Privacy

1. Who we are

NODO is operated by [LEGAL ENTITY — TODO].

Business address: [BUSINESS ADDRESS — TODO].

Privacy contact: [PRIVACY CONTACT EMAIL — TODO] (currently routing via hello@nodo.house until a dedicated address is set).

We operate initially with a focus on the Netherlands / EU. Exact controller details: [TODO LEGAL].

2. What data we collect

Depending on what you choose to submit, we may collect:

• Email address
• Optional first name
• Table notify / waitlist interest (which table, timestamps)
• OFF MENU interest
• Optional marketing preference (only if you opt in)
• City suggestions (city name only on that form)
• Booking details when reservations are open (name, email, optional phone, seat count, acknowledgements)
• Dietary / allergy information when you provide it for a booking — treated with extra care (TODO LEGAL REVIEW)
• Limited technical / event signals in your browser for product learning (no third-party analytics SDK today)

We do not ask for information we do not need for the purpose you requested.

3. Why we use it

Purposes are separated. Examples:

• Table notify / waitlist — email you about the specific NODO TABLE you asked about
• OFF MENU updates — keep you posted about OFF MENU when you asked us to
• Booking — manage a reservation / transaction when booking is open
• Optional marketing — future NODO tables, drops and news only where you opted in
• City signal — understand geographic interest
• Security / abuse prevention where needed

Submitting a table notify or OFF MENU form does not automatically enrol you in general marketing.

4. Legal bases

Depending on the processing, bases may include consent, steps at your request prior to a contract, performance of a contract, legal obligation, and/or legitimate interests. Exact mapping per purpose: [TODO LEGAL REVIEW].

5. Who receives data

We do not sell your personal information. Providers that help us run the site may process data on our instructions:

• Form handling / intake: Formspree — All website form submissions currently POST to one Formspree endpoint.
• Hosting: Vercel — Site hosting / deployment. Confirm DPA and transfer mechanisms.
• Email delivery: [TODO LEGAL] — How Formspree emails are read/archived; any ESP for campaigns.
• Payments: [TODO LEGAL — not connected] — Checkout provider is not live (code stub only).
• Analytics: None (third-party) — Only local in-browser event buffer; no third-party analytics SDK.

Future OFFMENU restaurants / creators are not given access to NODO waitlists by default.

6. International transfers

Some providers may process data outside the EEA. Transfer mechanisms and locations: [TODO LEGAL — confirm Formspree / Vercel docs].

7. Retention

We keep information no longer than needed for the purpose it was collected, subject to legal requirements. Specific periods per category: [TODO — set retention]. Marketing stops when you unsubscribe; that does not automatically erase booking records we must keep for another lawful reason.

8. Your rights

Where GDPR applies, you may have rights to access, correct, delete, restrict, object, portability, and withdraw consent. You may also complain to the competent supervisory authority (e.g. Autoriteit Persoonsgegevens in the Netherlands). Contact hello@nodo.house.

9. Marketing

Optional marketing uses an unchecked checkbox and is stored separately from table notify / OFF MENU / booking purposes. Unsubscribe anytime via email links (when campaigns are sent) or by writing to us. Withdrawing marketing consent does not cancel a booking.

10. Cookies & similar tech

See our Cookie notice. We do not currently run third-party advertising or analytics pixels.

11. Changes

We may update this notice. The “Last updated” date at the top will change when we do. Material changes will be handled thoughtfully.

Legal entity shown above: [LEGAL ENTITY — TODO]. Address: [BUSINESS ADDRESS — TODO].