Privacy Policy
What we hold, why, and for how long.
Eightish handles two different kinds of personal data with two different sets of responsibilities, and most privacy policies blur them. This one separates them at the top, because the difference decides who you should ask about what.
Last updated 4 October 2026.
The two roles, first
Guest data — the restaurant decides
Names, phone numbers, bookings, notes and message history belong to the restaurant you booked with. They are the controller; Eightish is their processor. We only act on their instructions.
If you are a diner and want your data corrected or erased, ask the restaurant. If you cannot reach them, contact us and we will pass it on within 5 working days.
Account data — we decide
The names and email addresses of restaurant staff who use Eightish, billing details, and how the product is used. Here we are the controller, and the rest of this policy applies directly.
Who we are
Eightish is a product of Mensia Limited, a private limited company registered in England and Wales.
- Company number: 17231746
- Registered office: 10 Hudson Drive, Preston, PR4 2ER, United Kingdom
Contact for any data protection question: hello@eightish.co.uk.
What we collect
From restaurants (we are controller)
- Account — name, work email, password hash, venue details, role.
- Billing — plan, subscription status, invoice history. We never see or store your card. Card details go directly to Stripe; we hold only a token, the brand and the last four digits.
- Usage — counts of bookings and messages per month, for billing and for showing you your allowance.
- Technical — IP address, browser and error logs, for security and diagnosis.
From guests, on a restaurant’s behalf (we are processor)
- Booking — name, mobile number, email if given, party size, date and time, and any dietary or access note the guest chose to share.
- History — previous visits, no-shows, cancellations, and tags or notes the restaurant adds.
- Messages — the confirmations and reminders sent, their delivery status, and any replies.
- Consent — whether the guest agreed to marketing, when, how, and when they withdrew it. This record is append-only: withdrawing consent adds an entry, it does not erase the history of having given it.
We do not collect special category data. A dietary note a guest volunteers may imply health or religious information, so restaurants should treat that field with care and guests should share only what they want the kitchen to know.
Why, and on what lawful basis
| Purpose | Basis |
|---|---|
| Providing the product to a restaurant | Contract |
| Taking payment | Contract |
| Booking confirmations and reminders | Contract, between guest and restaurant — these are service messages, not marketing |
| Marketing messages to guests | Consent, or the soft opt-in where the guest has booked before and was given a clear chance to refuse |
| Measuring visits to our public website and our Google ads, using cookies | Consent, given or refused in the cookie banner and changeable at any time |
| Security, fraud prevention, diagnosing faults | Legitimate interests |
| Keeping accounting records | Legal obligation |
Who else processes it
We use a small number of sub-processors. Restaurants will be told at least 30 days before we add one, and may object.
| Who | What for | Where |
|---|---|---|
| Supabase | Database and authentication | EU (London region) |
| Vercel | Application hosting | EU / UK edge |
| Stripe | Payments and card storage | EU / US — UK adequacy and SCCs |
| Twilio | Sending and receiving text messages | EU / US — UK adequacy and SCCs |
We do not sell personal data. Restaurant account data and guest data are never shared with advertisers, and there is no advertising inside Eightish or on any booking page. The only advertising technology we use is Google Analytics and Google Ads on our own public website, and only as described under Cookies.
How long we keep it
- Guest records — for as long as the restaurant’s account is open, because a guest history that expires is not a guest history. Restaurants can delete any guest at any time.
- After an account closes — exportable for 30 days, then deleted within 90 days.
- Consent records — kept for 6 years after the last contact, because they are the evidence that a message was lawful.
- Invoices and accounting — 6 years, as UK tax law requires.
- Technical logs — 90 days.
Text messages, opting out, and what STOP does
Every marketing message tells you how to stop. Replying STOP is honoured immediately and permanently for that restaurant, and recorded. You will still receive confirmations and reminders for bookings you actually make, because those are part of the booking, not marketing — if you do not want those either, tell the restaurant.
Replying CANCEL TABLE cancels your booking. It does not opt you out, and opting out does not cancel your booking. These are deliberately separate, because confusing them has real consequences at both ends.
Your rights
Under UK GDPR you can ask for access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Where consent is the basis, you can withdraw it at any time without affecting what came before.
Ask the right party: for booking and guest data, ask the restaurant, who decides. For account data, ask us. Either way we respond within one month.
If you are unhappy with how we have handled it you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first, but it is your right either way.
Security
Data is encrypted in transit and at rest. Access between restaurants is separated at the database level, so one venue’s staff cannot read another’s guests even if the application has a bug. Billing fields can only be written by our payment webhook, never by a browser. Access to production data is limited to those who need it and is logged — see the next section for exactly how.
If a breach affects your data and is likely to result in a risk to your rights, we will notify the ICO within 72 hours and tell affected restaurants without undue delay.
When we look inside your account
We will never ask a restaurant for their password, and we cannot read it — passwords are stored as hashes that nobody at Eightish can reverse. If someone claiming to be from Eightish asks you for one, it is not us.
Helping a restaurant sometimes means seeing what they are seeing. When it does, a member of Eightish staff opens a support session on that one restaurant. It is enforced by the database, not by the app, and it works like this:
- They stay themselves. Nothing signs them in as the restaurant, so anything changed during support is recorded as ours, not yours.
- They record a reason first, in their own words, before anything opens.
- Looking only, to begin with. Changing anything requires a separate deliberate step, which is recorded separately and expires after 15 minutes.
- One restaurant, one hour. Access is scoped to a single venue and ends automatically.
- Never your money. Support access cannot reach your card, your Stripe account, your billing portal, or take a deposit from a guest.
- You can see it. Every session appears in your app under Account → Support access — who, when, why, and whether anything was changed.
For guest data this is processing on the restaurant’s instructions under Article 28 UK GDPR, limited to providing and securing the service. For our own account data the basis is legitimate interests: running a product people can ring up about. A restaurant that would rather be asked first every time can tell us, and we will note it on their account.
Guests: this is why a member of Eightish staff may occasionally see a booking or a phone number. It is the same access your restaurant already has, held for a limited time, for a recorded reason, and visible to them.
Cookies
Inside Eightish (the app, the host stand and every restaurant’s booking page) we use only what it needs to work: a session cookie so you stay signed in, and local storage on the host stand so it keeps working through a wifi drop. No analytics or advertising cookies are ever set there, and diners booking a table are never measured by us.
On our public website (eightish.co.uk and the sign up page) we ask before setting anything. If you click Accept in the cookie banner, we use:
| Who | What for | Cookies |
|---|---|---|
| Google Analytics | Which pages are visited, how people arrive, and which buttons lead to a sign up | _ga, _ga_* (up to 2 years) |
| Google Ads | Telling us which of our ads led to a sign up or a call booking, so we stop paying for the ones that don’t | _gcl_* and Google’s own cookies (up to 90 days) |
If you click Reject, or do nothing, no Analytics or Ads cookies are stored on your device. Google’s tag still sends a cookieless signal that a page was viewed, without any identifier, which Google uses to estimate overall numbers. Your choice is remembered on your device for 12 months, and you can change it at any time with Cookie settings, also at the foot of every page.
Google acts as an independent controller for this data under its own privacy policy, and may process it outside the UK under appropriate safeguards. We switch off ad personalisation signals unless you accept, and we never send Google names, email addresses, phone numbers or anything a restaurant or guest enters into Eightish.
Children
Eightish is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16 other than a name that may appear in a party size.
Changes
Material changes are emailed to account holders 30 days before they take effect, and the version and date at the top of this page always tell you which version you are reading.