Privacy Policy

Last updated: 16 July 2026 — courtesy translation; the German version prevails.

1. Controller

holy moly concepts GmbH, Heiligengeiststraße 33, 21335 Lüneburg, Germany · email: hello@rabea.ai · phone: +49 4131 7066500.

Roles: For reservation data you enter on a restaurant's booking page, the restaurant is the controller; we process that data on its behalf as a processor (Art. 28 GDPR). For this website and restaurant-manager accounts, we are the controller ourselves.

2. Principles

No tracking, no advertising, no selling of data. The guest booking pages set no cookies and load no third-party resources. Guests never need an account. All data is hosted in the EU — including all AI processing.

3. What we process

Reservations: name, email address or phone number, party size, date/time, optional notes (e.g. allergies). Purpose: confirming, reminding, changing and cancelling your reservation, and notifying the restaurant. Legal basis: Art. 6(1)(b) GDPR.

Confirmations & reminders: sent by email; if you only provided a phone number (e.g. booking by phone), by SMS. Legal basis: Art. 6(1)(b) GDPR.

Rabea (AI assistant — chat / voice / phone): when you chat, speak or call, we process the conversation to answer your request and create reservations; for phone calls additionally your caller number (as booking contact) and a transcript. Rabea always identifies herself as an AI. Legal bases: Art. 6(1)(b) and (f) GDPR.

Manager accounts (restaurants): email address, sign-in credentials (magic link/passkey), a strictly necessary session cookie, and billing data for the chosen plan. Legal basis: Art. 6(1)(b) GDPR.

Server logs: for secure operation we briefly process technical connection data (e.g. IP address). Legal basis: Art. 6(1)(f) GDPR.

4. Retention

Guest data is automatically deleted or anonymized 30 days after the visit by default (depending on the restaurant's setting). The same period applies to Rabea's conversation transcripts. Statutory retention duties (e.g. invoicing data for restaurant subscriptions) remain unaffected.

5. Recipients & processors

We use the following providers, each under a data processing agreement:

Hetzner Online GmbH (Germany) — hosting, all application data.
Scaleway SAS (France) — transactional email delivery.
GatewayAPI / Onlinecity ApS (Denmark) — SMS to guests who provided only a phone number.
fonial GmbH (Germany) — the phone line for the phone channel.
Apple Inc. (Apple Push Notification service, USA) — delivery of push notifications to the manager app. Notifications deliberately carry no guest data (only weekday, time and party size); transfers to the USA are safeguarded by EU standard contractual clauses (Art. 46 GDPR).

AI processing (EU only): Rabea handles chat and voice requests exclusively with European AI: the Mistral Medium language model, running on servers of Scaleway SAS (France), and Voxtral for speech recognition and speech output, operated by Mistral AI SAS (France). Conversation content never leaves the EU, is not used for training, and is not stored permanently.

Payments (restaurant subscriptions only, no guest data): restaurant plans are handled by Paddle (Paddle.com Market Ltd, UK / Paddle Payments Ltd, IE) as merchant of record; Paddle is an independent controller for payment data.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) — write to hello@rabea.ai. You can view, change or cancel your reservation any time via the link in your confirmation. You also have the right to lodge a complaint with a supervisory authority; ours is the Landesbeauftragte für den Datenschutz Niedersachsen (Lower Saxony, Germany).

7. Cookies

The guest booking pages set no cookies. Only the restaurant admin area sets a strictly necessary session cookie for signed-in managers (Art. 6(1)(b) GDPR; § 25(2) German TDDDG). No consent banner is therefore required.