day we add one, the banner will appear and nothing will be switched on until you say yes.

The full detail is in the Cookie Policy.

14. Security

We encrypt communications, we store no passwords because we do not use them, and the database has rules that stop one account seeing another’s data. Access to the data is limited to the people who need it to do their job.

None of this is an absolute guarantee, and anyone telling you otherwise is lying to you. If something ever happens that puts your data at risk, we will tell you, and we will notify the Agency where we are required to.

15. Changes to this policy

If we change it, we will publish the new version here with its date. If the change is significant, we will tell you inside the app or by email before it takes effect. We do not change the rules through the back door.