Privacy Policy
Last updated: September 2026
This Privacy Policy describes how Miso (“we”, “our”), publisher of the Miso Resa platform, collects, uses, shares, and protects personal data in connection with the Site and the Miso Resa application.
1. Who is responsible for what
Two roles coexist in Miso Resa, and they do not carry the same obligations.
Miso is the controller for the data of restaurant operators and their teams: account creation and management, billing, security, support, and service improvement.
The restaurant is the controller for the data of its own guests (the people who book a table). The restaurant decides why and how that data is used. Miso then acts as a processor within the meaning of Article 28 GDPR: we process that data on the restaurant's instructions, under the data processing agreement appended to our Terms.
In practice, a person who has booked a table and wishes to exercise their rights can contact the restaurant concerned, or write to us: we will forward their request to the restaurant and assist in handling it.
The publisher:
Miso, a French SAS with a share capital of €10,000, registered under SIREN number 105 989 305 (RCS Rennes), whose registered office is located at 2 rue de la Mabilais, 35000 Rennes, France.
For any question regarding your personal data: contact@misogroup.ai
2. Who this policy applies to
Miso Resa connects two categories of individuals, whose data is processed differently:
- Restaurant operators and their teams (Owner, Manager, Staff): users who hold a Miso Resa account to manage their establishment.
- Restaurant guests: people who book a table through the online booking module, the AI voice agent, WhatsApp, or whose reservation is entered by the restaurant.
3. Data we collect
3.1 Operator accounts (Owner / Manager / Staff)
- Identity: first name, last name, email address, phone number
- Login credentials, or Google identifier if signing in with Google Sign-In
- Restaurant information: name, address, opening hours, floor plan configuration, menu
- Billing data: handled by our payment provider (see 5.)
- Login and platform usage logs
3.2 Guests (people booking a table)
- Identity: first name, last name, phone number, email address
- Reservation details: date, time, party size, assigned table, special requests entered as free text
- Dietary preferences and restrictions, including allergens: this data may constitute health data within the meaning of Article 9 GDPR. It is entered either by the person themselves in the special requests field, or by the restaurant on the guest record, based on what the person told them. It is used solely to prepare the service. Collecting explicit consent is the restaurant's responsibility, as controller.
- Reservation history, reliability status (calculated from no-shows and cancellations), VIP status
- Content of exchanges with the AI voice agent (call transcript) or the WhatsApp agent, to the extent necessary to handle the booking request
- Data transmitted by third-party booking channels (WhatsApp, phone)
3.3 Data from the Google Business Profile connection
When a restaurant operator connects their Google Business Profile account to Miso Resa, we access, with their explicit authorisation (OAuth), the following data:
- Public business listing information (name, address, opening hours, category)
- Customer reviews (Google Reviews) left on the business listing
3.4 Data from the POS integration
If the restaurant connects its point-of-sale system (Zelty, or other POS systems in future), we receive receipts (amounts, timestamps) in order to enrich attendance statistics and the guest profile.
4. Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Providing the booking service and managing the account | Performance of the contract |
| Automatic table placement and AI recommendations | Legitimate interest (optimising the service for the restaurant) |
| Sending reservation-related notifications (confirmation, reminder, modification, cancellation) | Performance of the contract |
| Sending marketing communications | Consent (opt-in), revocable at any time |
| Managing allergens and dietary preferences | Explicit consent, collected by the restaurant |
| Billing and payment | Performance of the contract / legal obligation |
| Security, fraud prevention, no-show detection | Legitimate interest |
| Service improvement | Legitimate interest |
5. Data sharing: recipients and subprocessors
We do not sell personal data. We do not share data with third parties for advertising purposes.
To operate the Service, we rely on technical subprocessors, which process data on our behalf, on our instructions, and strictly for the purposes described above. They fall into the following categories:
| Category of recipient | Role | Data concerned |
|---|---|---|
| Application and database hosting | Hosting of the application, the database and files | All platform data, browsing logs |
| Telephony and messaging | Phone numbers, inbound calls, SMS, WhatsApp, transactional email | Phone number, email address, message and call content |
| Voice agent and speech synthesis | AI voice agent orchestration and voice generation | Call content, reservation data |
| AI model providers | AI features (table placement, analytics, conversational agents) | Only the data required for the relevant feature. No data is used to train these providers' models. |
| Payment provider | Subscription payment and billing | Payment data. Miso Resa never stores card details. |
| Point-of-sale systems (POS) | POS synchronisation, at the restaurant's request | Receipts, floor plan |
| Sign-In and Google Business Profile | Google ID, email, customer reviews, business listing |
The named, up-to-date list of our subprocessors is appended to the data processing agreement provided to our business customers on subscription. It is also provided to anyone who requests it at contact@misogroup.ai. Any change of subprocessor is notified to our business customers before it takes effect, with a right to object under the conditions set out in the agreement.
6. Transfers outside the European Union
Database hosting and the application's main compute are configured within the European Union. Primary storage and processing therefore remain in the EU.
Transfers outside the EU nevertheless occur:
- Some of our providers are US companies. Even with infrastructure configured in Europe, certain technical data (notably IP addresses, required for protection against attacks) passes through their infrastructure, and these providers may transfer data to the United States in the course of their business.
- Some telephony, speech synthesis and AI model providers may process data outside the EU, depending on their own infrastructure.
These transfers are governed by the European Commission's Standard Contractual Clauses and, where the provider is certified under it, by the EU-U.S. Data Privacy Framework, mechanisms recognised under the GDPR for transferring data outside the EU.
7. Retention periods
- Operator account data: for the duration of the contractual relationship. At the end of the contract, the restaurant has 30 days to retrieve its data, which is then deleted from our production systems within 30 days, and purged from our backups within a maximum of 90 days.
- Guest profile (contact details, preferences, history): automatically anonymised after 36 months with no new reservation. This period is configurable by the restaurant (Owner) in its settings, between 1 and 120 months. Anonymisation covers the guest record and every record attached to it: reservations, waitlist entries, notification dispatch logs and voice calls.
- AI voice call recordings: no audio recording is retained by Miso Resa.
- AI voice call transcripts and content: retained for no more than 90 days, then deleted. Only a structured summary, containing no verbatim data, is kept on the guest record and then follows the guest profile retention period.
- WhatsApp conversation history: deleted within 90 days of a request to stop from the person concerned.
- Transactional notifications (email, WhatsApp, SMS): we keep a record of each dispatch (channel, date, recipient, delivery status), attached to the relevant reservation and retained for the same period as that reservation. These messages are necessary to perform the booking and do not constitute marketing: they are not subject to opt-out.
- Billing data: statutory accounting retention period (10 years).
8. Data security
We implement appropriate technical and organisational measures to protect data, including:
- strict separation between establishments: each restaurant can only access its own data, enforced at the database level and not only in the application;
- role and permission management per user;
- encryption of data in transit, and encrypted storage of secrets and third-party service credentials;
- authentication by strong password or via Google Sign-In;
- logging of access and sensitive changes;
- regular backups.
9. Your rights
Under the GDPR, every data subject has the following rights over their data:
- Right of access and rectification
- Right to erasure
- Right to restriction of processing
- Right to object
- Right to data portability
- Right to withdraw consent at any time (without retroactive effect)
- Right to lodge a complaint with the CNIL (cnil.fr)
For operator account data, these rights are exercised with Miso: contact@misogroup.ai.
For guest data, the controller is the restaurant. Requests should be addressed to it directly. If a request reaches us, we forward it without delay to the restaurant concerned and assist in handling it, in accordance with Article 28 GDPR.
10. Use of data from Google APIs
Miso Resa offers sign-in via Google Sign-In (account creation / login) and an integration with Google Business Profile (review management, business listing). Miso Resa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:
- Data obtained via Google APIs (identifier, email, Google reviews, business listing information) is used solely to provide and improve user-facing features (account sign-in, displaying and managing customer reviews).
- This data is never sold to third parties.
- This data is never used for advertising purposes, including advertising remarketing.
- This data is not used to train generalised artificial intelligence models.
- Access to this data can be revoked at any time by the user from their Google account settings (myaccount.google.com/permissions) or from the Miso Resa settings.
11. Cookies
The Site uses two categories of cookies.
Strictly necessary cookies. They keep the Site and the application working (session, authentication) and remember your cookie choice (miso_consent, kept for 6 months). They do not require consent.
Analytics cookies. Only with your consent, we use Google Analytics to measure how the presentation pages of the Site are used (page views, where visits come from, clicks on buttons) and to improve them. The _ga and _ga_<identifier> cookies are then set for up to 13 months. Until you accept, none of these cookies is set and no data is sent to Google. We use no advertising cookies, and what you type in our forms is never sent to the analytics tool.
This data is processed by Google Ireland Limited, which may transfer it to Google LLC in the United States, under the conditions described in section 6.
You can change your choice or withdraw your consent at any time, through the “Cookie settings” link at the bottom of the presentation pages of the Site. Withdrawing removes the analytics cookies from your browser.
12. Minors
Miso Resa is not intended for minors under 15 and the Site does not knowingly solicit data from this population.
13. Changes to this policy
We may amend this privacy policy. Any substantial change will be notified to users (in-app banner and/or email) before it takes effect, and fresh consent will be sought where necessary, in particular regarding the use of Google data.
14. Contact
For any question regarding this policy or your personal data: contact@misogroup.ai