Privacy notice

Who we are

LastTable is run by Raya Software Limited, 41 Walnut Close, Kingswood, Dublin 24, D24 FHV0. We are the controller of the personal data described here. Questions or requests: privacy@lasttable.ae.

When you book, the restaurant also receives your booking details and is responsible for how it uses them for its own records (see "What the restaurant receives").

What we collect

Your mobile number, which we verify with a one-time SMS code. It is your login and where we send booking confirmations.

Your name and, for each booking: the restaurant, date, time, party size, any occasion or special request you add, any offer used, and what happened (attended, cancelled or no-show).

Preferences you choose to give: dietary and seating preferences, a default occasion, saved places and your notification settings.

Cancellation Radar watches, and the alerts we send you (and whether you opened them).

If you turn on notifications: your device's push token, platform and app version.

If you use Near me, the map's location button or Sort: Nearest, the app uses your phone's location to measure distances. It stays on your phone: we don't store it or link it to you, and a search sends our server only a rounded position (about 100 m), which is not kept.

We do not collect your contacts or photos, we do not use advertising identifiers, and we do not track you across other companies' apps or websites.

Kept only on your phone

So that "For you" works before you sign in, the app keeps a taste profile on your phone: venues you viewed, cuisines and areas you searched, usual party size and time, and a summary of your bookings. It contains no name or phone number and is not sent to us.

When you sign in, your saved places and dietary and seating preferences are copied to your account. You can switch personalised recommendations off, or clear this data, in Notifications & privacy.

Why we use it and on what legal basis

To make and manage your bookings, send confirmations, reminders and changes, and run Cancellation Radar: this is needed for our contract with you (GDPR Art. 6(1)(b)).

To verify your number, prevent fraud and repeated no-shows, and keep the service secure: our legitimate interests (Art. 6(1)(f)).

To charge restaurants our fee for new diners who book through LastTable and attend, and to keep accounting records: our legal obligations (Art. 6(1)(c)) and legitimate interests.

Personalised recommendations: our legitimate interest in showing you relevant restaurants. You can switch them off at any time.

Flash Table alerts and news and offers from LastTable: only with your consent (Art. 6(1)(a)). Both are off until you turn them on, and you can withdraw consent at any time in the app.

Dietary preferences (for example halal or gluten-free) can say something about your religion or health. They are optional and we use them only to suggest suitable restaurants and pre-fill your booking.

What the restaurant receives

The restaurant you book receives your name, phone number, date, time and party size, and any occasion or special request you add. It uses them to prepare for your visit and may contact you about your booking.

The restaurant can also see whether you are a new guest through LastTable, because it pays us a fee for new diners. It does not see your other bookings, saved places or preferences.

Who helps us run LastTable

Supabase: our database, sign-in and server functions, hosted in the European Union.

Twilio Ireland Limited: sends verification codes and booking text messages.

Google Firebase Cloud Messaging (and Apple Push Notification service on iPhone): delivers notifications you turned on.

RevenueCat, Apple and Google handle in-app purchases made by restaurants in LastTable Business; Stripe handles restaurant payments on the web. Diners never pay in the app.

Some of these providers may process data outside the European Economic Area. Where they do, transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

We never sell your personal data.

Booking confirmations: when a booking is made, changed or cancelled, we send you the details by email through Google Workspace (Gmail) (if your account has an email address, for example after signing in with Apple, Google or email) and, where switched on, by text message to the number on the booking.

Anthropic: when you use the AI Concierge, the request you type (with any e-mail addresses or phone numbers removed) and the live availability we look up for it are sent to Anthropic's AI model to write the answer. We don't send your name, phone number, e-mail address or location, and Anthropic doesn't use this data to train its models.

How long we keep it

Your account, preferences and saved places: until you delete your account.

When you delete your account, your bookings stay with the restaurant and in our fee records without your name, phone number, occasion or request, for as long as accounting law requires. Upcoming bookings are cancelled.

Notification history: 13 months. Verification codes expire within minutes.

Your rights

You can ask to access, correct, export or delete your data, to restrict its use, and object to uses based on our legitimate interests. You can withdraw consent at any time.

In the app: Profile → Privacy & your data → Download my data, or Delete account. Or email privacy@lasttable.ae. We reply within one month.

You can raise a concern with the UAE Data Office.

Age

LastTable is for people aged 16 and over.

Changes

If we change this notice in a way that matters, we will tell you in the app before the change applies.

This website

This website sets no cookies and loads no third-party trackers, advertising or social media scripts. Fonts and images are served from our own domain. Our hosting provider keeps standard server logs (such as IP address and pages requested) for security and to keep the site running.

If you use a form on this site (pilot invite or pilot restaurant), we receive what you enter and use it only to reply to you about the pilot. Write to privacy@lasttable.ae to have it deleted.