Privacy policy

1. Who we are

Avintas is operated by SKKILLS BV, with its registered office at Steenbrugsestraat 14, 8210 Zedelgem, Belgium and enterprise number BE1032213622.

For privacy questions or to exercise your rights, please use our contact form and mention that it is a privacy request.

2. Our role

Our role depends on whose data it is:

• Guest data (reservations, contact details, messages): the restaurant you book with is the controller. Avintas processes this data as a processor, on behalf of and according to the instructions of that restaurant.
• Data of our customers (accounts of restaurant owners and their staff, subscriptions and billing): here SKKILLS BV itself is the controller.

Are you a guest who wants to see, correct or erase your data? Please contact the restaurant first. Restaurants can export and erase a guest's data directly in Avintas. If you contact us instead, we will pass your request on to the restaurant concerned.

3. What data we process

• Account data: name, email address, password (stored only as an encrypted hash), language preference and your role within a restaurant.
• Restaurant data: name, address, opening hours, tables, menus and settings, and the details of your subscription.
• Guest booking data: name, email address, phone number, date, time and party size, special requests, the restaurant's notes and tags, and the visit and no-show history at that restaurant.
• Payment data: payments for deposits, gift vouchers, tickets and subscriptions are handled by Stripe. We receive the amount and status of a payment, never your full card details.
• Messages: the confirmations, reminders and other emails or text messages we send on behalf of a restaurant, with their delivery status.
• AI conversations: what you type into the AI assistant or the AI host, and the replies.
• Technical data: log files including IP address, time and error messages, to keep the service secure and working.

4. Why, and on what legal basis

• To provide the service a restaurant has contracted us for: taking, confirming and reminding of reservations, assigning tables and processing payments (performance of a contract).
• To manage your account and bill your subscription (performance of a contract, and our legal accounting obligations).
• To secure the service, prevent abuse and trace errors (legitimate interest).
• To estimate the likelihood of a no-show from the visit history at the same restaurant, so the restaurant can send better-timed reminders (legitimate interest). This estimate never by itself leads to a booking being refused.
• To send a restaurant's newsletters and promotional emails (consent). Every promotional email contains a link to unsubscribe immediately.

5. Who we share data with

We do not sell personal data. We work with the following service providers, who as sub-processors each receive only the data they need for their task:

• DigitalOcean (hosting)
• Stripe (payments)
• Mailgun (email delivery)
• Anthropic (AI features)
• Twilio (text messages, only when a restaurant uses them)
• Better Stack (logging)

Some of these parties process data outside the European Economic Area. When they do, it is on the basis of the European Commission's standard contractual clauses or another lawful transfer mechanism.

Guest data is shared with the restaurant the guest books with. Beyond that, we only disclose data when the law requires us to.

6. How long we keep data

• Guest data is automatically anonymised three years after the guest's last visit to a restaurant. The reservations remain for the restaurant's statistics but can no longer be traced to a person.
• The log of sent messages is deleted after two years.
• Conversations with the AI assistant are deleted after 90 days.
• Account data is kept for as long as your account exists. When you delete your account, it is anonymised straight away.
• Invoices and the accounting records that go with them are kept for seven years, as Belgian law requires.
• When a restaurant is deleted, the data of its guests is anonymised straight away.

7. Security

Data is sent encrypted. Passwords are stored only as an encrypted hash. Within a restaurant, each staff member sees only what their role allows, and access by Avintas staff is limited to what support and administration require.

8. Your rights

You have the right to:

• see the data we hold on you (access);
• have incorrect data corrected (rectification);
• have your data erased (to be forgotten);
• have the processing restricted;
• object to processing based on legitimate interest, and always to direct marketing;
• receive your data in a common, machine-readable format (portability);
• withdraw any consent you gave, at any time.

You can change your name and language and delete your account yourself, in the dashboard settings. For anything else, please use our contact form; we reply within one month.

If you disagree with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels (gegevensbeschermingsautoriteit.be).

9. Cookies and local storage

Avintas uses no tracking or advertising cookies and no third-party analytics.

In your browser's local storage we keep only what the site needs to work: your login session and preferences such as your language. This needs no consent. Logging out clears your session.

Fonts are loaded from Google Fonts, which means Google receives your IP address. On payment pages, Stripe may set its own cookies to prevent fraud.

10. Changes

We update this policy when the service or the law changes. The date at the top shows the latest change. We notify customers of significant changes by email in advance.