TODO (owner): This text is a working draft written for the product and has not been reviewed by a lawyer. Have it reviewed, fill in every TODO, then remove this note.
The short version
- We collect what a restaurant needs to hold your table: your name, mobile number, your email if you give it, and anything you choose to tell the kitchen.
- We use it only to make and manage your booking. If you tick “Keep me posted”, the restaurant may also send you occasional news.
- The restaurant you book with is responsible for your details. Glasgow GFX runs Seato and looks after them on the restaurant's behalf.
- There is no tracking, no advertising and no analytics in the app, and we never sell your details.
- You can ask for a copy of your details, or for them to be corrected or deleted, at any time.
Who we are
Seato is a restaurant reservations system: a booking page and app for guests, and a host stand for restaurant staff. It is built and run by Glasgow GFX (“we”, “us”), a software studio in Glasgow.
Registered name: TODO: registered company name. Company number: TODO: company number. Registered address: TODO: registered address. ICO registration: TODO: ICO registration number.
TODO (owner): Fill in the company details in site.config.ts (legal name, company number, registered address, ICO registration number). Delete any that don't apply.
Who is responsible for your data
When you book a table, the restaurant is the controller of your booking details: it decides what it needs and how it uses them. Glasgow GFX is a processor: we store and process your details on the restaurant's behalf, only on its instructions, under a written agreement with the restaurant.
Glasgow GFX is the controller only for the information we use to run our own business: emails you send to our support address, this website, and the contact details of the restaurants and staff who use Seato.
What we collect
When you book
- Your name and mobile number, so the restaurant knows who's coming and can reach you.
- Your email address, only if you give it.
- Your booking: the restaurant, date, time, party size, your booking reference and any extras you add (such as a celebration plate).
- Anything you choose to tell the kitchen: allergies and dietary needs, an occasion, or a special request.
- Whether you want news from the restaurant (“Keep me posted”).
When you visit the restaurant
The restaurant's host stand records what happens to your booking: whether you arrived, were seated, ran late, cancelled or didn't come. Where the restaurant uses the GFX till, the total of your bill is added to your guest profile when it's paid, so the restaurant can recognise returning guests. Staff may add notes and tags such as “Regular” or “VIP”.
Payments
The Seato app does not take card payments. Where a restaurant asks for a deposit, it's held against your booking and paid at the restaurant. We record the amount, not your card details.
Technical information
Like any online service, our servers receive your device's IP address and basic request information when you use the booking page or app. We use it only to deliver the service and to protect it from abuse (for example, limiting how many bookings can be made in a short time).
Why we use it
Only to make and manage your booking. In more detail, and the lawful basis under UK GDPR that usually applies:
| What for | Lawful basis |
|---|---|
| Holding your table, sending your confirmation and a reminder, letting you find or cancel your booking | Taking steps at your request to provide the booking (contract) |
| Letting the kitchen prepare for allergies and dietary needs | Your explicit consent, given by choosing to tell us. You can leave it out. |
| Recognising you when you come back (visits, spend, notes) | The restaurant's legitimate interest in looking after its guests |
| Occasional news from the restaurant, if you tick “Keep me posted” | Your consent. Unsubscribe at any time. |
| Keeping the service secure and preventing abuse | Legitimate interests |
The restaurant, as controller, decides the lawful basis for its own use of your details.
Allergies and dietary needs
Allergies and dietary needs can be health information, which the law treats as especially sensitive. They are shared with the restaurant team only so they can look after you. Leave them out if you would rather tell the restaurant in person.
Who can see it
- The restaurant you booked with and its staff, on the host stand.
- Glasgow GFX, only where we need to: to run and support the service, or when the restaurant or you ask for help.
- Our service providers, who host the service and deliver messages for us, under contracts that require them to protect your details and use them only for us.
TODO (owner): List the sub-processors by name and purpose (for example hosting, database, and the SMS/email provider once messages are sent for real). Today the service runs on Vercel with a Supabase database; confirm.
We never sell your details, and we don't share them with advertisers. A restaurant's guest details are never shared with another restaurant.
No tracking, no ads
The Seato app does not track you across other apps or websites, shows no advertising and contains no analytics SDKs. We don't build advertising profiles.
On your device
If you tick “Remember me”, your details are stored on your device only (in the iPhone or Android secure keychain) so you can book faster next time. Untick it, or tap “Not you?”, to remove them.
This website
This website sets no cookies and has no analytics, advertising or third-party tracking. Our fonts are served from this site, not a third party. If you email us, we use your email only to reply.
TODO (owner): Confirm what the hosting provider of this website logs (for example IP addresses in server logs) and for how long, once hosting is chosen.
How long we keep it
We keep your details only as long as the restaurant needs them to look after your bookings, and then delete them automatically:
- Allergy, dietary and other notes on a booking: cleared 90 days after the date of that booking.
- Your guest profile (name, mobile, email, visit history, and any allergy note the restaurant keeps so it can look after you next time): deleted 3 years after your last visit or booking. Your past bookings then stay in the restaurant's records only as anonymous counts, with nothing that identifies you.
- The texts and emails we send you (the message itself and its link to your booking): deleted from our systems 30 days after they're sent. We keep a record that a message was sent, without its contents.
- Waitlist requests: deleted 30 days after the date you asked about.
- If you reply STOP to a text, we keep your number on a do-not-text list for as long as we send texts, so we can honour it.
- Security records (who on the restaurant's staff changed a booking and when) are kept for as long as the restaurant uses Seato; any notes about you in them are removed after 90 days.
You can ask the restaurant at any time for a copy of what it holds about you, or for it to be deleted sooner. When a restaurant stops using Seato, we return or delete its guest data as our agreement with the restaurant sets out.
TODO (owner): Legal review: confirm these periods (decided 2026-10-25, see docs/DATA-RETENTION.md in the Seato repo) suit each restaurant, and add how long support emails, server logs and database backups are kept.
Where it's stored
We aim to store your details in the UK. Where a service provider processes data outside the UK, we make sure appropriate safeguards are in place, as UK law requires.
TODO (owner): Confirm where data is stored and processed (database region, hosting, messaging) and name the safeguard used for any transfer outside the UK (e.g. adequacy regulations or the UK International Data Transfer Addendum).
Keeping it safe
Your details are encrypted in transit. The database can only be read by our server, not directly from the internet, and restaurant staff sign in to the host stand with a venue PIN. Only people who need your details to run your booking can see them.
Your rights
Under UK GDPR you have the right to:
- ask for a copy of your details;
- have them corrected if they're wrong;
- have them deleted;
- object to, or ask us to restrict, how they're used;
- receive them in a portable format;
- withdraw your consent at any time (for example to news from the restaurant, or to holding your allergy information).
Ask the restaurant you booked with, or email us at support@glasgowgfx.co.uk with the subject “Data request”, the restaurant's name and the mobile number you booked with. We'll pass it to the restaurant and help them respond. There's no charge, and you'll get a response within one month. We may need to confirm it's you first.
If you're unhappy with how your details have been handled, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We'd appreciate the chance to put it right first.
Children
Bookings should be made by an adult. We don't knowingly collect details from children to make bookings.
TODO (owner): Confirm the minimum age to make a booking (commonly 16 or 18) and update this section.
Changes to this policy
If we change how we handle your details, we'll update this page and the date at the top. If the change is significant, we'll make it clear in the app.
Contact
For anything about your details: support@glasgowgfx.co.uk.
Glasgow GFX, TODO: registered address.