Privacy Policy
1. Who we are and the role we play
Regulars Reservations is reservation and floor-management software that Regulars Marketing LLC (“Regulars,” “we,” “us”) provides to restaurants. When you book a table through a restaurant’s booking page, your reservation is with that restaurant. The restaurant is the controller of your information. Regulars processes that information as the restaurant’s service provider, only on the restaurant’s behalf and only to run the reservation service described in this policy.
Guest data belongs to the restaurant. Every restaurant can export its complete guest list at any time, in one click, free of charge, and that access is never conditioned on payment status. We do not sell guest data. We do not rent it, trade it, or share it across restaurants.
You never create an account with us. There is no diner login, no diner app, and no cross-restaurant diner profile. Each restaurant’s guest records live in that restaurant’s own tenant, walled off from every other restaurant on the platform.
2. What we collect and why
We collect only what the reservation service needs.
When you book:
- Name. So the restaurant knows who the reservation is for.
- Phone number (required for online booking). It identifies your reservation, lets the host reach you about it, and carries reservation text messages where you have received the disclosure described in Section 3.
- Email address (optional in normal operation). When provided, it receives a copy of every reservation message and serves as the fallback channel if you opt out of texts. During a restaurant’s initial text-messaging registration window, email is required so that your confirmation has a working channel.
- Reservation details. Party size, date and time, seating preferences, accessibility needs, and any notes you add.
As you dine with a restaurant over time, the restaurant may maintain:
- Visit history. Visit counts, last visit date, and no-show counts, so the restaurant can recognize and serve its regulars.
- Preferences and notes. Seating preferences, accessibility needs, and host notes the restaurant records about how to serve you well.
- Special occasions. If you or the restaurant record a birthday or anniversary, we store the month and day only. We never store a birth year, so occasion records cannot reveal your age.
Records the service generates:
- Consent records. Each consent event is stored with its channel, class, basis, the exact disclosure text and version you saw, its source, and a timestamp. These records are append-only and exist to prove what you agreed to and when.
- Message logs. A log of reservation and other messages sent on the restaurant’s behalf, including delivery status, so problems can be diagnosed and consent rules enforced at the moment of sending.
- Service event records. Operational records of reservation activity (booked, seated, cancelled, and similar events) that make the reservation book reliable and auditable.
We collect nothing else about you. There is no advertising tracking, no data enrichment from outside sources, and no profile that follows you between restaurants.
3. Text messages, consent classes, and STOP
Reservation messaging is built on explicit consent classes, enforced in software at the moment each message is sent.
Reservation service messages (transactional). When you provide your phone number to book online, a disclosure is shown beside the confirm action stating that you agree to receive text messages about that reservation. These messages are strictly about your reservation: confirmation, reminders, table-ready notices, and similar updates. They never contain promotional content. The exact disclosure text you saw is version-stamped in your consent record. While a restaurant’s text messaging is still being provisioned, these updates arrive by email instead of by text.
Marketing messages. Marketing texts and emails are sent only with your prior express written consent, given through a separate control that is unchecked by default, is never bundled with booking, and is never a condition of booking. That control appears only on booking pages of restaurants that have purchased the marketing service; at every other restaurant no marketing consent is requested and none is captured. Guests imported from a restaurant’s previous system never inherit marketing consent.
Opting out. Reply STOP to any text message and texting to your number is suppressed immediately. Your reservation remains valid; reservation updates fall back to email if you provided one, and otherwise the host is flagged to confirm by phone. Message and data rates may apply to texts you receive; frequency varies with your reservation activity.
4. Cookies
The booking page uses a minimal, functional set:
- A booking session cookie, strictly necessary to complete your reservation.
- Cloudflare Turnstile, a bot-protection check that loads only when traffic looks abusive, to keep booking availability honest for real diners.
There are no advertising cookies, no analytics trackers, and no third-party marketing pixels on the booking flow.
5. How long we keep information
Retention is governed by our internal retention schedule. In summary:
- Reservation and visit records are retained as the restaurant’s operational history.
- Consent records are retained for the life of the guest record plus a statutory margin, with a five-year minimum, to substantiate consent.
- Encrypted backups are kept for 30 days, and the database’s own point-in-time recovery window is 7 days.
- Export files are generated on demand and are not retained on our servers.
- We do not store the text of the messages we send you. Each message is composed from your live reservation record at the moment it is sent. The messaging provider that delivers it keeps its own record under its own retention policy.
- Links we send you expire: the link that manages your reservation lasts 30 days, and a feedback link lasts 30 days.
6. Your rights and how to exercise them
Because each restaurant controls its own guest data, requests about your information (access, correction, deletion, and any rights your state’s law provides) go to the restaurant you dined with. Contact the restaurant directly; its contact details appear on its booking page. Regulars assists every restaurant in fulfilling these requests, and if you contact us first at [email protected] we will route your request to the right restaurant and support its response.
What deletion means here, in plain terms. The reservation book keeps a permanent record of what happened in the dining room: that a table was booked, seated, and finished, on a date, for a party of a certain size. That record is what makes the book trustworthy, and it is the restaurant’s own account of its own nights. When you ask to be deleted, we remove YOU from it: your name, phone number, email address, notes, preferences, and any special occasion we hold are erased and cannot be recovered, and what remains is a booking with nobody’s name on it. We do not rewrite history, and we do not keep you inside it.
Two consequences we would rather state than bury. First, we keep the record of the permissions you gave or withdrew, because it is the proof that we were allowed to contact you, and that record holds no contact details of its own once your details are erased. If you told us to stop texting you, we keep the minimum needed to keep honoring that. Second, our encrypted backups are kept for 30 days, so an erasure lands in the live system immediately and is re-applied to anything restored from an older copy.
7. Children
The booking service is directed at adults making restaurant reservations. We do not knowingly collect information from children under 13. If you believe a child has provided information through a booking page, contact us at [email protected] and we will work with the restaurant to delete it.
8. Service providers
We use a small set of infrastructure providers to run the service, each bound to process data only for us: DigitalOcean (hosting and database), Postmark (email delivery), Twilio (text messaging), Cloudflare (network security and bot protection), Sentry (error monitoring), and Stripe (payment processing, used where a restaurant enables deposits and for billing the restaurants themselves). Messaging providers receive your phone number or email address solely to deliver the messages described above.
9. Security
We protect guest data with tenant isolation enforced on every server query, role-based access control checked server-side, encrypted backups stored off the primary provider, signature verification on all provider webhooks, rate limiting and bot protection on public endpoints, and tokenized reservation-management links that are hashed at rest, scoped, and expiring. Bulk guest export requires an authenticated owner or manager session, which a host’s device credential cannot satisfy, and every export is recorded in the restaurant’s own audit log. We work to keep phone numbers and email addresses out of our error telemetry, and we do not record diner sessions.
10. Changes to this policy
When this policy changes, we will post the new version with a new effective date and version number. Material changes will be communicated through the restaurants we serve. Prior versions remain available on request.
11. Contact
Regulars Marketing LLC
6521 Plowman Rdg, Harrisburg, Pennsylvania 17112
[email protected]
For questions about a specific reservation or a restaurant’s guest records, contact that restaurant directly.