Lobbra · Data Processing Agreement

1. This agreement

Lobbra stores and uses personal data of the restaurant’s guests for the restaurant: names, phone numbers, bookings, call recordings and more. The GDPR (EU Regulation 2016/679, Article 28) asks for a written agreement about this. This is that agreement, between the restaurant and Lobbra (run by Yossef Alaswad in Malta; contact support@lobbra.com).

It is part of the Terms of Service and the restaurant accepts it together with them when it creates its account. There is nothing to sign. If the two say different things about personal data, this agreement wins. Words like “personal data”, “controller”, “processor” and “personal data breach” mean what they mean in the GDPR: the controller decides why and how data is used; the processor uses it only for the controller.

2. Who is who

For guest data, the restaurant is the controller and Lobbra is the processor. For the restaurant team’s accounts (logins, phones for alerts), for payments by the restaurant’s owners, and for Lobbra’s own security and billing records, Lobbra is the controller; that data is covered by Lobbra’s privacy notice, not by this agreement. Annex 1 describes the processing.

3. What Lobbra promises

Only on the restaurant’s instructions. Lobbra uses guest data only to run Lobbra for the restaurant, as the Terms, this agreement and the restaurant’s choices in Settings describe (for example reminders, review requests, the words of guest messages, the online booking page). These are the restaurant’s instructions.
Lobbra does not use guest data for its own purposes: it does not sell it, use it for advertising, or use it to train AI models.
If the law asks Lobbra to process data in another way (for example a court order), Lobbra tells the restaurant first, unless the law forbids this. If Lobbra thinks an instruction breaks the GDPR, it tells the restaurant at once.
Only people who need guest data to run or support Lobbra can see it, and they keep it confidential, also after they stop working for Lobbra.
Lobbra keeps guest data safe with the measures in Annex 2 and keeps them up to date (GDPR Article 32).
Guest requests. If a guest asks Lobbra (not the restaurant) to see, correct, delete or get a copy of their data, Lobbra sends the request to the restaurant within 3 working days and does not answer the guest itself, unless the restaurant asks it to. Lobbra helps the restaurant answer: it finds, copies (a spreadsheet file), corrects or deletes a guest’s data within 5 working days of the restaurant’s request.
Lobbra helps the restaurant with security, breach notices, data protection impact assessments and questions from the regulator, as far as they concern Lobbra (GDPR Articles 32–36), and gives the information needed to show this agreement is followed (part 9).

4. What the restaurant promises

It has a lawful reason (a “legal basis”) to collect guest data and let Lobbra process it, for example to take and manage a booking the guest asked for.
Allergies and dietary needs can be health data (GDPR Article 9). They are recorded only when the guest gives them for their visit, and used only to serve the guest safely.
It tells its guests about Lobbra in its own privacy notice: that bookings and calls are handled by Lobbra, that calls are recorded and kept for 30 days, and whom to contact. A sample text is in Annex 4.
It switches on reminders and Google review requests only when it has a lawful reason to send them.
Its team does not write unnecessary sensitive data in guest notes (for example health details beyond allergies, or opinions about a guest’s religion or origin).
It keeps team logins safe, removes people who leave, and answers guests’ data requests in time (usually one month).

5. Other providers Lobbra uses (sub-processors)

The restaurant allows Lobbra to use the providers in Annex 3. Before Lobbra adds or replaces a provider that handles guest data, it emails the restaurant’s owners at least 30 days before. The restaurant can object by email for a good reason related to data protection; if we cannot agree, the restaurant can end the Terms without a fee before the change and get its unused paid credit back. Each provider has a written agreement with data protection duties like these (its data processing agreement), and Lobbra stays responsible to the restaurant for what its providers do with guest data.

6. Data outside the EU

Lobbra’s main database, including call recordings, is in the EU (Frankfurt, Germany). Some providers in Annex 3 are in the United States or may process data there. For these, Lobbra relies on the EU Standard Contractual Clauses (Commission Decision 2021/914) in each provider’s data processing agreement and, where the provider is certified, on the EU-U.S. Data Privacy Framework. Lobbra keeps transfers small: call recordings and their words are deleted at ElevenLabs after 30 days; for Hold to talk only the words the team member says and the table numbers go to the AI, never the guest list, and Lobbra keeps neither; photos of a table used at setup are never saved.

7. Personal data breaches

A breach is when guest data is lost, changed, seen or shared by someone who should not, by accident or on purpose. If Lobbra finds a breach that affects the restaurant’s guest data, it tells the restaurant without undue delay, aiming for 24 hours and at the latest 48 hours after it finds out, by email to the owners and by phone where we have a number. Lobbra gives what it knows, and more as it learns: what happened, which data and roughly how many guests, the likely effects, and what Lobbra has done and will do. It contains the breach at once, checks the logs, and adds a protection so it does not happen again.

The restaurant, as controller, decides whether to tell the Information and Data Protection Commissioner (IDPC, idpc.org.mt) within 72 hours, and the guests if the risk is high. Lobbra helps with the facts and the wording, and sends the notice for the restaurant if it asks in writing.

8. Keeping and deleting data

Lobbra keeps guest data only as long as Annex 1 says. When the Terms end, Lobbra deletes all guest data; if the restaurant wants a copy, it asks before the end. When the only owner deletes the restaurant in Settings → Your account → Delete my account, everything is deleted at once, including the AI receptionist and the call recordings. If Lobbra ends the Terms, it deletes guest data 30 days after the end unless the restaurant asks for it back before then. Copies in backups disappear within 7 days. Lobbra confirms the deletion by email if asked.

9. Checks and audits

Lobbra answers the restaurant’s reasonable questions about data protection and security, in writing, within 14 days. Once a year (or after a breach), the restaurant may audit Lobbra itself or through an independent auditor who keeps things confidential, with at least 30 days’ notice and at its own cost; the audit must not put other restaurants’ data at risk. The IDPC may always check, as the law allows.

10. Responsibility, how long, and law

Each side is responsible as the GDPR says (Article 82); apart from that, the limits in the Terms (part 11) apply, as far as the law allows. This agreement starts when the Terms start and lasts as long as Lobbra processes guest data for the restaurant, including the time needed to delete it. Maltese law and the GDPR apply; the courts of Malta decide disagreements.

Annex 1 · What data, whose, why and how long

What Lobbra does: stores, shows and sends booking data for the restaurant: takes bookings by phone (the AI receptionist), on the online booking page and at the host stand; shows them to the team; sends the guest the answer and, if switched on, a reminder and one Google review request; sends phone alerts to the team; deletes data on time.
Whose data: the restaurant’s guests and people who call it (also people who do not book); people named by a guest may appear in notes.
Guest data: name; phone number; email (if given); the booking (day, time, people, table, occasion, wishes, notes); whether the guest came, was late or did not come; walk-ins; the team’s notes (for example “regular”, “VIP”); “Don’t accept” marks; messages sent and whether they arrived; the guest’s taps on their change/cancel link.
Call data: caller ID; the recording; the word-by-word text; the AI’s short summary; the time and length; whether the call was put through to the team.
Online booking page: what the guest types; for 7 days a scrambled code of the guest’s connection and phone number, only to stop spam.
Special categories: allergies and dietary needs (may be health data), only when the guest gives them. Lobbra asks for no other special category; guests may mention them on a call.
How long: recordings and their words 30 days (at Lobbra and ElevenLabs); spam-stop codes 7 days; guests, bookings and messages until the restaurant deletes them or closes its account; the app’s offline copy (today and tomorrow) is replaced every 2 minutes and removed at logout.
Where: the main database and recordings at Supabase in Frankfurt (EU); other providers in Annex 3.

Annex 2 · How Lobbra keeps data safe

Where data lives: the database and recordings are in the EU; recordings sit in a private storage area, one folder per restaurant. All connections are encrypted (HTTPS) and stored data is encrypted (AES-256). Card numbers never reach Lobbra.
Restaurants kept apart: every table carries the restaurant’s id with Row Level Security, so a team member only ever sees their own restaurant; logged-out visitors read nothing; links between data are checked to belong to the same restaurant; only owners change settings, the team and guest messages.
Testing: hundreds of automatic attack tests try to read or change another restaurant’s data, skip logins and abuse limits, on a separate test project, before changes go live; every code change is checked for errors, vulnerable packages and secret keys.
Logins: password, Google or Apple; login pages are limited to 10 tries a minute per address; deleting a whole restaurant needs the only owner, its name typed in and a recent login; secret keys live only in secret stores, never in code, chat or logs; two-step login on providers’ consoles where offered.
Phone, messages and AI: the AI receptionist’s line accepts calls only from Lobbra’s phone provider; limits on calls and messages per restaurant and for all of Lobbra; texts only to European mobile numbers; provider reports checked for a valid signature, time and duplicates; the AI never changes saved data on its own (a person presses the button), and its fixed rules (“virtual assistant”, the allergy rule) cannot be removed; if a caller asks, it says that the call is recorded.
Less data, deleted on time: a nightly job deletes recordings and their words after 30 days; spam-stop codes after 7 days; Hold to talk keeps nothing; logs and alert emails contain ids, not guests’ numbers or emails.
Watching and reacting: a health check every few minutes and an alert when calls, texts, emails or recordings fail; an incident plan (contain, change keys, check logs, tell the restaurant, add a test); database backups kept at most 7 days, in the EU.

Annex 3 · Providers (sub-processors)

Each has accepted data protection terms with Lobbra (its data processing agreement). Transfers outside the EU use the EU Standard Contractual Clauses and, where certified, the EU-U.S. Data Privacy Framework.

Supabase: Database, logins, storage of call recordings. Data: All guest and call data; team logins. Where: EU (Frankfurt, Germany); stays in the EU.
Vercel: Hosts the website and app; runs Lobbra’s server code. Data: All data passing through the app. Where: EU and USA.
ElevenLabs: The AI receptionist’s voice, call recording, speech to text (also Hold to talk). Data: Callers’ voice, caller ID, what is said, booking details; team members’ voice (Hold to talk). Where: USA (calls kept 30 days).
Anthropic (Claude): The AI that understands calls and Hold to talk; reads the restaurant’s website at setup. Data: What callers and team members say; table numbers. Where: USA.
Zadarma: Phone numbers; routes calls to the AI receptionist and to the team. Data: Caller ID; the call audio passing through. Where: EU and other countries.
Twilio: SMS to guests; AI phone numbers (routes calls to the AI receptionist). Data: Guest phone number; message text (name, booking); caller ID and the call audio passing through. Where: USA and EU.
Meta (WhatsApp): WhatsApp messages to guests. Data: Guest phone number; message text. Where: EU (Meta Platforms Ireland) and USA.
Resend: Emails to guests and the team. Data: Email address; message text. Where: EU sending region (Ireland); company in the USA.
Apple and Google (push): Phone alerts to the restaurant’s team. Data: Alert text (guest name, time, people, allergy flag); the phone’s address. Where: USA.
Stripe: Owners’ payments for credit. No-show prevention: a group’s card, saved and charged on the restaurant’s own Stripe account. Data: Owner name and email; the card (kept by Stripe). For a group’s card: the guest’s name, email and phone number, and the card (kept by Stripe). Where: EU (Ireland) and USA.

Not listed because they get no guest data: GitHub (Lobbra’s code), UptimeRobot (only checks that Lobbra answers “ok”), Namecheap (the domain name).

Annex 4 · Sample text for the restaurant’s privacy notice

The restaurant can copy this into its own privacy notice or website, and change it as it needs:

“We use Lobbra to take bookings by phone, online and at our door, and to answer our phone. When you call us, a virtual assistant may answer, and it tells you so. Calls are recorded. We keep the recording and its text for 30 days, then they are deleted. We keep your name, phone number, email (if you give it) and the details of your booking, including any allergies you tell us about, so we can manage your visit and send you its confirmation and, if you choose, a reminder. Lobbra works for us and keeps this data in the EU; some services it uses are in the USA, with EU-approved safeguards. You can ask us to see, correct or delete your data at any time: [your email or phone]. You can also complain to the Information and Data Protection Commissioner (idpc.org.mt).”

How Lobbra handles your guests’ data.