No unnecessary jargon. Here is what we collect, why, and what you can do if you want us to delete your data. Last updated: 14 May 2026.
Matably is a reservation management software for restaurants, operated by MARAFOOD. Legal name: MARAFOOD. Tax ID: 000071121000042. Contact: contact@matably.com. MARAFOOD acts as data controller for Matably platform administrator and user accounts, and as data processor for data processed on behalf of restaurant clients (for example, their own guest contacts).
Account data (restaurant administrator): full name, email address, phone number, password (hashed with argon2, never stored in plain text), technical identifiers linked to your session.
Restaurant data: name, address, phone, public email, cuisine type, logo, opening settings, floor plan configuration, third-party API keys provided by the restaurant (Stripe, YouCanPay).
Guest data (restaurant customers): name, phone, email, optional dietary preferences, reservation history, and notes left by the restaurant. This data belongs to the restaurant; Matably hosts and processes it solely on their behalf.
Technical data: IP address, device type, browser, error logs, essential cookies (authentication, language preference).
If you connect your WhatsApp Business account to Matably via the Meta Embedded Signup process, we collect: your WhatsApp Business account identifier (WABA ID), the associated phone number identifier, the display number and Meta-verified business name, your Meta Business portfolio identifier, and an access token issued by Meta — encrypted at rest (AES-256-GCM) in our database.
This information is used exclusively to send, on your behalf, the transactional notifications and marketing campaigns you configure in Matably. We never read private conversations your customers send you on WhatsApp, and we do not share any of this data with third parties for advertising purposes.
You can revoke our access at any time from Settings → Integrations → WhatsApp → Disconnect in your dashboard. This immediately deletes the encrypted token and unregisters our application from your WABA webhooks.
Service delivery: creating your account, running the platform, managing your reservations. Communication: sending you service-related emails (confirmation, security, billing). Guest notifications: sending WhatsApp or email messages on your behalf related to guest reservations. Security: preventing fraud, detecting abuse. Product improvement: understanding which features are used (aggregated, non-personal data).
We do not sell any data. We share the strict minimum necessary with service providers bound by confidentiality obligations: Meta Platforms Ireland Ltd. (WhatsApp Business Cloud API), Amazon Web Services (hosting, Europe region), Amazon SES (transactional emails), Stripe / YouCanPay (payments, if you enable no-show protection). We may disclose data if required by law.
Account data: retained while your account is active, deleted within 30 days of cancellation. Guest data: retained at the restaurant's request, deleted upon cancellation. WhatsApp tokens: deleted immediately upon disconnection. Technical logs: retained 90 days then purged. Billing data: retained 10 years to meet accounting obligations.
In accordance with Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data (and the GDPR for European Union residents), you have the following rights: right of access to your data, right of rectification, right of erasure ("right to be forgotten"), right to data portability (receive your data in an open format), right to object to processing, right to withdraw your consent at any time. To exercise any of these rights, write to contact@matably.com. We respond within 30 days.
To request deletion of all your personal data processed by Matably (including data from Meta / WhatsApp Business): send an email to contact@matably.com from the address linked to your account, with the subject "Data deletion request". We confirm within 7 days and complete the deletion within 30 days. You can also delete your account from Settings → My Account → Delete my account.
TLS 1.2+ encryption for all communications. AES-256-GCM encryption at rest for third-party access tokens. Argon2 password hashing. Hosting on certified infrastructure (AWS, ISO 27001). Data access limited to employees on a need-to-know basis. Daily encrypted backups.
Our primary servers are hosted in Europe (AWS eu-west region). Some sub-processors (Meta, Amazon, Stripe) may process data in the United States. These transfers are governed by the European Commission's standard contractual clauses.
We may update this policy to reflect changes in the service or the law. For significant changes, we will notify you by email at least 14 days before they take effect. The last updated date is shown at the top of this page.
Data controller
MARAFOOD
Operator of Matably. For data requests, write from the email linked to your account.