Privacy policy

Who we are

Nollby Mat is run by Nollby Group OÜ, a private limited company (osaühing) registered in Estonia with registry code 17549825, Maakri tn 36-66, 10145 Tallinn, Estonia. The same company runs Nollby Service and Nollby Taxi. This policy covers Nollby Mat: this website, the restaurant app, the ordering and tracking pages and the diner directory.

Questions and requests about your data go to hej@nollby.com, or call us on +46 72 013 14 76.

Who is responsible for what

We are the controller for restaurant accounts and billing, the forms on this website, the diner directory, and keeping Nollby Mat safe from fraud and bots.

When you order from a restaurant, the restaurant is the controller of your order. We process it on the restaurant’s behalf, under the data processing agreement in the restaurant terms, and the restaurant decides what happens to it.

What we collect

• Restaurants: the restaurant’s name, address, phone, country, organisation number or other business ID and EU VAT number (with the answer from the EU’s VIES register), its menu, opening hours and settings. About the owner: name, email, mobile number and a hashed password. Which version of the terms was accepted, when and by whom, and a record of our decisions about the restaurant, such as approving or suspending it.
• Diners who order: name, mobile number, delivery address (for delivery), the order and any note to the kitchen. You can mention an allergy in the note; only write what the restaurant needs to know.
• Website forms: what you enter when you ask us to call you back (name, restaurant, phone, email, city and message) or join the waiting list for the diner app (email and area), and the campaign link that brought you here (utm parameters), if there was one.
• Technical data: your IP address, which the bot check and our limits on log-ins, orders, codes and forms use but we don’t store, and the technical logs Cloudflare keeps for us.

We use no advertising trackers and no analytics that follow you across websites.

Cookies and storage on your device

• Restaurant log-in: a cookie that lasts 30 days, or until you log out.
• Diners who confirmed their mobile number: a signed cookie for 90 days, so you don’t get a new code every time. It holds the number and when it expires.
• Your browser’s local storage: your language, your favourites and recent orders, the campaign link or invite you came from, and for restaurants a draft of a scanned menu. It stays on your device.
• “Use my location” on the restaurant list works only in your browser: your position is used there to sort restaurants by distance and is never sent to us.

All of this is needed for the service to work, so we don’t ask for consent to it.

Why, and on what legal basis

• Providing the service to restaurants, billing and support: our contract with the restaurant.
• Checking that a restaurant is a real business (VIES, a confirmed mobile, its address on the map, its menu) and stopping fraud, fake orders, spam and bots: our legitimate interest in a safe service.
• Emails to restaurant owners about getting started, and tips: our legitimate interest. Every tips email has a link to turn tips off.
• Calling back a restaurant that asked us to: steps you asked for before a contract.
• The waiting list for the diner app: your consent, which you can withdraw at any time.
• Keeping our accounts: our legal obligation.
• Diners’ orders: on the restaurant’s behalf, as described above.

We approve restaurants automatically when every check passes. When one doesn’t, a person looks at the restaurant.

Providers that handle data for us

Each provider handles only what it needs for its job, under a data processing agreement with us:

• Cloudflare, Inc. (USA): hosting the website, the app and the database. The database (Cloudflare D1) is set to EU jurisdiction and stored in the EU. Everything sent to and from Nollby Mat passes through Cloudflare’s network, usually in a data centre near you. Cloudflare also runs Turnstile, the bot check on the restaurant sign-up and call-back forms: to tell people from bots, it looks at technical signals from your browser and your IP address, not at what you type (cloudflare.com/turnstile-privacy-policy).
• Vonage (Vonage Holdings Corp., USA, and its group companies): text messages. One-time codes for diners and restaurant owners, order updates to diners at restaurants on Pro, and texts to owners about their restaurant, such as an order that is waiting. Vonage receives the phone number and the message.
• Resend, Inc. (USA): email to restaurant owners, and alerts to us (for example when a restaurant asks us to call back), sent from Resend’s EU region. Resend receives the address and the email. No diner data is sent by email.
• Stripe (Stripe Payments Europe, Ltd., Ireland, with Stripe, Inc., USA): restaurants paying for their plan by card. Stripe receives the restaurant’s name, email, phone, address, organisation number and VAT number (if it has one), and the card details straight from the restaurant: we never see the card number. Stripe is also a controller in its own right for some of this, for example to prevent fraud. No diner data goes to Stripe.
• Anthropic, PBC (USA): when a restaurant chooses “Scan your menu”, Claude, Anthropic’s AI, reads the photos of its menu. Anthropic receives only the photos. We don’t keep them, and Anthropic doesn’t use them to train its models.
• Qallio OÜ (Estonia): AI phone ordering, for restaurants with the add-on. Qallio answers the restaurant’s phone and takes the order, and receives the call, the caller’s number and the order. We connect the restaurant’s number to Qallio by hand; our systems send Qallio nothing.

Other services that receive data

• VIES, the European Commission’s register of VAT numbers (ec.europa.eu/taxation_customs/vies): when a restaurant gives an EU VAT number, VIES receives it and answers whether it is valid, with the name and address registered for it where the country shares them. We keep the answer with the restaurant’s account, and ask again later if VIES couldn’t answer at first.
• OpenStreetMap’s Photon (komoot GmbH, Germany) and Nominatim (OpenStreetMap Foundation, United Kingdom): to find a restaurant’s address on the map, and an area you type on the restaurant list. We send only the text, never your IP address or anything else that identifies you, and keep the answer for that text.
• Your browser’s push service (Google, Apple, Mozilla or Microsoft, depending on the device): order alerts on a restaurant’s own devices. They are encrypted end to end, so the push service can’t read them.
• Google Maps: when a restaurant or its driver taps a delivery address in the app, it opens in Google Maps, which then receives the address.

No diner data is ever sent to VIES or to the map search services.

Outside the EU and the EEA

The database and everything we keep are in the EU. Cloudflare, Vonage, Resend, Stripe and Anthropic are US companies or have a US parent company, so data may be processed in, or reached from, the USA. Data only goes there under Chapter V of the GDPR: the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, for companies certified under it, and otherwise the Commission’s standard contractual clauses in the provider’s data processing agreement. Nominatim is run from the United Kingdom, which has an adequacy decision of its own. Ask us for a copy of these safeguards.

How long we keep it

Nothing deletes accounts, orders or form answers automatically. This is how long data is kept today:

• Restaurant accounts, menus and settings: as long as the account exists. Email us to have an account deleted and we will delete it, except what the law requires us to keep, such as the records behind our invoices.
• Diners’ orders: as long as the restaurant’s account exists, so the restaurant can see its history. The restaurant can ask us to delete older orders. When a restaurant stops using Nollby Mat, we delete its diners’ data within 90 days, as the data processing agreement says.
• Form answers (call-back and the waiting list): until you ask us to delete them or withdraw your consent.
• One-time codes by SMS: only as hashes, removed automatically after 48 hours.
• Log-ins: 30 days, or until you log out. A diner’s confirmed-number cookie: 90 days on the device.
• Cloudflare’s technical logs: a few days.
• Stripe keeps payment records for as long as the law requires of it.

Your rights

You have the right to know what data we have about you and get a copy, to have mistakes corrected, to have data deleted, to restrict how we use it, to get the data you gave us in a machine-readable format, and to object to processing based on our legitimate interest. Where you gave your consent, you can withdraw it at any time.

Email hej@nollby.com and we answer within a month. If it’s about an order, the restaurant is responsible: contact the restaurant, or us, and we help the restaurant answer.

Complaints

If you’re unhappy with how we handle your data, you can complain to a data protection authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), as the company is established in Estonia. If you live or work in Sweden, you can also turn to the Swedish Authority for Privacy Protection (IMY, imy.se). Please talk to us first if you can.

Changes

We update this policy when the service changes. The date at the top shows when it last did.

Contact

Nollby Group OÜ
Registry code 17549825 · Maakri tn 36-66, 10145 Tallinn, Estonia

Email: hej@nollby.com
Phone: +46 72 013 14 76