Privacy Policy
This policy explains what personal data EnoList (enolist.com) collects, why, and how it is processed, under EU Regulation 2016/679 (GDPR).
1. Data controller
EnoList — contact: edo.enolist@gmail.com
2. Data we collect
- Owner accounts: first name, last name, email, password (stored only in encrypted form), venue name and address.
- Venue content: menus, products, prices, images, opening hours, shifts and notes entered in the dashboard.
- Reservations: name, phone, date, time, party size and notes entered by guests in a venue's booking form.
- Payments: handled by Stripe. EnoList never sees or stores card details; it only receives the subscription status.
- Technical data: IP address and browser data processed by our hosting providers for security and operation of the service.
3. Purposes and legal bases
- Providing the service and managing your account — performance of a contract (Art. 6(1)(b) GDPR).
- Managing subscriptions and billing — contract and legal obligations (Art. 6(1)(b) and (c)).
- Security and abuse prevention — legitimate interest (Art. 6(1)(f)).
- Service emails (e.g. password reset) — performance of a contract.
We do not sell data and do not use it for advertising.
4. Reservations and venue guests' data
For data entered by a venue's guests (e.g. reservations), the venue is the data controller; EnoList acts as data processor and uses this data only to provide the service to the venue.
5. Providers (data processors)
- Cloudflare, Inc. — website hosting and database.
- Stripe, Inc. — payments and subscriptions.
- Google LLC — Sign in with Google (if used) and typefaces (Google Fonts).
- Resend, Inc. — service emails.
Some providers may process data outside the EU; such transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
6. Cookies
We only use one technical cookie needed to keep you signed in to the dashboard (el_session). We use no profiling cookies or third-party analytics, so no consent banner is required.
7. Retention
Account data is kept while the account is active. If you request deletion, we delete the account and its content within 30 days, except data we must keep by law (e.g. tax records). Reservations are kept until the venue deletes them or closes its account.
8. Your rights
You can request access, rectification, erasure, restriction, data portability or object to processing at any time by writing to edo.enolist@gmail.com. You also have the right to lodge a complaint with your data protection authority.
9. Minors
The service is intended for business owners and is not directed at people under 18.
10. Changes
We may update this policy; the date above shows the latest version. We will notify registered users by email of significant changes.