Privacy

Controller and scope

The controller is the company identified above. Its registered office is distinct from the restaurant’s operating address. To exercise a data right, use the Contact page and select “Privacy / personal data”. The request is tracked in the administration; identity verification limited to what is necessary may be requested before any action.

Data, voluntary submission and purpose

The forms collect a name, contact method and message. The contact form also collects an enquiry category; the group form collects the requested date and time, guest count and event type. Providing the information is voluntary and it is used only to handle and reply to the enquiry. Without a name and contact method, the team cannot reply.

The concierge records exchanged messages, language, replies and handling status. When a later reply is required, the email address and transactional consent are stored solely to send the approved reply and a secure recovery link, without marketing. For a group enquiry, information is recorded progressively and contact details are requested only at the end of the flow. For a dietary or accessibility requirement, provide only the practical need, without a diagnosis or medical detail.

Do not include a name, email, phone number, payment details, identity documents, medical information or severe allergy details in chat; use the separate form for contact details. The information is not reused for marketing.

Recipients and security

Access is limited to authorised restaurant staff and the necessary providers: OpenAI for ChatGPT Sites and the concierge API, Cloudflare infrastructure and its D1 database, Resend (Plus Five Five, Inc.) for transactional alerts and replies, and Google for the internal Gmail inbox. To generate a reply, the site sends the filtered free-text message and recent context, the language, a pseudonymous technical identifier and only relevant verified public information to the OpenAI API. Separate name, email and phone fields are excluded; detectable contact details in text are rejected before storage. A free-text answer about a dietary or accessibility need is processed once as a message, then its structured value is removed from later model context. The reply request uses store:false. OpenAI has no access to the administration, Ontopo or unpublished information.

When you send a voice note, its audio recording is sent to OpenAI for transcription before text filtering. Avoid speaking personal or sensitive information. The restaurant does not retain the audio file; the transcript follows the processing and retention rules for concierge messages. Playback is temporarily available in the open page.

An internal alert contains only the category, urgency, a reference and a restricted administration link; it contains no name, contact details or conversation content.

The site uses HTTPS, restricted administration and delivery logs. No security measure removes all risk; access rights and providers must be reviewed regularly.

Retention and deletion

The first paragraph below covers Contact/Group forms and analytics. Concierge conversations use the separate retention starting points described further below.

The active policy applies only to data recorded from its activation on 2 September 2026. In temporary manual mode, it makes free text eligible for deletion 30 days after closure, a closed enquiry 90 days after the later of creation or event date, any remaining enquiry after 365 days using the same reference point, and individual analytics events after 90 days. Earlier data is excluded from deletion. Victor expressly starts each maintenance run; viewing a page or conversation never starts cleanup. These periods define eligibility, not proof that deletion has already happened. A technical log keeps only dates, statuses and aggregate counters, without personal content. Temporary recovery copies may remain under Cloudflare D1 technical retention periods; Resend states that it keeps email data for 30 days by default.

Applicable requests for access, correction or deletion may be sent with the “Privacy / personal data” subject on the Contact page. A dispute or separate legal obligation may require longer retention.

For new conversations, messages and structured information become eligible for erasure 30 days after resolution or closure; the remaining record — follow-up email, consent proof, alerts, decisions, delivery statuses and recovery links — becomes eligible for deletion after 90 days. An unresolved conversation becomes eligible for deletion after 365 days without an update. The strictly necessary HttpOnly cookie expires after 365 days; a link sent or provided to the guest expires after 90 days. These tokens are cryptographically secure and only their hashes are stored. Abuse-prevention fingerprints are no longer used after 48 hours; they then become eligible for deletion during the next expressly initiated manual maintenance run. No deletion is applied retroactively.

Analytics and transfers

The site code includes no advertising, marketing pixels or third-party analytics. Restaurant analytics events contain only action type, language, an approved site location, a source category and a test indicator. No name, contact details, message, visitor identifier, referring URL or search term is recorded in these events. A source category is kept in the tab’s session storage for 30 minutes of inactivity, without an individual identifier. Booking links pass this category to Ontopo in the source parameter. Reservation snapshots in the administration contain only totals by period, source, service and status, without customer identity.

ChatGPT Sites does not guarantee data residency in Israel, so processing outside Israel is possible. By default, the OpenAI API may retain abuse-monitoring logs for up to 30 days and does not use API data to train its models unless the customer explicitly opts in. Resend retains email and log data for 30 days on its standard plans and processes data in the United States; Google may also process the Gmail alert outside Israel. These providers, their contractual safeguards and subprocessors must be reviewed periodically.

Rights and legal framework

Israeli law provides rights including access and correction where data is inaccurate, incomplete, unclear or out of date. Requests are verified before action. This page describes the site’s actual operation; it is not a general legal-compliance guarantee.