Privacy policy

Short version: we collect as little as possible, we never sell data on, and you can ask us at any time to show or delete what we hold about you. Write to us and we sort it out.

1. Who this page is about

Goboblo is run by Strumpbudet (Swedish company reg. 880519-5115), Vestagatan 5, 416 48 Gothenburg, Sweden. We are the data controller for information about you as a visitor to goboblo.com or a customer of ours — that is, you who run a restaurant — and for information about restaurants and bars we have emailed (section 3).

If you are a guest who reserved a table or collected stamps at a restaurant, the restaurant is responsible for your data, not us. See section 4.

2. If you visit the site or get in touch

Just reading the site. We set no cookies and have no ad pixels. That is why there is no cookie banner here to click away.

We count visits with Vercel Web Analytics, from our hosting provider Vercel (listed in section 5). It sets no cookies and saves nothing in your browser. We see totals: which pages are viewed, which site a visit came from, and general details such as country and city, browser, operating system and type of device. We also count what happens on each page, as totals: how far down people scroll (a quarter, half, three quarters or all the way), which buttons and links they click (the text on them), whether a video is started (which video), and which questions they open. We count arrivals through our campaign links (the campaign name) and clicks through to sign up (where the visit came from). We use this to make the pages better. Nothing you type into a form is sent. We do not collect your name, email or anything else that says who you are. According to Vercel's documentation, a visitor is told apart only by a code made from the request, which is discarded after 24 hours, and no profile of you is built.

You can say no to this counting at any time, for free. If your browser sends Global Privacy Control, we don't count your visit. You can also use the button below. It saves one setting in this browser so that we remember your choice.

A few choices you make yourself are remembered in your own browser, for example the language or currency you picked, or that you closed a suggestion. That stays on your device and is not sent to us. When you watch our demo video, we count plays without knowing who you are: a random number, deleted when you close the tab, stops us from counting one visit twice. Our status page loads its fonts from Google Fonts, so Google sees your IP address when you open that page. Like every website, our hosting provider sees technical details such as your IP address when a page loads, and keeps them for a short time in its logs to run and protect the site.

If you fill in a form (contact, demo or account) we store what you write: name, email, phone, the restaurant's name and your message. We use it to answer you and to handle the relationship — nothing else. If you become a customer we also store what belongs to the agreement: invoices, subscriptions and support tickets. The app keeps you logged in by saving your login in your browser. If you came to us through one of our links or campaigns, your new account also saves which one, so we know what brought you.

3. If we have emailed you

If you got an email from us about table reservations or game-day reservations, it is because your restaurant or bar has an email address that is publicly listed on your own website or your business profile online, for example on Google. We do not buy email lists.

We only keep details about the business: name, address, city, phone, website, the email address, what your website shows about how you take reservations and which sports you show — and where and when we found the address. We email businesses, not private individuals, and only about things that concern your business. The legal basis is our legitimate interest in telling restaurants about a service for restaurants (Article 6(1)(f) GDPR / UK GDPR). The emails are sent using Instantly.

The link in the email carries a code, so we can see if an account came from the email and stop emailing you once you have signed up.

Don't want any more emails? Reply "no" or use the unsubscribe link in the email, and we won't contact you again. We then keep only the email address on a block list, so we never email it by mistake. To see what we hold or to have everything deleted, email help@goboblo.com.

4. Restaurants' guests — who is responsible for what

When a guest reserves a table, joins a stamp card or orders food from a restaurant using Goboblo, the restaurant is the data controller for that guest's data. We process it only on the restaurant's behalf, as a data processor — we do not decide what it is used for, and we never use it for our own marketing. How we do that is set out in our Data Processing Addendum.

What the restaurant keeps through the system is what the guest provides and what belongs to their visits: name, phone or email, reservations and visit history, any allergies or preferences the guest has stated, no-shows, and stamps, memberships and gift cards if the guest uses them. The restaurant uses this to look after the guest's visits — nothing else.

If you are a guest and want to know what is stored about you, or want it deleted, contact the restaurant. Every restaurant website we build has its own page about this, and the restaurant can answer directly. Made a reservation through a reservation widget on the restaurant's own website? Contact the restaurant. If you can't reach them, write to help@goboblo.com and we pass your request on to the restaurant. The split is also written into our terms.

5. Who else sees the data

We never sell data on, and we give it only to providers that need it to run the service. They may use it only to do their job for us. These are the providers we use (our subprocessors), what each one does and what it can see:

• Supabase — Database, file storage and login. This is where the data in the service is kept. Data: All data in the service. Location: Stockholm, Sweden (EU).
• Railway — Runs our servers, which the app, the reservation widget and the websites read and save data through. Data: All data in the service, as it passes through. Location: Amsterdam, the Netherlands (EU).
• Vercel — Serves the app, the reservation widget, restaurant websites and goboblo.com from Vercel's network of servers. Counts visits to goboblo.com (Vercel Web Analytics, no cookies). Also registers domains you buy through us. Data: What the pages show, and technical data such as IP address. On goboblo.com: visit totals, with no name or email. For a domain purchase: the domain owner's name, address, email and phone.
• Loopia — Registers .se, .no, .dk and .nu domains you buy through us. Data: The domain owner's name, address, email and phone.
• Stripe — Payments: your subscriptions and invoices with us, and your guests' payments (deposits, gift cards, orders, experiences) in your own Stripe account. Data: Name, email, amounts and card details. The card number is typed in directly with Stripe — we never see it.
• Resend — Sends email: reservation confirmations, reminders, receipts, the automatic emails you turn on, and our emails to you. Data: Name, email address and the content of the email.
• 46elks — Sends text messages when a location has turned them on. Not used for locations in the United States — guests there get email instead. Data: Phone number and the text of the message.
• Inngest — Runs scheduled jobs, such as reminders and automatic emails, at the right time. Data: What the job needs, for example which reservation a reminder is for.
• Anthropic — AI text: Goboblo AI and texts the AI writes for you (website, posts). Data: What you write to the AI, and the reservation and guest details the answer needs, for example names and allergies.
• OpenAI — AI images and reading images: pictures that are created or edited, and menus read from a photo. Data: Photos and menus you upload.
• Google (Places API) — Looks up your restaurant's public business details (address, phone, opening hours) when you search for it. Data: The restaurant's name and address. No guest data.
• Browser push services (Apple, Google, Mozilla, Microsoft) — Deliver notifications to a guest or staff member who has turned on notifications in their own browser. Data: A technical address for the notifications, and the text of the notification.
• Zernio — Publishes posts to the social media accounts a location connects, and fetches comments and messages to them. Only used if the location uses social media in Goboblo. Data: The posts, and the names and messages of people who comment or write to the location.

For our own emails to restaurants and bars (section 3) we also use Instantly. It sees the business details listed in section 3.

Where the data is. Our database is in Stockholm, Sweden (EU), and our servers run in Amsterdam, the Netherlands (EU). Several of the providers above are US companies, so some data may be processed in the United States or in other countries outside the EU/EEA and the UK. When data leaves the EU/EEA or the UK, we use the safeguards the law provides, such as the EU–US Data Privacy Framework for providers certified under it, or the European Commission's Standard Contractual Clauses (with the UK's addendum for UK data).

If we add or replace a provider that handles guest data, we update this list and the list in the Data Processing Addendum, and tell restaurants that are customers at least 30 days before, as the Data Processing Addendum says.

6. How long we keep it

As long as we need it for what you used it for, and no longer. If you write and ask something, we delete the conversation once the matter is closed. If you are a customer we keep contract and billing records for as long as Swedish accounting law requires (seven years) — the rest is cleared when the account closes.

7. Your rights

You have the right to know what we hold about you, to have it corrected if it is wrong, to have it deleted, and to object to how we use it. Email help@goboblo.com and we answer — normally within a few days, always within a month.

If you think we handled something badly, you can contact the Swedish Authority for Privacy Protection (IMY) or the data protection authority in your own country. In the United States, see section 10.

8. Changes

If we change something material, we get in touch before it takes effect. Everything shows in the change log below.

9. Children

Goboblo is a service for restaurants and is not aimed at children. We do not knowingly collect personal data from children under 13 (in the United States, the Children's Online Privacy Protection Act, COPPA, sets this limit). The reservation widget is meant for the person who reserves the table. If you think a child under 13 has given us personal data, write to help@goboblo.com and we will delete it — together with the restaurant, if it is a guest's data.

10. If you are in the United States

This section is for people in the United States, including California residents under the California Consumer Privacy Act (CCPA, as amended by the CPRA). It adds to sections 1–9.

If you are a guest of a restaurant

The restaurant decides over your data, and Goboblo is its service provider. Send your request to the restaurant. If you can't reach them, write to help@goboblo.com and we pass it on.

What we collect about you, and why

This is what Goboblo collects as a business about visitors, customers and the businesses we email. It is the same list for the last 12 months.

• Identifiers and contact details: name, email, phone, the restaurant's name and address. From you (forms and your account) and from public business listings (section 3). Used to answer you, run your account, bill you and email businesses about Goboblo.
• Commercial information: subscriptions, invoices and payments. From you and from Stripe. Used to run and bill your account.
• Professional information: your role at the restaurant. From you. Used to set up the right access in the app.
• Internet activity: technical details such as IP address and browser, visit counts from Vercel Web Analytics (pages viewed, how far people scroll, which buttons, links, videos and questions they use — as totals), and anonymous demo-video counts (section 2). From your browser. Used to run and protect the site and the app, and to see which pages and campaigns work.
• Sensitive personal information: your email and password for logging in to the app. Used only to log you in.

How long we keep each kind of data is in section 6. We share it only with the providers in section 5, so they can run the service for us.

We do not sell or share your data

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the last 12 months. We have no ad pixels or ad tracking, and we do not give personal information to anyone for their own marketing. So there is nothing to opt out of. We do not sell or share personal information of anyone under 16.

We use sensitive personal information only for what it is needed for. For restaurants, that includes allergies and dietary needs that a guest states: they are used only so the restaurant can serve the guest safely. We do not use sensitive personal information to draw conclusions about anyone.

Your rights

• Know: ask what we have collected about you, where it came from, why, and who we gave it to — and get a copy.
• Delete: ask us to delete what we have collected about you.
• Correct: ask us to fix data that is wrong.
• Opt out and limit: we do not sell or share data and use sensitive data only as described above, so this is already the case.
• Equal treatment: we will not charge you more or give you a worse service because you used these rights.

How to ask: email help@goboblo.com. To check that the request is yours, we answer the email address we have on file, or ask for details we already hold. We answer within 45 days. If we need more time, we tell you why, and we may take up to 45 days more. Someone you authorize, such as an authorized agent, can ask for you with your written permission; we may ask you to confirm it with us directly.

Other states: if you live in another state with a privacy law, such as Colorado, Connecticut, Oregon, Texas or Virginia, you can use the same rights the same way. If we say no to a request, you can appeal by replying to our answer. We answer the appeal within 45 days. If you are still not satisfied, you can contact your state's attorney general.

California: you can also contact the California Attorney General or the California Privacy Protection Agency (CPPA).

Our emails to US businesses

Our emails to restaurants and bars (section 3) say who we are, include our postal address and are about Goboblo. Reply "no" or use the unsubscribe link, and we stop within 10 business days at the latest — normally right away.

Change log

• 2026-09-29 — Section 2: we count visits with Vercel Web Analytics (no cookies, nothing saved in your browser), including what happens on each page (scrolling, clicks on buttons and links, videos started, questions opened) as totals; you can say no to it — we respect Global Privacy Control, and there is a button in section 2. A new account saves which link or campaign brought you. Also in section 2: what the site keeps in your browser, the demo-video counts and the status page's fonts. Section 4: guests who reserved through a restaurant's own website, and a link to our Data Processing Addendum. Section 5: the full list of providers with what each one does, where our database and servers are, and how data is protected when it leaves the EU/EEA or the UK. Section 6: Swedish accounting law. Section 7: where to complain. New section 9: children. New section 10: if you are in the United States (California and other state privacy laws).
• 2026-09-23 — New section 3: if we have emailed you — where we got the address, what we keep and how to opt out.
• 2026-08-06 — Section 3 clarified: lists what the restaurant keeps about its guests through the system.
• 2026-08-01 — First version.