Privacy Policy
1. Who we are and the role we play
Regulars Reserve is reservation and floor-management software that Regulars Company LLC (“Regulars,” “we,” “us”) provides to restaurants. When you book a table through a restaurant’s booking page, your reservation is with that restaurant. The restaurant is the controller of your information. Regulars processes that information as the restaurant’s service provider, only on the restaurant’s behalf and only to run the reservation service described in this policy.
Guest data belongs to the restaurant. Every restaurant can export its complete guest list at any time, in one click, free of charge, and that access is never conditioned on payment status. We do not sell guest data. We do not rent it, trade it, or share it across restaurants.
We do not share mobile information, including phone numbers and SMS consent records, with third parties or affiliates for marketing or promotional purposes. We share it only with the service providers listed in Section 8 to operate the reservation service.
You never create an account with us. There is no diner login, no diner app, and no cross-restaurant diner profile. Each restaurant’s guest records live in that restaurant’s own tenant, walled off from every other restaurant on the platform.
2. What we collect and why
We collect only what the reservation service needs.
When you book:
- Name. So the restaurant knows who the reservation is for.
- Phone number (required for online booking). It identifies your reservation and lets the host reach you about it. We use it for reservation texts only when you have given the permission described in Section 3.
- Email address. We use it to send confirmation, reminder, and requested reservation-code copies. Email is required unless you select the optional reservation-text box and the service confirms an active text route for your booking. If that route is unavailable, the booking page asks for email before confirming. You may still add email when texts are available so you receive both. After a visit the restaurant marks finished, we send one email asking how everything was, with a way to leave a Google review or send private feedback. It carries no promotion, comes no more than once in 30 days or twice in 90 days, and every one has a “Stop these emails” link that ends them for that restaurant. Your reservation emails keep coming.
- Reservation details. Party size, date and time, seating preferences, accessibility needs, and any notes you add.
As you dine with a restaurant over time, the restaurant may maintain:
- Visit history. Visit counts, last visit date, and no-show counts, so the restaurant can recognize and serve its regulars.
- Preferences and notes. Seating preferences, accessibility needs, and host notes the restaurant records about how to serve you well.
- Special occasions. If you or the restaurant record a birthday or anniversary, we store the month and day only. We never store a birth year, so occasion records cannot reveal your age.
Records the service generates:
- Consent records. Each consent event is stored with its channel, class, basis, source, timestamp, and the evidence appropriate to how it was given. A consent given on the booking page includes the exact disclosure text and version shown there; a text-message opt-in or opt-out records the keyword used. These records are append-only and exist to prove what you agreed to and when.
- Message logs. A log of reservation and other message attempts made on the restaurant’s behalf. Text-message entries include the destination, template version, provider identifier when accepted, delivery status, and any failure code, but not the outgoing message body. These records help diagnose problems and enforce consent rules when a message is sent.
- Text keyword receipts. For a STOP, START, UNSTOP, or other recognized consent keyword, we keep the provider message identifier, normalized sender number, keyword intent, provider occurrence time, and processing time. This prevents a replayed or delayed provider webhook from reversing a later choice.
- Incoming text replies. A free-form text reply and its sender number are stored in the restaurant’s host inbox so a person can act on it. The service sends no automated reply from that inbox.
- Service event records. Operational records of reservation activity (booked, seated, cancelled, and similar events) that make the reservation book reliable and auditable.
- Public-request protection records. We briefly record the requester IP address, the public action attempted, and its timestamp to rate-limit automated abuse. These rows are normally removed after about one day.
We do not use advertising tracking, enrich guest records from outside sources, or build a profile that follows you between restaurants.
3. Text messages, consent classes, and STOP
Reservation messaging is built on explicit consent classes, enforced in software at the moment each message is sent.
Reservation service messages (transactional). The booking page has a separate reservation-text box that starts unchecked. Selecting it gives the named restaurant permission to send automated confirmations, reminders, and a booking code when you request one. It also states that message frequency varies, message and data rates may apply, and consent is not required to book. Direct links to the Terms and Privacy Policy sit beside the box. The exact sentence and its version are stored with your consent record.
That permission covers the restaurant’s ongoing reservation-text program, including later reservations with the same restaurant. Leaving the box unchecked creates no new permission and does not withdraw a permission you already gave. Reply STOP whenever you want reservation texts to stop. Imported reservations receive no text messages unless the guest gives this same permission or opts in by text.
Marketing messages. Marketing texts and emails are sent only with your prior express written consent, given through a separate control that is unchecked by default, is never bundled with booking, and is never a condition of booking. That control appears only on booking pages of restaurants that have purchased the marketing service; at every other restaurant no marketing consent is requested and none is captured. Guests imported from a restaurant’s previous system never inherit marketing consent.
Opting out. Reply STOP to any text message and texting to your number is suppressed immediately. Your reservation remains valid; reservation updates fall back to email if you provided one, and otherwise the host is flagged to confirm by phone. Message and data rates may apply to texts you receive; frequency varies with your reservation activity. Reply START or UNSTOP to resume after a STOP, or HELP for help.
4. Cookies
The booking page uses a minimal, functional set:
- A booking session cookie, strictly necessary to complete your reservation.
- Cloudflare Turnstile, a bot-protection check that loads only when traffic looks abusive, to keep booking availability honest for real diners.
There are no advertising cookies, no analytics trackers, and no third-party marketing pixels on the booking flow.
5. How long we keep information
Retention is governed by our internal retention schedule. In summary:
- Reservation and visit records are retained as the restaurant’s operational history.
- Consent records are retained for the life of the guest record plus a statutory margin, with a five-year minimum, to substantiate consent.
- Encrypted backups are kept for 30 days, and the database’s own point-in-time recovery window is 7 days.
- Export files are generated on demand and are not retained on our servers.
- We do not store the text of the messages we send you. Each message is composed from your live reservation record at the moment it is sent. The messaging provider that delivers it keeps its own record under its own retention policy.
- We do store a free-form text reply you send, with its sender number, in the restaurant’s host inbox. A reply linked to your guest record or reservation is cleared when that guest is erased. An unmatched reply remains with the restaurant’s data until that restaurant’s tenant data is removed.
- Links we send you expire: the link that manages your reservation lasts 30 days or until the day after your reservation, whichever is later, and a feedback link lasts 30 days.
6. Your rights and how to exercise them
Because each restaurant controls its own guest data, requests about your information (access, correction, deletion, and any rights your state’s law provides) go to the restaurant you dined with. Contact the restaurant directly; its contact details appear on its booking page. Regulars assists every restaurant in fulfilling these requests, and if you contact us first at [email protected] we will route your request to the right restaurant and support its response.
What deletion means here, in plain terms. The reservation book keeps a permanent record of what happened in the dining room: that a table was booked, seated, and finished, on a date, for a party of a certain size. That record is what makes the book trustworthy, and it is the restaurant’s own account of its own nights. When you ask to be deleted, we remove YOU from it: your name, phone number, email address, notes, preferences, and any special occasion we hold are erased and cannot be recovered, and what remains is a booking with nobody’s name on it. We do not rewrite history, and we do not keep you inside it.
Two consequences we would rather state than bury. First, we keep the record of the permissions you gave or withdrew, because it is the proof that we were allowed to contact you, and that record holds no contact details of its own once your details are erased. If you told us to stop texting you, we keep the minimum needed to keep honoring that. Second, our encrypted backups are kept for 30 days, so an erasure lands in the live system immediately and is re-applied to anything restored from an older copy.
7. Children
The booking service is directed at adults making restaurant reservations. We do not knowingly collect information from children under 13. If you believe a child has provided information through a booking page, contact us at [email protected] and we will work with the restaurant to delete it.
8. Service providers
We use a small set of infrastructure providers to run the service, each bound to process data only for us: DigitalOcean (hosting and database), Postmark (email delivery), Twilio (text messaging), Cloudflare (network security and bot protection), Sentry (error monitoring), and Stripe (payment processing, used where a restaurant enables deposits and for billing the restaurants themselves). Where a restaurant buys a marketing service and enables its consent sync, our DigitalOcean-hosted n8n workflow transfers the permitted contact and consent record into that restaurant’s HighLevel/LeadConnector sub-account. These providers receive only the data needed to operate, secure, monitor, or deliver the service described here. Mobile information is never shared with them for their own marketing or promotional use.
9. Security
We protect guest data with authorization checked on the server for every request, with database row-level security as a second layer, role-based access control checked server-side, encrypted backups stored off the primary provider, signature verification on all provider webhooks, rate limiting and bot protection on public endpoints, and tokenized reservation-management links that are hashed at rest, scoped, and expiring. Bulk guest export requires an authenticated owner or manager session, which a host’s device credential cannot satisfy, and every export is recorded in the restaurant’s own audit log. We work to keep phone numbers and email addresses out of our error telemetry, and we do not record diner sessions.
10. Changes to this policy
When this policy changes, we will post the new version with a new effective date and version number. Material changes will be communicated through the restaurants we serve. Prior versions remain available on request.
11. Contact
Regulars Company LLC
6521 Plowman Rdg, Harrisburg, Pennsylvania 17112
[email protected]
For questions about a specific reservation or a restaurant’s guest records, contact that restaurant directly.