Data Processing Addendum

This Data Processing Addendum (DPA) is part of our terms of service (section 5). It covers the personal data Goboblo processes for you when your restaurant, bar or other business uses Goboblo — mostly data about your guests. You do not need to sign anything: the DPA applies as soon as the terms do. Need a signed copy for your records? Write to help@goboblo.com.

1. Who is who

You decide over your guests' data. You are the controller under the GDPR and the UK GDPR, and the “business” under US state privacy laws. Goboblo — Strumpbudet (Swedish company reg. 880519-5115), Vestagatan 5, 416 48 Gothenburg, Sweden — is your processor and service provider: we process the data only for you, to deliver the service.

This DPA does not cover data Goboblo decides over itself, such as your own account and invoices. That is in our privacy policy.

2. What we process, and why

We process the data needed to run Goboblo for you: reservations, the guest register, stamp cards and memberships, orders and payments, gift cards and experiences, confirmations and reminders, and the features you turn on. Whose data it is, which kinds of data and what we do with them is in Annex 1. The processing lasts as long as you use Goboblo, and until the data is deleted under section 9.

3. Only on your instructions

We process the data only on your documented instructions. Your instructions are the terms, this DPA, and the way you set up and use Goboblo — for example which features you turn on and what you ask the app to do. If we think an instruction breaks data protection law, we tell you. If the law requires us to process the data in another way, for example to follow an order from an authority, we tell you before we do it, unless the law forbids us to.

4. Confidentiality

Everyone at Goboblo who can reach the data is bound to keep it confidential. We look at your data only when it is needed to run the service or to help you, for example when you contact support.

5. Security

These are the measures that protect the data today:

All traffic to the app, the reservation widget, the websites and our servers is encrypted (HTTPS).
Only people you give a login can see your data in the app, and roles (such as owner, admin and staff) limit what each person can do.
Each customer's data is kept apart in the database, so one account cannot read another account's data.
Card numbers never reach us: guests and customers type them in directly with Stripe.
We check our code for security flaws regularly and fix what we find.

We keep these measures at a level that fits the risk, and we improve them as the service grows. We never lower the protection without telling you.

6. Subprocessors

You give us general permission to use the subprocessors listed in Annex 2. We make sure each one is bound by data protection terms that protect the data as well as this DPA does, and we remain responsible to you for their work.

New subprocessors: we tell you by email at least 30 days before we add or replace a subprocessor, and the change shows in the change log below. If we must replace a provider urgently — for example because it shuts down — we tell you as soon as we can, and you keep the right to object. If you have a reasonable objection, tell us. If we cannot solve it, you can cancel the affected service before the change takes effect.

Services you connect yourself — for example your POS system, your own Stripe account for guests' payments, or a partner you give an API key — are your own providers. You decide what they get, and they are not our subprocessors.

7. Helping you

Guests' requests. In the app you can look up a guest, correct their details, export your reservations and stamp card members, and delete a guest's personal details (the visit count is kept without the name). If you need more help to answer a guest who wants to see, correct, move or delete their data, we help. If a guest contacts us directly, we pass the request on to you and do not answer it ourselves unless you ask us to.

Your other duties. We give you the information we have when you need it for security, for reporting a breach, for a data protection impact assessment or for talking to a data protection authority.

8. If something goes wrong

If we find a personal data breach that affects your data, we tell you without undue delay. We tell you what we know at that point — what happened, which data and roughly how many people are affected, the likely consequences and what we are doing about it — and send more as we learn more. We document every breach.

9. When the agreement ends

Before you leave, you can export your reservations and stamp card members from the app. When your account is closed, we delete the personal data we process for you, unless the law requires us to keep it. Want it deleted at a set date, or a confirmation that it is done? Write to help@goboblo.com. If copies remain in backups, they are deleted as the backups are replaced, and they are not used in the meantime.

10. Showing that we follow this DPA

We give you the information you need to see that we follow this DPA. Start by writing to us: we answer written questions and share documents. If that is not enough, you — or an auditor bound by confidentiality — may audit us once a year, with 30 days' notice. You may audit more often if a data protection authority requires it or after a breach. Each side pays its own costs.

11. Where the data is

Our database is in Stockholm, Sweden (EU), and our servers run in Amsterdam, the Netherlands (EU). Some subprocessors in Annex 2 are US companies and may process data in the United States or in other countries outside the EU/EEA and the UK. When data leaves the EU/EEA or the UK, we use the safeguards the law provides, such as the EU–US Data Privacy Framework for providers certified under it, or the European Commission's Standard Contractual Clauses (with the UK's addendum for UK data).

12. Liability and which text wins

Between you and us, the limits of liability in section 7 of the terms also apply to this DPA, as far as the law allows. They never limit the rights your guests have under the law. If this DPA and the terms say different things about personal data, this DPA wins. For locations in the United States, Annex 3 wins on the topics it covers.

13. Changes

We change this DPA the same way as the terms: if we change something material, we email you at least 30 days before it takes effect (section 10 of the terms). Everything shows in the change log below.

Annex 1 — The processing

Whose data

Your guests: people who reserve, order, join a stamp card or membership, buy a gift card or an experience, or get emails or text messages from your location.
Your staff and others you give a login.
People who comment on or write to your social media accounts, if you use social media in Goboblo.

Which data

Contact details: name, email and phone.
Reservations: date, time, party size, table, notes, answers to the questions you ask when guests reserve, status and no-shows.
Visit history, and whether the guest is a regular or VIP.
Allergies, dietary needs and preferences the guest states, and a birthday if you add it.
Whether the guest has said yes to marketing, and unsubscribes.
Stamps, memberships, gift cards, experiences, orders and payments (amounts and status — card numbers are handled by Stripe).
Records of the emails and text messages sent to the guest.
Staff: name, email, role and login.
Social media, if you use it: your posts, and the names and messages of people who comment or write.

Sensitive data

Allergies and dietary needs can say something about a guest's health. We process them only so your location can serve the guest safely.

What we do with the data

We store it, show it to you in the app, use it to find free tables, send confirmations, reminders and the emails you turn on, handle orders and payments, run the AI features when you use them, publish posts when you use social media, make exports, and delete data when you or the guest ask.

For bars that use games, the app can show how many seats similar bars have reserved for a game. It shows only rounded figures from at least three other locations — never another location's own numbers, and never anything about a guest. You can turn this off with the setting "Compare with similar bars" in Settings; your location is then left out, and you no longer see the comparison.

Annex 2 — Subprocessors

These are the subprocessors that can process personal data when you use Goboblo. Most of them are used only when you use the feature in question.

Supabase — Database, file storage and login. This is where the data in the service is kept. Data: All data in the service. Location: Stockholm, Sweden (EU).
Railway — Runs our servers, which the app, the reservation widget and the websites read and save data through. Data: All data in the service, as it passes through. Location: Amsterdam, the Netherlands (EU).
Vercel — Serves the app, the reservation widget, restaurant websites and goboblo.com from Vercel's network of servers. Counts visits to goboblo.com (Vercel Web Analytics, no cookies). Also registers domains you buy through us. Data: What the pages show, and technical data such as IP address. On goboblo.com: visit totals, with no name or email. For a domain purchase: the domain owner's name, address, email and phone.
Loopia — Registers .se, .no, .dk and .nu domains you buy through us. Data: The domain owner's name, address, email and phone.
Stripe — Payments: your subscriptions and invoices with us, and your guests' payments (deposits, gift cards, orders, experiences) in your own Stripe account. Data: Name, email, amounts and card details. The card number is typed in directly with Stripe — we never see it.
Resend — Sends email: reservation confirmations, reminders, receipts, the automatic emails you turn on, and our emails to you. Data: Name, email address and the content of the email.
46elks — Sends text messages when a location has turned them on. Not used for locations in the United States — guests there get email instead. Data: Phone number and the text of the message.
Inngest — Runs scheduled jobs, such as reminders and automatic emails, at the right time. Data: What the job needs, for example which reservation a reminder is for.
Anthropic — AI text: Goboblo AI and texts the AI writes for you (website, posts). Data: What you write to the AI, and the reservation and guest details the answer needs, for example names and allergies.
OpenAI — AI images and reading images: pictures that are created or edited, and menus read from a photo. Data: Photos and menus you upload.
Google (Places API) — Looks up your restaurant's public business details (address, phone, opening hours) when you search for it. Data: The restaurant's name and address. No guest data.
Browser push services (Apple, Google, Mozilla, Microsoft) — Deliver notifications to a guest or staff member who has turned on notifications in their own browser. Data: A technical address for the notifications, and the text of the notification.
Zernio — Publishes posts to the social media accounts a location connects, and fetches comments and messages to them. Only used if the location uses social media in Goboblo. Data: The posts, and the names and messages of people who comment or write to the location.

Annex 3 — Goboblo as your service provider in the United States

This annex applies to locations in the United States, and to personal information about their guests and staff. It meets the requirements for service provider contracts under the California Consumer Privacy Act (as amended by the CPRA) and similar state privacy laws.

Purpose. You give us the personal information only for the limited purpose of providing Goboblo to you, as the terms and Annex 1 describe.
No selling or sharing. We do not sell it, and we do not share it for cross-context behavioral advertising.
No other use. We do not keep, use or disclose it for any other purpose — including any other commercial purpose — or outside our direct business relationship with you.
No combining. We do not combine it with personal information we get from others or collect ourselves, except where the law allows a service provider to.
Same protection. We follow the duties these laws give service providers, and protect the information as well as the law requires of you.
Your checks. You may take reasonable and appropriate steps to make sure we use the information in line with your duties (section 10), and, after telling us, to stop and fix any use you have not authorized.
Telling you. We tell you if we can no longer meet these duties.
Consumer requests. We help you answer requests from your guests (section 7).
Subcontractors. The subprocessors in Annex 2 are bound in writing by the same duties (section 6).

Change log

2026-09-29 — First version.