Privacy Policy

Gastilo is a hospitality platform operated by Review Lab L.L.C. We are the controller for personal data described in this policy, unless stated otherwise.

• Review Lab L.L.C — Business No. 812366509
• Rruga UÇK, Prishtinë 10000, Kosovo
• Contact: info@gastilo.com

We keep data collection to what we need to run Gastilo and answer your requests.

• Contact and demo requests: name, email address, business name, phone number if provided, and the content of your message.
• Customer account data: login credentials, billing contact, subscribed services and support history.
• Content you upload: menu items, photos, opening hours, texts and other business information.
• Technical data: IP address, browser and device type, pages visited and timestamps, collected in server logs for security and stability.

• To provide the services you ordered and manage your subscription — performance of a contract.
• To respond to demo requests, questions and support tickets — pre-contractual steps and legitimate interest.
• To keep the platform secure, prevent abuse and fix errors — legitimate interest.
• To send product updates or offers where you asked for them — consent, which you can withdraw at any time.
• To meet accounting and legal obligations — legal obligation.

When a restaurant uses Gastilo for reservations, menus or the AI chat assistant, guest data (such as a reservation name, contact details, party size, notes or chat messages) belongs to that restaurant. The restaurant is the controller; Gastilo acts as a processor and only handles this data on the restaurant's instructions.

If you are a guest and want your data corrected or deleted, contact the restaurant directly. You may also write to us and we will forward your request.

We use a small number of carefully selected providers. They process data only for us and under contract.

• Cloud hosting and managed database/authentication for running the platform and storing content.
• Email delivery for transactional messages such as confirmations and notifications.
• AI providers that generate answers for the AI Chat Assistant. Messages are sent for processing and are not used by us to train public models.
• Social platforms (for example Instagram and Facebook) when we manage a customer's social presence on their behalf.

We do not sell personal data and we do not share it for advertising purposes.

Our website uses only essential and functional storage — for example remembering your language choice and keeping you signed in. We do not use advertising or cross-site tracking cookies. You can clear this storage in your browser settings at any time.

• Enquiry and demo data: up to 24 months after the last contact, unless a contract follows.
• Customer account and content data: for the duration of the contract and up to 90 days afterwards, so you can export it.
• Invoices and accounting records: for the retention period required by applicable law.
• Server logs: typically up to 12 months.

We use encryption in transit, access controls, role-based permissions and regular backups. No system is perfectly secure, but we work to keep risk low and to react quickly to incidents.

Some providers may process data outside your country. Where that happens, we rely on appropriate safeguards such as standard contractual clauses.

Depending on where you live — and for visitors in the EU, EEA and Switzerland under the GDPR — you can ask us to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete data we no longer need to keep.
• Receive a copy in a portable format.
• Restrict or object to certain processing.
• Withdraw consent at any time, without affecting past processing.

Write to info@gastilo.com and we will reply within 30 days. You also have the right to complain to your local data protection authority.

Gastilo is a business tool and is not directed at children under 16. We do not knowingly collect their data. If you believe a child's data reached us, contact us and we will delete it.

We may update this policy as the product or the law changes. The date at the top always shows the current version. For significant changes we notify active customers by email.