1. Scope and parties
1.1 This Data Processing Agreement ("DPA"), published at carbonaraapp.com/dpa, forms part of the Carbonara Terms of Use (the "Terms") between Carbonara, Inc., 606 Liberty Ave Suite 300 Box 2020, Pittsburgh, PA 15222, USA ("Carbonara"), and the business that uses the Carbonara services (the "Business"). It applies automatically, without signature, whenever Carbonara processes Guest Personal Data for a Business that is established in the EEA, the UK or Switzerland, or is otherwise subject to a Data Protection Law that requires it. A Business that wants a signed copy can request one at [email protected].
1.2 For Guest Personal Data, the Business is the controller and Carbonara is its processor. Carbonara processes that data only to provide the services described in the Terms and in Annex I.
1.3 This DPA does not cover data that Carbonara processes as a controller for its own purposes. That includes account administration and billing for the Business and its staff, Carbonara's own sales and marketing, product analytics, security monitoring and legal compliance. Carbonara's Privacy Policy covers that processing.
1.4 When a Business exports a marketing list or other Guest Personal Data out of the services, the Business is solely responsible for what it does with the exported data. This DPA governs the export itself.
1.5 If this DPA conflicts with the Terms, this DPA prevails for the processing of Guest Personal Data. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses prevail.
2. Definitions
Terms not defined here have the meaning given in the Terms or in the GDPR.
- Data Protection Law: the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), and the US state privacy laws listed in section 9, each to the extent it applies.
- Guest: a person whose details a Business, or the person themselves, enters into the services, such as a diner on a waitlist or a reservation.
- Guest Personal Data: personal data about Guests that Carbonara processes for a Business through the services, as described in Annex I.
- Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Guest Personal Data.
- Standard Contractual Clauses (SCCs): the clauses approved by European Commission Implementing Decision (EU) 2021/914.
- UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
- Sub-processor: a third party Carbonara engages to process Guest Personal Data, listed in Annex III.
- Controller, processor, process, data subject, supervisory authority: as defined in the GDPR.
3. Carbonara's obligations
3.1 Instructions. Carbonara processes Guest Personal Data only on the Business's documented instructions. The Terms, this DPA and the Business's settings and use of the services are those instructions. If Carbonara believes an instruction breaks Data Protection Law, it will tell the Business promptly. If the law requires Carbonara to process data in another way, it will tell the Business first unless the law forbids that.
3.2 Confidentiality. Only Carbonara staff and contractors who need access to provide or support the services can access Guest Personal Data. Each is bound by a confidentiality obligation.
3.3 Security. Carbonara keeps in place the technical and organisational measures in Annex II. It may update them, but not in a way that lowers the overall protection of Guest Personal Data.
3.4 Sub-processors. Carbonara uses sub-processors only as set out in section 4.
3.5 Data subject requests. If a Guest contacts Carbonara directly about their data, Carbonara will pass the request to the Business without undue delay and will not answer it itself unless the Business asks it to. The services let the Business view, correct and delete Guest records. Where the Business cannot meet a request through the services, Carbonara will help when asked, by exporting or deleting the Guest's data within 30 days of the request.
3.6 Other assistance. Taking into account the information available to it, Carbonara will reasonably help the Business meet its obligations on security, Personal Data Breaches, data protection impact assessments and prior consultation with supervisory authorities (GDPR Articles 32 to 36).
3.7 Deletion and return. At the end of the services, Carbonara deletes or returns Guest Personal Data as set out in section 7.
3.8 Information and audits. Carbonara makes available the information needed to show it complies with this DPA, and allows for audits, as set out in section 8.
3.9 Business's responsibilities. The Business is responsible for having a lawful basis for the Guest Personal Data it collects through the services, for giving Guests the information Data Protection Law requires, and for any consent it needs, including for marketing messages.
4. Sub-processors
4.1 The Business gives Carbonara general authorisation to use sub-processors. The current list is in Annex III and is kept up to date at carbonaraapp.com/subprocessors.
4.2 Carbonara will give at least 30 days' notice before adding or replacing a sub-processor, by updating that page and emailing the Business's account owner. Where a sub-processor gives Carbonara shorter notice of a change on its side, Carbonara will tell the Business as soon as it is told.
4.3 The Business may object on reasonable data protection grounds within the notice period, by writing to [email protected]. Carbonara will try in good faith to find a workable alternative. If it cannot, the Business may stop using the affected part of the services, or end the Terms, without penalty.
4.4 Carbonara puts a written agreement in place with each sub-processor that protects Guest Personal Data at least as well as this DPA, except SignalMash, which does not offer one. SignalMash receives only the phone number and message text needed to deliver SMS and automated voice calls to US and Canadian numbers. Carbonara remains responsible to the Business for each sub-processor's performance, including SignalMash's.
5. Personal Data Breaches
5.1 Carbonara will notify the Business without undue delay after becoming aware of a Personal Data Breach affecting its Guest Personal Data, and no later than 72 hours after confirming it.
5.2 The notice will describe, as far as Carbonara then knows: what happened, the categories and approximate number of Guests and records affected, the likely consequences, the steps taken or proposed, and a contact for more information. Where Carbonara cannot give all of this at once, it will give it in stages without further undue delay.
5.3 Carbonara will take reasonable steps to contain the breach and limit its effects, and will help the Business with any notice it must give to a supervisory authority or to Guests.
5.4 Notice goes to the email address of the Business's account owner. Notifying a breach is not an admission of fault.
5.5 Unsuccessful attempts that do not compromise Guest Personal Data, such as blocked log-in attempts, port scans or spam bookings caught by rate limits, are not Personal Data Breaches.
6. International transfers
6.1 Carbonara is based in the United States and its main hosting is in the United States (Annex III). Where Guest Personal Data is transferred from the EEA, the UK or Switzerland to Carbonara, the SCCs are incorporated into this DPA and apply as follows:
- Module: Module Two (controller to processor) where the Business is a controller; Module Three (processor to processor) where the Business is itself a processor.
- Clause 7 (docking clause): applies.
- Clause 9 (sub-processors): Option 2, general written authorisation, with the notice period in section 4.2.
- Clause 11 (redress): the optional wording does not apply.
- Clause 13 (supervision): the supervisory authority of the Member State where the Business is established.
- Clauses 17 and 18 (law and courts): the law and courts of Ireland.
- Annexes: Annex I.A and I.B are completed by Annex I of this DPA, Annex I.C by Clause 13 above, Annex II by Annex II of this DPA, and Annex III by Annex III of this DPA.
6.2 UK. For transfers subject to the UK GDPR, the UK Addendum is incorporated. Its Table 1 is completed with the parties' details in Annex I, Tables 2 and 3 by section 6.1 and the Annexes of this DPA, and in Table 4 neither party may end the UK Addendum under its Section 19.
6.3 Switzerland. For transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR are read as references to the FADP, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and "Member State" includes Switzerland.
6.4 Onward transfers. Where a sub-processor outside the EEA, the UK or Switzerland receives Guest Personal Data, Carbonara relies on that sub-processor's adequacy decision, Data Privacy Framework certification or standard contractual clauses, as set out in its DPA. SignalMash does not offer a DPA (section 4.4).
6.5 Carbonara is directly subject to the GDPR under its Article 3(2). If the European Commission adopts standard clauses for importers in that position, Carbonara may replace section 6.1 with them by notice to the Business.
7. Return and deletion
7.1 While the account is open, Carbonara keeps Guest Personal Data for as long as the Business uses the services, unless the Business deletes it sooner or asks Carbonara to.
7.2 Export. Within 30 days after the services end, the Business may ask for a copy of its Guest Personal Data. Carbonara will provide it in a common electronic format (CSV or JSON) within 30 days of the request.
7.3 Anonymisation. Within 90 days after the services end, Carbonara will irreversibly anonymise the Business's Guest Personal Data in its production systems. It removes or redacts all personal data, including Guest names, contact details, notes and message content, and keeps the remaining records, which no longer identify any Guest, for statistics. On request, Carbonara will confirm in writing that it has done so.
7.4 Backups and logs. Copies that remain in backups and logs are deleted as those age out: backups after 14 days, application logs after 30 to 90 days depending on the system (Annex II). Until then they stay protected under this DPA and are not used for any other purpose.
7.5 Sub-processors. Messaging, email and analytics providers keep their own copies (for example message delivery records) for the periods in their own terms. Carbonara does not send them separate deletion requests unless the Business asks it to for a specific Guest.
7.6 Carbonara may keep Guest Personal Data longer only where the law requires it, and then only for that purpose.
8. Information and audits
8.1 On written request, Carbonara will answer the Business's reasonable questions about its processing of Guest Personal Data, and provide copies of the relevant parts of its sub-processors' security documentation and certifications.
8.2 If that information is not enough to show compliance, or a supervisory authority requires it, the Business may audit Carbonara's compliance with this DPA, itself or through an independent auditor bound by confidentiality. The Business must give at least 30 days' written notice. Audits take place once a year at most, during business hours, and remotely unless an on-site visit is needed.
8.3 Each party pays its own costs of an audit. Carbonara may charge reasonable costs for time beyond two business days per year.
8.4 Audits do not extend to sub-processors' facilities. For those, Carbonara relies on the sub-processors' own certifications and audit reports.
9. US state privacy terms
9.1 This section applies where the California Consumer Privacy Act as amended (CCPA) or a similar US state privacy law applies to Guest Personal Data. Carbonara acts as the Business's "service provider" or "processor" under that law.
9.2 Carbonara will not:
- sell or share Guest Personal Data, as those terms are defined in the CCPA;
- keep, use or disclose it for any purpose other than providing the services under the Terms, or outside the direct business relationship with the Business;
- combine it with personal data Carbonara receives from other sources, except as the CCPA allows for service providers.
9.3 Carbonara will comply with the obligations that apply to it under the CCPA and give Guest Personal Data the level of privacy protection the CCPA requires. It will tell the Business if it can no longer meet those obligations.
9.4 The Business may take reasonable steps to stop and fix any unauthorised use of Guest Personal Data by Carbonara.
9.5 Carbonara certifies that it understands and will comply with this section 9.
10. General terms
10.1 Term. This DPA applies for as long as Carbonara processes Guest Personal Data for the Business, and survives the end of the Terms until that processing stops.
10.2 Liability. Each party's liability under this DPA is subject to the limits in the Terms. Nothing in this DPA limits either party's liability to Guests under the SCCs.
10.3 Changes. Carbonara may update this DPA to reflect changes in Data Protection Law or in the services. It will give 30 days' notice of any change that reduces the protection of Guest Personal Data, and the Business may end the Terms if it objects.
10.4 Law and courts. Apart from section 6, this DPA is governed by the law and courts set out in the Terms.
10.5 Representatives and contacts. Carbonara's privacy contact is Luke Panza, CEO, [email protected]. Carbonara has appointed representatives under GDPR Article 27 and UK GDPR Article 27:
- EU: Euverify Ltd (Ireland), Unit 3D, North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland
- UK: Euverify Ltd (UK), 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom
- Contact for both: [email protected]
Annex I: Description of the processing
A. Parties
| Data exporter | Data importer | |
|---|---|---|
| Name | The Business, as named in its Carbonara account | Carbonara, Inc. |
| Address | As given in the Business's account | 606 Liberty Ave Suite 300 Box 2020, Pittsburgh, PA 15222, USA |
| Contact | The account owner | Luke Panza, CEO, [email protected] |
| EU / UK representative | As applicable to the Business | Euverify Ltd (Cork, Ireland) / Euverify Ltd (London, UK), [email protected] |
| Role | Controller (or processor for its own client) | Processor |
| Activities | Using the Carbonara services | Providing the Carbonara services |
| Signature and date | Accepted by using the services under the Terms | Accepted by offering the services under the Terms |
B. Description of the transfer
Data subjects: Guests of the Business: people who join a waitlist, make or change a reservation, receive messages about their visit, place a deposit or pre-order, or leave feedback.
Categories of personal data:
- Identity and contact: name, phone number, email address, WhatsApp user ID, and the Google user ID for bookings made through Google.
- Visit details: party size and type, booking channel, reservation and arrival times, quoted and actual wait times, seating area and table, visit status, and a history of changes to the Guest's details.
- Notes and requests: free-text notes entered by the Guest or the Business, and answers to custom fields the Business sets up.
- Context flags: yes/no flags for wheelchair access, pregnancy, children, child seat and dog.
- Messages: the content of SMS, WhatsApp and email messages between the Business and the Guest, and their delivery status; automated voice calls to the Guest and their call logs (calls are not recorded).
- Payments: deposit and pre-order amounts, items and status, deposit history, and Stripe customer and payment IDs. Card details are entered directly with Stripe and Carbonara does not receive them. Pre-orders are no longer offered; past pre-orders stay stored until the Business's Guest Personal Data is anonymised (section 7.3).
- Feedback: survey answers and ratings the Guest submits.
- Technical: IP address and browser details when a Guest uses Carbonara's booking or waitlist pages. The IP address goes to Cloudflare Turnstile when anti-bot checks are on; otherwise Carbonara keeps only a salted hash of it, for rate limiting and message links.
Sensitive data: the wheelchair and pregnancy flags are health data. Free-text notes may contain allergies, dietary needs or other health information if a Guest or the Business enters it. Safeguards: this data is used only to serve the Guest at the Business; the services show it to Business staff with access to the waitlist or reservations; since app version 3.11.0 it is not sent to product analytics (older app versions still in use send the wheelchair and pregnancy flags, see Annex II, 3); and the wait-time model uses the flags without names or contact details. The wheelchair flag is kept in the wait-time model's training data for up to 14 months; the pregnancy flag is not kept there. Annex II applies to all of it.
Frequency: continuous, for as long as the Business uses the services.
Nature of the processing: collecting, storing, organising, displaying, sending messages and making automated voice calls, calculating wait times and table availability, producing reports for the Business, exporting and deleting.
Purpose: to provide the services to the Business: managing its waitlist and reservations, notifying Guests, managing tables, taking deposits and pre-orders, reporting to the Business, and supporting it.
Retention: as set out in section 7.
Transfers to sub-processors: as listed in Annex III, for the purposes stated there and for the duration of the services.
C. Competent supervisory authority: as set out in section 6.1 (Clause 13).
Annex II: Technical and organisational measures
Carbonara is a small team running on managed cloud infrastructure. These are the measures in place today.
1. Encryption
- All traffic between the apps, browsers, Carbonara's servers and its sub-processors that carries personal data uses HTTPS (TLS).
- Data at rest, including databases, file storage and backups, is encrypted by the hosting provider (Google Cloud default encryption).
- Application secrets are held in Google Secret Manager or in access-restricted configuration, not in source code.
2. Access control
- Every Carbonara product uses Firebase Authentication. Each Business user has their own login, and access is limited to the restaurants their account belongs to.
- Access to production systems is limited to named members of Carbonara's team, currently five people. Cloud infrastructure accounts use Google sign-in with two-factor authentication on every account that can access customer data.
- Access is granted when someone joins and removed when they leave.
- Everyone with access is bound by a confidentiality obligation.
3. Data minimisation
- Since app version 3.11.0, product analytics events do not contain Guest names, notes, contact details or health-related flags. Older app versions still in use send the wheelchair and pregnancy flags, and versions before 3.10.0 also send Guest names, phone numbers and notes. Those events are kept for 2 years (section 4).
- Session replays record about 10% of mobile sessions and mask text and images. App versions before 3.12.1 do not mask the table management screen on phones or the pregnancy icon, and versions before 3.7.0 record without masking.
- Phone numbers and email addresses are masked in back-end logs.
- The wait-time model uses visit details and context flags without names or contact details.
- Locally stored chat messages are cleared from a device when the user logs out.
4. Logging and monitoring
- Application and infrastructure events are logged centrally. Logs are kept for 30 days (Google Cloud Logging), 35 days (Logz.io) and 90 days (error monitoring, self-hosted in the EU).
- Product analytics events are kept for 2 years and session replays for 30 days.
- High-risk endpoints are rate-limited, with alerts on unusual volumes and on messages to unusual country codes.
- Public booking and waitlist pages are protected by Cloudflare bot protection and Firebase App Check, with an additional challenge (Turnstile) available per restaurant.
5. Availability and backups
- The production database is backed up daily. Backups are encrypted and kept on a rolling 14-day cycle.
- Code is held in version control, so changes can be rolled back.
- Hosting runs on Google Cloud's managed services, across its availability zones.
6. Physical security
- Carbonara has no data centres of its own. It relies on the physical security of its hosting providers, each certified to ISO 27001 (Google Cloud, Hetzner, Heroku/Salesforce).
7. Sub-processor management
- Before using a new provider for Guest Personal Data, engineering reviews its security, data location and API.
- Carbonara puts a data processing agreement in place with each sub-processor (Annex III), except SignalMash, which does not offer one (section 4.4).
8. Incident response
- Carbonara's head of engineering leads the response to any suspected incident, with the CEO deciding on notifications.
- The first step is to contain the incident and close the gap. Personal Data Breaches are notified to affected Businesses under section 5.
9. Helping Businesses with Guest requests
- Businesses can view, correct and delete Guest records in the services.
- Carbonara can export or delete a Guest's data on request, as set out in section 3.5.
Annex III: Sub-processors
Carbonara uses these 17 sub-processors for Guest Personal Data. The live list is at carbonaraapp.com/subprocessors.
| Sub-processor | What it does | Guest data it receives | Where data is stored |
|---|---|---|---|
| Google LLC (Google Cloud, Firebase) | Hosting, database, login, file storage, push notifications | All Guest Personal Data | United States |
| Salesforce, Inc. (Heroku) | Hosts the statistics service behind Business reports | Visit, deposit, order and message-delivery details and Guest phone numbers, without message or note text | United States |
| Hetzner Online GmbH | Hosts Carbonara's own error-monitoring and reporting tools | Error reports and statistics that can include Guest details | Finland (EU) |
| Cloudflare, Inc. | Protects and delivers the booking and waitlist pages | Page traffic in transit, IP addresses | Global network |
| Mitto AG | SMS and WhatsApp delivery | Phone number, message text | Europe (Microsoft Azure); Mitto is in Switzerland |
| Bird B.V. (formerly MessageBird) | SMS and MMS delivery in some countries, and automated voice calls in the EU | Phone number, message text | EU (Netherlands, Belgium) |
| Messente Communications OÜ | SMS delivery in some EU countries, Australia and Switzerland | Phone number, message text | EU (Germany, Finland) |
| SignalMash | SMS and automated voice calls to US and Canadian numbers only | Phone number, message text | United States |
| Meta Platforms Ireland Ltd (WhatsApp) | WhatsApp message delivery | Phone number, message text | United States and other countries |
| Twilio Inc. (SendGrid) | Booking and account emails | Email address, name, booking details | United States |
| Logshero Ltd (Logz.io) | Back-end log storage and search | Log entries, which can include Guest details | United Kingdom (support from the US and UK) |
| Mixpanel, Inc. | Product analytics | Usage events and session replays, masked as described in Annex II, 3. Since app version 3.11.0, without Guest names, contact details or health-related flags; older app versions still in use send the wheelchair and pregnancy flags, and versions before 3.10.0 also send Guest names, phone numbers and notes | United States |
| Stripe, Inc. / Stripe Payments Europe Ltd | Deposits and pre-orders | Card details, name and email address the Guest enters, amounts | United States / Ireland |
| Google LLC (Google Workspace) | Support email and documents | Guest details in support requests | Global |
| Elastic Inc. (Close) | Customer records and support conversations with Businesses | Guest details a Business shares when it asks for support, for example about a specific booking | United States |
| TimelinesAI LLC | Support conversations with Businesses | Guest details a Business shares when it asks for support, for example about a specific booking | EU (AWS, Google Cloud, Microsoft Azure; some integrations may run in the United States); TimelinesAI is in the United States |
| Botpress Technologies Inc. | In-app AI support assistant for Business staff; uses Google's Gemini AI model to generate answers | Only Guest details a Business user types into the assistant, which the Terms ask users not to do | United States |
Reserve with Google, Apple's App Store and Google Play receive data as independent controllers under their own terms, so they are not sub-processors.
Carbonara's marketing website, including this page, runs on Strapi hosted by Salesforce, Inc. (Heroku) in the United States. It holds website content only and no Guest Personal Data, so its host is not a sub-processor under this DPA.