Privacy Policy
Last updated: October 27, 2026
Who we are
Profilapp provides booking pages to restaurants and independent professionals. For the details your guests enter when booking (name, phone, email, note), the restaurant or professional is responsible for that information; Profilapp processes it on their behalf, as a service provider, following their instructions and this policy.
What we collect
Restaurants and professionals: account email, name, phone (optional), page content, menu or services, hours and settings. Guests who book: name, phone, email (optional), party size, date and time, optional note, how they plan to pay at the restaurant (card or cash, for information only) and their consent choices (WhatsApp reminders, the restaurant's offers). Nothing is paid online. Page visits are counted with a salted daily hash: we never store raw IP addresses and use no advertising cookies.
How we use it
Only to manage the reservation (request, confirmation, reminder, changes, cancellation), protect the service from abuse and show statistics to the restaurant or professional. A restaurant's offers are only sent if you agreed by ticking the box; every such message has an unsubscribe link. We don't sell personal information or use it for advertising.
Health and sensitive data
Please don't enter medical history or other sensitive information in booking notes. Only include what the service needs (for example an allergy the restaurant should know about).
Service providers
Supabase (database, authentication, storage — European Union, Ireland), Vercel (hosting, servers in Ireland, and anonymous cookie-free analytics — United States and global network), Resend (email — United States), Cloudflare Turnstile (bot protection), Meta WhatsApp (only if you accept WhatsApp messages), Google (sign-in with Google if you choose it; Google Calendar if a professional connects it; Google Places to find a restaurant's public listing during setup — United States), PayPal (subscription billing for restaurants and professionals; Profilapp never sees card numbers), and, when a restaurant imports its menu, DeepSeek (China) and OpenStreetMap (finding the venue). DeepSeek only receives the menu the restaurant provides — text from its website, pasted text, or text read from its menu photos or PDFs on our own servers — and, for a suggested description, the restaurant's name, cuisine, address and dish names. It never receives guests' information. These providers are bound by confidentiality and security commitments.
Transfers outside Quebec and Canada
Your information is hosted and processed outside Quebec and Canada (European Union and United States; for menu imports only, China, which never receives guests' information). Before these transfers we assessed the sensitivity of the information, the purpose, the safeguards (encryption in transit and at rest, access control, contractual commitments) and the applicable legal framework, as Quebec's Law 25 requires.
Google Calendar and Google Meet
If a professional connects their Google account, Profilapp only asks to manage events in their calendar (calendar.events) and their email address, to add confirmed bookings and create Google Meet links for online appointments. Each confirmed booking is added to the professional's own Google Calendar with the client's name, email, phone number and note, and the client is invited to the event so they can join the Meet. Google (United States) processes this information as the professional's provider. We don't read their other events, and this data is used for nothing else. The professional can disconnect at any time from Settings.
Retention and destruction
Reservation details are kept for the restaurant's or professional's guest history while their account is active. For restaurants, a guest's name, phone number, email and notes are erased automatically 3 years after their last reservation; the old reservations remain only as anonymous numbers (date, party size) for statistics. A guest a restaurant has declined is kept only while the restaurant keeps them declined. Everything is destroyed when the account is deleted (from Settings) or on request. Technical logs and (anonymous) visit statistics are kept for a limited time.
Your rights
You can ask to access your information, correct it, delete it, receive it in a structured, commonly used technological format (portability), withdraw your consent (for example to offers or WhatsApp reminders) and ask for de-indexing. Write to support@profilapp.com: we reply within 30 days. In Quebec you can also complain to the Commission d'accès à l'information (cai.gouv.qc.ca); elsewhere in Canada, to the Office of the Privacy Commissioner (priv.gc.ca).
Person in charge of the protection of personal information
The person in charge of protecting personal information at Profilapp is its Founder and Director, who acts as Privacy Officer. Contact them at support@profilapp.com with "Privacy" in the subject line.
Confidentiality incidents
We keep a register of confidentiality incidents. If an incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information or the Office of the Privacy Commissioner, the people concerned and the affected restaurant or professional.