Privacy policy

Last updated: 5 November 2026

This policy explains what personal data Revotab handles, why, for how long, who helps us, and what your rights are. It is written to be read, so it uses plain words. If anything is unclear, write to us at [email protected].

1. Who we are

Revotab is run by AviaTravel OÜ (registry code 17586406, VAT number EE103022901), Tornimäe tn 5, Kesklinna linnaosa, Tallinn, a company registered in Estonia ("Revotab", "we", "us").

We have two different roles, depending on whose data it is:

• We are the controller for the data of people who use revotab.com, who contact us, who subscribe to our newsletter or apply for a job, and of the restaurants and their staff who have a Revotab account. We decide why and how that data is used.
• We are a processor for the data restaurants keep about their guests in Revotab: bookings, the guest book, orders, vouchers, reviews and loyalty cards. The restaurant is the controller of that data and decides how it is used. We only process it to run Revotab for the restaurant, under our data processing terms.

Are you a restaurant guest? For questions about a booking, or to see, correct or delete what a restaurant knows about you, the quickest route is the restaurant itself. If you cannot reach it, write to us and we will pass your request on and help the restaurant answer it.

2. What we collect, and why

If you visit revotab.com

• Visit statistics. Our own statistics count pages viewed, the site that sent you, campaign tags and the type of device. We do not store your IP address for this: each visitor is counted with a code that changes every day and cannot be traced back to you. Legal basis: our legitimate interest in knowing how the website is used.
• Google Analytics and Google Tag Manager, only if you accept them in the cookie banner. Until you choose, no Google tag is loaded. You can change your choice at any time from the cookie settings link at the bottom of the website. Legal basis: your consent.
• Security records. To protect the service we record security events such as sign-ins, failed sign-ins, blocked requests and rate limits, with the IP address and browser involved. Our "I'm human" check runs in your browser and does not use any outside captcha service. Legal basis: our legitimate interest in keeping Revotab and its users safe.

If you have a Revotab account (restaurants and their staff)

• Account details: name, email address, password (stored only as a secure hash), language, the restaurants you work for, your role, and two-factor sign-in settings if you turn them on.
• Business and billing details: business name, address, VAT number, the plan and invoices. Card payments are handled by Stripe. We never see or store full card numbers.
• How you use Revotab: settings, the changes you make, and support conversations.

Legal basis: the contract with your business, and our legal duty to keep accounting records.

If you contact us, ask for a demo or subscribe

• Support requests and demo requests: your name, email, company, phone number if you give it, and your message. Legal basis: answering you, at your request.
• Newsletter: your email address and language. We only send it after you confirm your address by clicking the link in our email, and every newsletter has a one-click unsubscribe link. Legal basis: your consent.

If you apply for a job

Your name, email, phone number, links you share (such as LinkedIn), your message and your CV. Legal basis: steps you ask us to take before a possible contract.

Restaurant guests (we process this for the restaurant)

When you book, order or buy a voucher from a restaurant that uses Revotab, the restaurant receives your name, contact details, the details of your booking or order, and anything you choose to tell it, such as an allergy or an occasion. Allergy notes can be health information: the restaurant uses them only to serve you safely. Revotab sends confirmation and reminder emails and text messages for the restaurant, takes deposits and payments for it, and keeps the restaurant's guest book. Marketing messages from a restaurant are only sent if you agreed to receive them, and each one has an unsubscribe link.

3. Who helps us

We use a small number of trusted companies to run Revotab. Each one only receives what it needs for its task and is bound by a data processing agreement.

Company	What it does for us	Where
Contabo GmbH	Servers that run Revotab and store its data	European Union
Cloudflare, Inc.	Delivers the website quickly and protects it from attacks	Worldwide network
Stripe Payments Europe, Ltd.	Card payments: subscriptions, deposits, vouchers and orders	Ireland, with transfers to the USA
Brevo (Sendinblue SAS)	Sends our emails and the restaurants' emails to guests	France
Twilio Ireland Limited	Sends text messages for restaurants (confirmations and reminders)	Ireland, with transfers to the USA
Google Ireland Limited	Website statistics and tags, only with your consent	Ireland, with transfers to the USA

We do not sell personal data, and we do not share it with advertisers.

Transfers outside Europe. Where a company above handles data outside the European Economic Area, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

We may also disclose data when the law requires it, for example to a court or tax authority, or to protect the rights and safety of our users.

4. How long we keep it

• Accounts: while the account is open. When a restaurant closes its account, the guests' personal data is erased automatically 30 days later; the month in between lets the restaurant change its mind or export its data.
• Invoices and accounting records: 7 years, as Estonian accounting law requires.
• Job applications: deleted automatically 12 months after you apply.
• Security records: deleted automatically after 90 days.
• Backups: encrypted, and each one is deleted after 14 days.
• Newsletter: until you unsubscribe. We keep a short record that you unsubscribed so we never email you again by mistake.
• Support and demo requests: as long as we need to help you and keep a record of what was agreed. You can ask us to delete them sooner.
• Visit statistics do not identify you, so they are kept as plain numbers.

5. Your rights

Under the EU General Data Protection Regulation you can ask us to:

• show you the data we have about you, and give you a copy;
• correct it, or complete it;
• delete it;
• limit what we do with it, or stop using it for a purpose you object to;
• send it to you, or to another company, in a common format;
• stop using it where we rely on your consent (this does not affect what we did before).

Write to [email protected] from the address we know you by. We answer within one month, and it is free. If the data belongs to a restaurant's guest list, we will forward your request to that restaurant and help it answer.

You can also complain to a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), and you can also go to the authority in the country where you live.

6. Cookies and local storage

We only use what the website needs to work, plus Google's statistics cookies if you accept them.

Name	What it is for	How long
revotab-session	Keeps you signed in and remembers your session	2 hours after your last visit
XSRF-TOKEN	Protects forms from being sent by other websites	2 hours after your last visit
revotab_locale	Remembers your language	1 year
remember_web_…	Keeps you signed in if you tick "Remember me"	400 days, or until you sign out
Local storage: cookie choice, screen settings	Remembers your cookie choice, touch mode, light or dark look and the sidebar	Until you clear it
_ga, _ga_… (Google)	Website statistics, only with your consent	Up to 2 years

7. How we protect data

All traffic to Revotab is encrypted. Passwords are stored as secure hashes, sensitive fields are encrypted in the database, and backups are encrypted. Staff access to Revotab HQ requires two-factor sign-in, and only the people who need data for their work can see it. If a data breach ever puts your data at risk, we will tell the people and authorities concerned as the law requires.

8. Children

Revotab is a service for businesses and is not aimed at children. We do not knowingly collect data from children under 16.

9. Changes

When we change this policy, we update the date at the top. If a change matters for how we use your data, we will tell account holders by email before it takes effect.

10. Contact

AviaTravel OÜ (registry code 17586406, VAT number EE103022901), Tornimäe tn 5, Kesklinna linnaosa, Tallinn Email: [email protected]