Privacy policy
How we handle personal data
Last updated 28 October 2026 · Published in Estonian and English; both say the same. Tell us if they differ.
In short
- 86d OÜ decides how data is used on 86d.io, in 86d accounts and in the 86d sign-in that restaurant guests use.
- A restaurant’s guest data belongs to that restaurant. We process it on its instructions, so ask the restaurant first.
- 86d.io, the console and the guest pages run in Frankfurt. Where data leaves the European Economic Area, the safeguards are in "Data outside the EEA".
- Questions and requests: hello@86d.io.
What we never do
- Sell your data.
- Use it to target advertising.
- Send restaurant guests marketing from 86d.
- Let one restaurant see what you did at another.
Who we are
86d OÜ, registered in Estonia under code 17551617 at Kadaka pst 169b-10, 12615 Tallinn, is behind 86d.io and the 86d software. Contact us at hello@86d.io; we have not appointed a data protection officer, and this address reaches the people responsible.
This policy covers 86d.io and the 86d software: the console and the guest pages 86d serves on 86d.io, 86d.menu and restaurants’ own domains.
We are a processor, acting for a restaurant and on its instructions, for that restaurant’s guest data (orders, reservations, loyalty, memberships, gift cards, wallet passes) and the data it brings in from Wolt, Bolt and CompuCash. The restaurant is the controller of that data. Our data processing terms (86d.io/en/data-processing-terms) say what we may do with a restaurant’s data and how, and we ask every restaurant to confirm them in writing. We also use restaurants’ sales, order and payout figures to make anonymised statistics across at least five restaurants, to show restaurants how they compare; for this step we decide the purpose ourselves (see "Legal bases"), and once anonymised the figures are not personal data.
Website visitors and access applicants
On 86d.io we measure visits only if you agree, and the access form asks for what we need to call you back.
What we collect
We collect only what we need. In practice:
- When you apply for access: your first and last name, phone, email, restaurant name, city and number of locations. Every field is required; the form does not send without them.
- If you accept the banner: how you reached the site (the referring page, the first page you opened, campaign tags (utm), and, if the link carried a Google or Facebook click tag, which of the two), sent with your application.
- If you accept the banner: visit statistics (page address, referring page, country, browser, operating system, device type, and the event of sending an application).
- Always: your IP address and browser details in server logs, and, with an application, the page you sent it from.
Why
- To answer your application and connect your restaurant (our legitimate interest: answering a business enquiry).
- To know which channels bring applications and which pages are read (consent).
- To deliver the site and protect it from attacks (our legitimate interest: a working, secure site).
How long we keep it
- Applications: if your restaurant joins, as long as the customer relationship lasts and then 3 years for possible claims; if not, until you ask us to delete it or we no longer need it to answer you.
- How you reached the site: in your browser until you close the tab, then with the application.
- Visit statistics: Vercel deletes the visit marker after 24 hours; only totals remain.
- Server logs: for the log retention period of Vercel and Cloudflare for our plans.
Applications are stored in our customer database and shared with our team through the tools listed under "Who we share data with".
Restaurant owners and staff in the console
A console account is created with an email and name; you get access to a restaurant when 86d sets up its workspace for you or the restaurant invites you.
What we collect
We collect only what we need. In practice:
- Your email, first and last name, organisation, role and venue access; with Google sign-in, also your profile picture link and Google account id.
- Invitations: your email, role and who invited you.
- The activity log: what was done, when, by whom, with the IP address and browser.
- Technical data: errors and page speed, linked to your account, and recordings of some sessions with all text, inputs and media hidden.
Why
- To provide the console the restaurant ordered and keep it secure (our legitimate interest: providing the service our customer ordered).
- To protect accounts and record who changed team members, invitations, roles and access, payout accounts and complimentary memberships, and each time 86d staff open the restaurant’s console (our legitimate interest: security).
- To find slow pages and fix faults (our legitimate interest: a working service).
How long we keep it
- Your account: until you or the restaurant ask us to delete it. Removing you from a team ends your access; the account stays until then.
- Invitations: they stop working after 7 days.
- The activity log: while the restaurant’s account is in use.
- Technical data: page speed 7 days; errors and recordings for Sentry’s retention period for our plan.
Where the data comes from
- The restaurant that invites you (your email and role), you, and Google if you sign in with it.
Restaurant guests
If you order, book a table, join a loyalty programme or buy a membership at a restaurant that uses 86d, the restaurant is in charge of your data and we process it for the restaurant.
Ask the restaurant first; we help it answer. The sign-in account you use at every restaurant is ours, and hello@86d.io is the one address for both.
The restaurant decides why it collects your data and on what legal basis, and explains that in its own privacy notice; ask it at the contact on its page.
What we collect
We collect only what we need. In practice:
- When you order: your name, phone, email, what you ordered, the payment status, your notes, and your loyalty account and points or credit if you used them.
- When you book a table: your name, email, phone, how many of you, the occasion and any requests.
- In a loyalty programme: your name, email, phone, birthday, points or credit and their history, visits, what you spent, your tier, and your marketing and notification preferences.
- For memberships and punch cards: your email and phone, both required (without them you can’t join), and your first name if you give it. When you give a gift card: your email, the recipient’s email and, if you add it, their name. When you top up your own card: your email and phone. When you give a membership: your email and the recipient’s email. Whoever redeems a gift gives their email and phone.
- For a wallet pass, and when you pay for a membership or gift card: see "Wallet passes" and "Payments" below.
- Your IP address and contact details, which can be used briefly to prevent abuse, and errors on the pages, so we can fix them.
Why
- To take and hand over your order, hold your table and remind you, run the restaurant’s loyalty programme, sell and redeem memberships and gift cards, keep your pass up to date, and record payments.
- To keep the pages working and secure, as one of the security measures we take for the restaurant (see "How we protect data").
How long we keep it
- The restaurant decides. Until it tells us otherwise, we keep the data while the restaurant uses 86d, then delete it or return it to the restaurant under our data processing terms.
- Payment records on our own Stripe account: 7 years, as accounting law requires (here we are the controller; our legal obligation).
- Wallet pass device id and push token: until you remove the pass from Apple Wallet.
- An IP or email address used to prevent abuse: deleted within minutes. Error reports: for Sentry’s retention period for our plan.
Signing in
You sign in with your Google account or with a one-time code sent to your email or phone. One 86d account works at every restaurant that uses 86d. When you sign in to a restaurant’s loyalty programme, we find or create your loyalty profile there by your email or phone, and the restaurant sees it and your name if you add it. Your account is linked to your profile at each restaurant where you sign in, so we can sign you in there.
The account itself is ours to run (our legitimate interest: one sign-in for every restaurant). We keep it until you ask us to delete it; if you object to it, we delete it.
When you join, notifications are switched on and marketing is off. You can switch either on or off in your profile at any time. 86d itself never sends you marketing.
Payments
Stripe handles online checkout through 86d: orders, memberships and gift cards. We receive the payment status and the transaction details, never your card details, and keep them for 7 years as accounting law requires (our legal obligation). Payments a restaurant takes through other channels fall under its own arrangements.
Wallet passes
If you add a pass to Google Wallet, Google receives what the pass shows and handles it under its own terms and privacy notice. If you add it to Apple Wallet, Apple does the same, and the update service uses a device id and a push token.
Deleting your data
In your profile you can change your communication preferences or remove your loyalty profile at a restaurant. Removing it takes your name, contact details and birthday off your loyalty profile there and closes it. Your points history stays with the restaurant without them, and any unused points are forfeited: if you had 40 visits, they stay, with no name on them.
Orders, reservations, memberships and gifts are the restaurant’s records: ask the restaurant, and we carry out its instruction without undue delay. To delete your 86d account, write to hello@86d.io. Deleted data stays in our encrypted backups until they expire, within 35 days.
Notes and allergies
Order notes and booking requests are free text. Please avoid putting sensitive details there, such as health information or allergies, unless the restaurant needs them to serve you.
Signing in with Google
We use this data to sign you in, show your name and, on a guest page, fill in your details at checkout. The basis is the one for your console account or your 86d sign-in account above. We store it with our sign-in provider Supabase, in our database and its backups.
A restaurant receives your name and email only when you place an order or join its programme; for console staff, the restaurant that invited you sees them. Besides the providers in "Who we share data with", which process it for us, we share it with no one, never sell it and never use it for advertising.
We keep it until you ask us to delete your account at hello@86d.io. You can also remove 86d’s access in your Google account settings; that stops future Google sign-ins, and the data we hold stays until you ask us to delete the account.
Where the data comes from
- Google, when you choose to sign in with it, gives us the basic identity information Google exposes to a sign-in: your name, email address, Google account id and, if available, a link to your profile picture. We ask for no other access: not to Gmail, Drive, contacts or calendar.
Emails to us and our LinkedIn page
When you write to us, and about our LinkedIn page. We do not email restaurants that have not contacted us.
What we collect
We collect only what we need. In practice:
- When you write to hello@86d.io: your message, your contact details and our reply.
Why
- To answer you (our legitimate interest: answering you).
How long we keep it
- In Google Workspace, for as long as the matter or the customer relationship lasts, then 3 years for possible claims.
Where the data comes from
- You, when you write to us.
Our LinkedIn page
For our LinkedIn page’s visit statistics, LinkedIn and we are joint controllers; LinkedIn answers requests about them (legal.linkedin.com/pages-joint-controller-addendum).
Who we share data with
These companies receive personal data from us. Most work for us and only on our instructions. Where a company also decides for itself, its own privacy policy applies to that part.
Providers that handle restaurants’ data
- Vercel: hosting of 86d.io and the software, Frankfurt (EU)
- Supabase: database and sign-in, EU
- Cloudflare: content delivery, security and storage, worldwide
- GitHub: development and operations tooling, US
- Google: email and office tools (Google Workspace), US and EU
- Google: address search in the console, wallet passes, and fonts and maps on restaurant pages, US and EU · decides for itself
- Stripe: payments (for fraud checks and its own legal duties it decides for itself), Ireland and US
- Apple: wallet passes, Ireland and US · decides for itself
- Resend: service emails, sent and received, US
- Sentry: error monitoring, Germany (EU)
- Messente: text messages: sign-in codes and reservation reminders, Estonia (EU)
- Upstash: abuse prevention, Frankfurt (EU)
- Slack: internal team communication, US
Other recipients
- Google: Sign in with Google, US and EU · decides for itself
- LinkedIn: our company page, Ireland (EU) · joint controller with us
The restaurant sees the data of its own guests and staff. A restaurant can add a Google Maps map to its page; Google then receives your IP address and sets its own cookies.
We disclose data to authorities only when the law requires it and after checking that the request is lawful. Our accountant and legal advisers receive what they need, under a duty of confidentiality. If 86d OÜ or its business is sold or merged, the data passes to the new owner under this policy; restaurants get the notice and the right to leave set out in the data processing terms.
We tell restaurants before we add or replace a provider that handles their data.
Data outside the EEA
Some of our providers are in the United States or contract from outside the European Economic Area. We transfer data to them only with a safeguard the GDPR recognises.
Under the EU-US Data Privacy Framework
- Vercel
- Cloudflare
- GitHub
- Stripe
- Resend (certified as Plus Five Five, Inc.)
- Sentry (stored in Germany)
- Upstash
- Slack (through Salesforce)
Under standard contractual clauses
- Supabase (Supabase Pte. Ltd, Singapore)
- Apple
If a certification lapses, we rely on the European Commission’s standard contractual clauses instead.
We check each certification on the Data Privacy Framework list at least every four months.
You can ask for a copy of the safeguards at hello@86d.io.
Legal bases
This is where the law’s article numbers live. Every purpose above names its basis in plain words; here is what each one means.
- Consent (GDPR Art. 6(1)(a)): visit statistics and how you reached 86d.io. You can withdraw it at any time.
- Legal obligation (Art. 6(1)(c)): keeping payment and invoice records for accounting.
- Legitimate interests (Art. 6(1)(f)): answering a business enquiry; providing the service a restaurant ordered and keeping it secure; a working, secure site and service; one sign-in for every restaurant; answering you; presenting 86d; making anonymised statistics that show restaurants how they compare. We have weighed each against your interests, and you can ask for that assessment at hello@86d.io.
- The restaurant’s own basis: for guest data and platform data we are the restaurant’s processor; the restaurant chooses its basis and tells you in its own notice.
- 7 years for payment records: Accounting Act § 12.
- 3 years for possible claims: General Part of the Civil Code Act § 146.
- 13 and over for the 86d sign-in: our own rule, set at the age from which Estonian law lets a child consent to online services (Personal Data Protection Act § 8).
No automated decisions
We make no decisions about you that are based only on automated processing and have a legal or similarly significant effect on you.
A restaurant can sort its loyalty members into tiers by spend or visits, under rules it sets. That changes the rewards you see, not your rights.
How we protect data
86d.io, the console and the guest pages run in Frankfurt. Data travels encrypted. Sign-in passwords are hashed; credentials for platform connections are encrypted. Access to the console is by role, and an activity log records security-relevant changes and each time 86d staff open a restaurant’s console. Encrypted database backups are made regularly and kept for 35 days.
No one at 86d looks at your restaurant’s data except platform administrators, who can open your console (each opening is written to its activity log) or search a guest’s records by email across restaurants to answer a data protection request, and the engineers who run the database, to fix a fault or carry out your instruction.
For data we control, we notify the Data Protection Inspectorate within 72 hours where the law requires, and tell you without undue delay if a breach is likely to result in a high risk to your rights and freedoms. For a restaurant’s guest data, we tell the restaurant without undue delay and within 48 hours, as the data processing terms set out, and help it meet its duties.
Your rights
- To know what data we process about you, and get a copy.
- To have wrong data corrected.
- To have data deleted.
- To restrict its processing.
- To receive the data you gave us, where we process it on your consent, in a machine-readable form.
- To object (next section), and to withdraw consent (below).
How to use them
Write to hello@86d.io. We answer free of charge within one month. For complex or numerous requests we can extend this by two months, and tell you why within the first month. We ask you to confirm your identity, for example by writing from the email address we hold.
If you are a restaurant’s guest and the request concerns that restaurant’s data, we pass it to the restaurant and help it answer.
Withdrawing consent
Where we rely on your consent, you can withdraw it at any time, as easily as you gave it: with "Cookie settings" in the footer of the site’s pages or the button under "Cookies and browser storage". Withdrawing does not affect what we did before.
Complaints
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee, info@aki.ee), or to the data protection authority where you live or work.
Your right to object
Where we process data on our legitimate interest, you can object at any time by writing to hello@86d.io. We then stop, unless we have compelling grounds that override your interests, or need the data for a legal claim. For the guest sign-in account, objecting means we delete the account; your memberships and history stay with each restaurant as its records.
You can object to direct marketing at any time, without giving a reason, and we stop.
Children
The 86d sign-in is for people aged 13 and over; we set that age ourselves (see "Legal bases"). If a child under 13 has created an 86d account, write to hello@86d.io and we delete it; data a restaurant holds is the restaurant’s to handle, and we help it.
Changes
The date of the last change is at the top of this page. We tell restaurants about material changes by email before they take effect. Each change gets a dated line below; the full text of an earlier version is available on request at hello@86d.io.
- 28 October 2026: Updated: the access form no longer asks to send emails about 86d.
- 27 October 2026: Updated: wording.
- 24 October 2026: Updated: providers, backup retention and wording.
- 23 October 2026: Updated: providers and wording.
- 22 October 2026: First published.
Contact
86d OÜ, Kadaka pst 169b-10, 12615 Tallinn, Estonia. hello@86d.io.