Privacy policy

Short version: we collect as little as possible, we never sell data on, and you can ask us at any time to show or delete what we hold about you. Write to us and we sort it out.

1. Who this page is about

Goboblo is run by Strumpbudet (Swedish company reg. 880519-5115), Vestagatan 5, 416 48 Gothenburg, Sweden. We are the data controller for information about you as a visitor to goboblo.com or a customer of ours — that is, you who run a restaurant — and for information about restaurants and bars we have emailed (section 3).

If you are a guest who booked a table or collected stamps at a restaurant, the restaurant is responsible for your data, not us. See section 4.

2. If you visit the site or get in touch

Just reading the site. We set no cookies and have no ad pixels. That is why there is no cookie banner here to click away.

We count visits with Vercel Web Analytics, from our hosting provider Vercel (listed in section 5). It sets no cookies and saves nothing in your browser. We see totals: which pages are viewed, which site a visit came from, and general details such as country and city, browser, operating system and type of device. We also count what happens on each page, as totals: how far down people scroll (a quarter, half, three quarters or all the way), which buttons and links they click (the text on them), whether a video is started (which video), and which questions they open. We count arrivals through our campaign links (the campaign name) and clicks through to sign up (where the visit came from). We use this to make the pages better. Nothing you type into a form is sent. We do not collect your name, email or anything else that says who you are. According to Vercel's documentation, a visitor is told apart only by a code made from the request, which is discarded after 24 hours, and no profile of you is built.

You can say no to this counting at any time, for free. If your browser sends Global Privacy Control, we don't count your visit. You can also use the button below. It saves one setting in this browser so that we remember your choice.

A few choices you make yourself are remembered in your own browser, for example the language or currency you picked, or that you closed a suggestion. That stays on your device and is not sent to us. When you watch our demo video, we count plays without knowing who you are: a random number, deleted when you close the tab, stops us from counting one visit twice. Our status page loads its fonts from Google Fonts, so Google sees your IP address when you open that page. Like every website, our hosting provider sees technical details such as your IP address when a page loads, and keeps them for a short time in its logs to run and protect the site.

If you fill in a form (contact, demo or account) we store what you write: name, email, phone, the restaurant's name and your message. We use it to answer you and to handle the relationship — nothing else. If you become a customer we also store what belongs to the agreement: invoices, subscriptions and support tickets. The app keeps you logged in by saving your login in your browser. If you came to us through one of our links or campaigns, your new account also saves which one, so we know what brought you.

3. If we have emailed you

If you got an email from us about table or match bookings, it is because your restaurant or bar has an email address that is publicly listed on your own website or your business profile online, for example on Google. We do not buy email lists.

We only keep details about the business: name, address, city, phone, website, the email address, what your website shows about how you take bookings and which sports you show — and where and when we found the address. We email businesses, not private individuals, and only about things that concern your business. The legal basis is our legitimate interest in telling restaurants about a service for restaurants (Article 6(1)(f) GDPR / UK GDPR). The emails are sent using Instantly.

The link in the email carries a code, so we can see if an account came from the email and stop emailing you once you have signed up.

Don't want any more emails? Reply "no" or use the unsubscribe link in the email, and we won't contact you again. We then keep only the email address on a block list, so we never email it by mistake. To see what we hold or to have everything deleted, email help@goboblo.com.

4. Restaurants' guests — who is responsible for what

When a guest books a table, joins a stamp card or orders food from a restaurant using Goboblo, the restaurant is the data controller for that guest's data. We process it only on the restaurant's behalf, as a data processor — we do not decide what it is used for, and we never use it for our own marketing. How we do that is set out in our Data Processing Addendum.

What the restaurant keeps through the system is what the guest provides and what belongs to their visits: name, phone or email, bookings and visit history, any allergies or preferences the guest has stated, no-shows, and stamps, memberships and gift cards if the guest uses them. The restaurant uses this to look after the guest's visits — nothing else.

If you are a guest and want to know what is stored about you, or want it deleted, contact the restaurant. Every restaurant website we build has its own page about this, and the restaurant can answer directly. Booked through a booking window on the restaurant's own website? Contact the restaurant. If you can't reach them, write to help@goboblo.com and we pass your request on to the restaurant. The split is also written into our terms.

5. Who else sees the data

We never sell data on, and we give it only to providers that need it to run the service. They may use it only to do their job for us. These are the providers we use (our subprocessors), what each one does and what it can see:

• Supabase — Database, file storage and login. This is where the data in the service is kept. Data: All data in the service. Location: Stockholm, Sweden (EU).
• Railway — Runs our servers, which the app, the booking window and the websites read and save data through. Data: All data in the service, as it passes through. Location: Amsterdam, the Netherlands (EU).
• Vercel — Serves the app, the booking window, restaurant websites and goboblo.com from Vercel's network of servers. Counts visits to goboblo.com (Vercel Web Analytics, no cookies). Also registers domains you buy through us. Data: What the pages show, and technical data such as IP address. On goboblo.com: visit totals, with no name or email. For a domain purchase: the domain owner's name, address, email and phone.
• Loopia — Registers .se, .no, .dk and .nu domains you buy through us. Data: The domain owner's name, address, email and phone.
• Stripe — Payments: your subscriptions and invoices with us, and your guests' payments (deposits, gift cards, orders, experiences) in your own Stripe account. Data: Name, email, amounts and card details. The card number is typed in directly with Stripe — we never see it.
• Resend — Sends email: booking confirmations, reminders, receipts, the automatic emails you turn on, and our emails to you. Data: Name, email address and the content of the email.
• 46elks — Sends text messages when a venue has turned them on. Data: Phone number and the text of the message.
• Inngest — Runs scheduled jobs, such as reminders and automatic emails, at the right time. Data: What the job needs, for example which booking a reminder is for.
• Anthropic — AI text: Goboblo AI and texts the AI writes for you (website, posts). Data: What you write to the AI, and the booking and guest details the answer needs, for example names and allergies.
• OpenAI — AI images and reading images: pictures that are created or edited, and menus read from a photo. Data: Photos and menus you upload.
• Google (Places API) — Looks up your restaurant's public business details (address, phone, opening hours) when you search for it. Data: The restaurant's name and address. No guest data.
• Browser push services (Apple, Google, Mozilla, Microsoft) — Deliver notifications to a guest or staff member who has turned on notifications in their own browser. Data: A technical address for the notifications, and the text of the notification.
• Zernio — Publishes posts to the social media accounts a venue connects, and fetches comments and messages to them. Only used if the venue uses social media in Goboblo. Data: The posts, and the names and messages of people who comment or write to the venue.

For our own emails to restaurants and bars (section 3) we also use Instantly. It sees the business details listed in section 3.

Where the data is. Our database is in Stockholm, Sweden (EU), and our servers run in Amsterdam, the Netherlands (EU). Several of the providers above are US companies, so some data may be processed in the United States or in other countries outside the EU/EEA and the UK. When data leaves the EU/EEA or the UK, we use the safeguards the law provides, such as the EU–US Data Privacy Framework for providers certified under it, or the European Commission's Standard Contractual Clauses (with the UK's addendum for UK data).

If we add or replace a provider that handles guest data, we update this list and the list in the Data Processing Addendum, and tell restaurants that are customers at least 30 days before, as the Data Processing Addendum says.

6. How long we keep it

As long as we need it for what you used it for, and no longer. If you write and ask something, we delete the conversation once the matter is closed. If you are a customer we keep contract and billing records for as long as Swedish accounting law requires (seven years) — the rest is cleared when the account closes.

7. Your rights

You have the right to know what we hold about you, to have it corrected if it is wrong, to have it deleted, and to object to how we use it. Email help@goboblo.com and we answer — normally within a few days, always within a month.

If you think we handled something badly, you can contact the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. You can also contact the Swedish Authority for Privacy Protection (IMY), which supervises us in Sweden.

8. Changes

If we change something material, we get in touch before it takes effect. Everything shows in the change log below.

9. Children

Goboblo is a service for restaurants and is not aimed at children. We do not knowingly collect personal data from children under 13. The booking window is meant for the person who books the table. If you think a child under 13 has given us personal data, write to help@goboblo.com and we will delete it — together with the restaurant, if it is a guest's data.

Change log

• 2026-09-29 — Section 2: we count visits with Vercel Web Analytics (no cookies, nothing saved in your browser), including what happens on each page (scrolling, clicks on buttons and links, videos started, questions opened) as totals; you can say no to it — we respect Global Privacy Control, and there is a button in section 2. A new account saves which link or campaign brought you. Also in section 2: what the site keeps in your browser, the demo-video counts and the status page's fonts. Section 4: guests who booked through a restaurant's own website, and a link to our Data Processing Addendum. Section 5: the full list of providers with what each one does, where our database and servers are, and how data is protected when it leaves the EU/EEA or the UK. Section 6: Swedish accounting law. Section 7: the ICO. New section 9: children.
• 2026-09-23 — New section 3: if we have emailed you — where we got the address, what we keep and how to opt out.
• 2026-08-06 — Section 3 clarified: lists what the restaurant keeps about its guests through the system.
• 2026-08-01 — First version.