Privacy policy

Matably is a reservation management software for restaurants, operated by Matably Network LLC, a limited liability company registered in Wyoming, United States (filing ID 2026-002095063). Address: 1021 E Lincolnway Unit #146, Cheyenne, WY 82001, USA. Contact: contact@matably.com. Matably Network LLC acts as data controller for Matably platform administrator and user accounts, and as data processor for data processed on behalf of restaurant clients (for example, their own guest contacts).

Account data (restaurant administrator): full name, email address, phone number, password (hashed with argon2, never stored in plain text), technical identifiers linked to your session.

Restaurant data: name, address, phone, public email, cuisine type, logo, opening settings, floor plan configuration, third-party API keys provided by the restaurant (Stripe, YouCanPay).

Guest data (restaurant customers): name, phone, email, optional dietary preferences, reservation history, and notes left by the restaurant. This data belongs to the restaurant; Matably hosts and processes it solely on their behalf.

Technical data: IP address, device type, browser, error logs, essential cookies (authentication, language preference). The approximate city of each sign-in (shown under « Open sessions ») is derived from the IP address on our own servers, from an offline database: IP Geolocation by DB-IP (https://db-ip.com), licensed under Creative Commons Attribution 4.0. The address is not sent to any third party for this.

If you connect your WhatsApp Business account to Matably via the Meta Embedded Signup process, we collect: your WhatsApp Business account identifier (WABA ID), the associated phone number identifier, the display number and Meta-verified business name, your Meta Business portfolio identifier, and an access token issued by Meta, encrypted at rest (AES-256-GCM) in our database.

This information is used exclusively to send, on your behalf, the transactional notifications and marketing campaigns you configure in Matably. We never read private conversations your customers send you on WhatsApp, and we do not share any of this data with third parties for advertising purposes.

You can revoke our access at any time from Settings → Integrations → WhatsApp → Disconnect in your dashboard. This immediately deletes the encrypted token and unregisters our application from your WABA webhooks.

Service delivery: creating your account, running the platform, managing your reservations. Communication: sending you service-related emails (confirmation, security, billing). Guest notifications: sending WhatsApp or email messages on your behalf related to guest reservations. Security: preventing fraud, detecting abuse. Product improvement: understanding which features are used (aggregated, non-personal data).

We do not sell any data. We share the strict minimum necessary with service providers bound by confidentiality obligations: Meta Platforms Ireland Ltd. (WhatsApp Business Cloud API), Amazon Web Services (hosting), Amazon SES (transactional emails), Stripe / YouCanPay (payments, if you enable no-show protection), Anthropic (AI-assisted column mapping during guest imports: sample rows only), and Google Firebase Cloud Messaging (push notifications to the staff mobile app). We may disclose data if required by law.

Account data: retained while your account is active, deleted within 30 days of cancellation. Guest data: retained at the restaurant's request; when the restaurant closes its account it is kept 30 days (time to change its mind), then deleted automatically, together with bookings, reviews, campaigns, calls and the team's access. The till's fiscal journal (tickets, payments, closures): kept, as the law requires. WhatsApp tokens: deleted immediately upon disconnection. Technical logs: retained 90 days then purged. Billing data: retained 10 years to meet accounting obligations.

If your restaurant switches the AI assistant on, two further processing activities apply. In the dashboard, your questions and the assistant's answers are kept for 90 days so you can re-read a conversation; they are processed by Anthropic (Claude) and, in voice mode, by Google (Gemini Live), with no reuse for training their models. On the phone, the assistant states in its first sentence that it is a voice assistant, as required by the EU AI Act. No call is recorded: only the written transcript is kept, for 30 days, then deleted automatically. A summary of the call may be added to the relevant guest's record, exactly as a note taken by a member of staff would be. The caller's number is used to find their record: that match is an aid to greeting them, never proof of identity, and the assistant confirms out loud who it is speaking to before reading out or changing a booking. The restaurant can switch the assistant off at any time from its dashboard.

In accordance with Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data (and the GDPR for European Union residents), you have the following rights: right of access to your data, right of rectification, right of erasure ("right to be forgotten"), right to data portability (receive your data in an open format), right to object to processing, right to withdraw your consent at any time. To exercise any of these rights, write to contact@matably.com. We respond within 30 days.

To request deletion of all your personal data processed by Matably (including data from Meta / WhatsApp Business): send an email to contact@matably.com from the address linked to your account, with the subject "Data deletion request". We confirm within 7 days and complete the deletion within 30 days. You can also delete your account from Settings → My Account → Delete my account.

TLS 1.2+ encryption for all communications. AES-256-GCM encryption at rest for third-party access tokens. Argon2 password hashing. Hosting on certified infrastructure (AWS, ISO 27001). Data access limited to employees on a need-to-know basis. Daily encrypted backups.

We set no non-essential cookie and load no audience measurement tool on this site before you have made your choice.

If you accept, we use PostHog (EU host: eu.i.posthog.com) to record page views, clicks on the site's buttons (trial, demo, log in, contact, pricing, country and language) and use of the calculator, so that we can understand which pages help restaurants decide. The legal basis for this measurement is your consent. With your consent, PostHog stores an identifier in your browser (a cookie and local storage).

Your choice is stored in your browser (local storage, key "mt-consent") for 13 months at most: after that, we ask you again, and PostHog's identifier is deleted. You can change it at any time with "Manage cookies" at the bottom of every page.

If you choose a version of the site (a country and its language) in the picker, that choice is stored in a cookie ("mt_site", valid for one year) so that matably.com takes you back to that version on your next visit. This cookie is used for nothing else and not for audience measurement. Without that choice, the version you land on at matably.com depends on the country our host derives from your IP address at the time of the visit, then on your browser's language; we do not keep that country. If you have accepted measurement, switching version is counted like the other button clicks.

Our primary servers are hosted on Amazon Web Services. Some sub-processors (Meta, Amazon, Stripe, Anthropic, Google) may process data in the United States. These transfers are governed by the European Commission's standard contractual clauses.

We may update this policy to reflect changes in the service or the law. For significant changes, we will notify you by email at least 14 days before they take effect. The last updated date is shown at the top of this page.