Security and Privacy

• Accounts use email and password, with email verification before full access.
• Password reset runs through a time-limited link sent to the verified address.
• Each workspace has owner, manager and staff roles with different permissions.
• Invitations are per-email, expire, and can be revoked.
• Signed-in users can see their active sessions and revoke them.
• Shared restaurant tablets can be marked as shared, which activates a restricted Host View with a PIN to leave it.

• The application runs on managed cloud infrastructure with an EU-hosted primary database.
• Traffic is encrypted in transit with TLS; the database and file storage are encrypted at rest.
• Access to data is enforced at the database level so a workspace can only read its own rows.
• Backups and restore procedures are operated by the hosting provider.

We collect what is needed to run reservations: account details for staff, and name, contact details and booking details for guests. We do not sell data, and data is not used to train third-party AI models. Full details are in the Privacy Policy and the Guest Privacy Notice.

Card data is handled entirely by our payment provider. When a restaurant uses card holds we store only a payment reference, the card brand and the last four digits; the full card number is held by the payment provider and never by us. Restaurant payouts run through the restaurant's own connected payment account.

Hosting, email, SMS, payments, maps and optional AI features are provided by named sub-processors, listed with their purpose and hosting region on the Sub-processor page.

The application uses only strictly necessary cookies and preferences you set yourself. There are no advertising cookies and no cross-site tracking. See the Cookie Policy.

Restaurants can delete guest records and reservations from their workspace. On account closure, data is exportable for 30 days, after which the applicable workspace and personal data is deleted within 90 days unless continued storage is required by law. Copies in backups are removed as those backups expire on their normal rotation cycle. The same lifecycle is set out in the Privacy Policy and the Data Processing Agreement.

Guests should contact the restaurant they booked with, since the restaurant decides how the data is used. We assist restaurants in answering requests. Write to legal@dinebase.se and we will route it.

Send security reports to legal@dinebase.se with enough detail to reproduce the issue. We acknowledge reports and keep the reporter updated. Please do not run automated scanning or load testing against the production service without written permission.

• Dinebase AB operates the platform, its security controls and its sub-processors.
• The restaurant controls who has access to its workspace, what it writes about guests, its booking and fee policies, and how it responds to guest privacy requests.
• Guests are responsible for the accuracy of the contact details they provide.