Privacy policy

Version 8 · updated 1 noiembrie 2026

How Mesea looks after your personal data — on mesea.ro, on restaurant menus, in Mesea Manager and in the Mesea app restaurant teams use. We've kept it plain; if anything is unclear, write to us and we'll explain.

Who looks after your data

Mesea is run by ALFI DIGITAL SRL (CUI 52377381). We are the controller of the data that belongs to Mesea itself: your diner account, which works at every restaurant on Mesea; the accounts of restaurant teams and of our own staff; mesea.ro; Mesea Manager; and the logs that keep it all secure.

Each restaurant is the controller of what you share with it: your orders, bookings, receipts and invoices, and its newsletter. We store and process that for the restaurant, on its instructions, and use it for nothing else.

So for an order, a booking or a newsletter, the restaurant is the one to ask. Its name and contact details are on its page on mesea.ro, on its menu and on your receipt. If you write to us instead, we'll pass your request on and help the restaurant answer it.

An order placed through a delivery app such as Glovo belongs to that app: the app is the controller, and the restaurant uses your details only to prepare your order.

What we collect, and why

Only what each part of Mesea needs to work. For each one you will find what it holds, what it's for, the legal basis under the GDPR and who decides about it.

Your diner account

What: Your email address or phone number, the name you give us and your language. If you sign in with Google, Google tells us your name, your email address and your Google account id. Each sign-in also records your IP address and browser.
Why: To sign you in with a code or link that works once, with no password to remember, and to keep your orders and bookings together at every restaurant on Mesea.
Legal basis: Providing the account you asked for (GDPR art. 6(1)(b)). Protecting sign-in from abuse is our legitimate interest (art. 6(1)(f)).
Who decides: Alfi Digital.

Orders and carts

What: What you order, the name you show at the table, your notes for the kitchen and your comments, your phone number and, for a delivery, the address you choose. Addresses you save stay in your account until you delete them.
Why: So the restaurant can prepare, serve or deliver your order and settle the bill. Notes and comments are for the kitchen and the delivery: please don't write anything about your health in them.
Legal basis: The agreement between you and the restaurant (GDPR art. 6(1)(b)).
Who decides: The restaurant.

Paying online

What: What we send the payment processor the restaurant chose: the amount and currency, the order's reference and the dishes you're paying for, your IP address and the menu's language. If you're signed in, also your email address and name; if not, a one-time address that reaches nobody, and no name. We keep the payment's status, its amount and the processor's reference, and any refund request, with its reason and who decided it. Never your card details.
Why: So you can pay for your order by card, the money reaches the restaurant, and a refund can go back to your card.
Legal basis: The agreement between you and the restaurant (GDPR art. 6(1)(b)), and the restaurant's duty to keep its accounts (art. 6(1)(c)).
Who decides: The restaurant. The payment processor answers for your card details and for the payment itself.

Table bookings

What: Your name, phone number and email address, the date and time, how many of you're coming and any notes. A booking made while you're signed in also shows in your account.
Why: So the restaurant can keep your table and reach you about it. Please don't write anything about your health in the booking's notes.
Legal basis: The booking you asked for (GDPR art. 6(1)(b)).
Who decides: The restaurant.

Receipts and invoices

What: What you paid and how and, if you ask for an invoice, the buyer details you give: name or company, tax id (CNP or CUI), address and email. Mesea never receives your card details.
Why: The restaurant must issue fiscal receipts and invoices, and send its invoices to ANAF through e-Factura.
Legal basis: A legal obligation (GDPR art. 6(1)(c)) under Romanian accounting and tax law.
Who decides: The restaurant.

Orders from delivery apps

What: The name, phone number and delivery address the app sends with your order.
Why: Only so the restaurant can prepare your order and hand it over.
Legal basis: The delivery app's own terms; its privacy policy applies.
Who decides: The delivery app (for example Glovo).

Finding restaurants near you

What: The address you type or the location you share. When you open mesea.ro with no saved address, your browser asks whether to share your location. If you say yes, our server turns it into a street address, and that is kept in a cookie on your device. Our server remembers the answer for a day, against a rounded position and nothing that links it to you, so it doesn't have to ask twice. Until you pick an address, we start from the city Cloudflare works out from your connection, if it is one we serve.
Why: To show you restaurants that are close by or deliver to you.
Legal basis: Your consent for your device's location (GDPR art. 6(1)(a)): you give it in your browser's prompt and take it back in your browser's settings, and saying no changes nothing else. Our legitimate interest in showing you restaurants you can actually order from, for an address you type and for the city we start from (GDPR art. 6(1)(f)).
Who decides: Alfi Digital.

Deliveries by the restaurant's own team

What: When a restaurant delivers with its own team: who carried your order, when it was picked up and handed over, the deliverer's phone location while carrying your order (only then, never before or after), the calls they made to you, and how far the handover was from your address. At the handover of a drink marked 18+, only whether the ID was checked and, if the drink stayed behind, why — never anything from the ID itself.
Why: To send each ready order to a free deliverer, to show you the deliverer's first name and their way to you on a map, and to give the restaurant proof of the handover if a payment is disputed.
Legal basis: The contract with the restaurant (GDPR art. 6(1)(b)), and the restaurant's legitimate interest in proving a delivery reached you (art. 6(1)(f)).
Who decides: The restaurant.

Restaurant teams and our staff

What: For the people who run restaurants on Mesea and for our own staff: name, email address, phone number, a password (stored only as a secure fingerprint), sign-in codes and the restaurants each person helps run. For team members, also their shifts and the orders they handle.
Why: So each person reaches only what their role allows, and the restaurant can run its shifts and orders.
Legal basis: The contract with the restaurant (GDPR art. 6(1)(b)) and our legitimate interest in keeping accounts secure (art. 6(1)(f)).
Who decides: Alfi Digital for the accounts; the restaurant for its team's work.

Restaurant devices

What: For each tablet or phone a restaurant uses with Mesea: its identifier, model and name, the app version and which team member is signed in on it.
Why: To connect each device to the right restaurant and keep orders flowing to it.
Legal basis: The contract with the restaurant (GDPR art. 6(1)(b)).
Who decides: The restaurant.

Writing to us

What: What you send us by email or through the form on mesea.ro/pentru-restaurante: your name, restaurant, phone number, email address and message.
Why: To answer you and, if you'd like, to bring your restaurant onto Mesea.
Legal basis: Steps you asked for before a contract (GDPR art. 6(1)(b)), and our legitimate interest in answering you (art. 6(1)(f)).
Who decides: Alfi Digital.

Security and logs

What: For each request to Mesea: your IP address, browser, the page and the time. For each change staff make: who changed what, and when. And error reports, with names, addresses, phone numbers and other personal details taken out before they leave our servers.
Why: To keep Mesea secure and working, stop abuse, and find and fix what breaks.
Legal basis: Our legitimate interest in a secure, reliable service (GDPR art. 6(1)(f)).
Who decides: Alfi Digital.

We make no automated decisions about you and build no profile of you.

No analytics, no ads

Mesea uses no analytics and no advertising trackers: nothing follows you around the web and nothing builds a profile of you. We don't sell your data, and we show no ads.

A few things on our pages come straight from other companies, so your browser contacts them and they see your IP address: mesea.ro loads its fonts from Google Fonts, the map you choose your place on from Google Maps, and, when you scroll to a restaurant's map, its map tiles from OpenStreetMap; our API documentation loads its viewer from jsDelivr.

A restaurant's own website made with Mesea belongs to the restaurant. It may load fonts and code from Google Fonts, jsDelivr and cdnjs.

Cookies and storage on your device

We store only what Mesea needs to work, so none of it needs your consent — and none of it tracks you.

Cookies on mesea.ro and restaurant menus

mesea_sessionalfi_client_session_id
Keeps you signed in on mesea.ro and on restaurant menus.
How long: 90 days; it stops working sooner, after 30 days without use.
mesea_addr
Remembers the address or area you chose, to show restaurants near you.
How long: 6 months.
mesea_locale
Remembers your language.
How long: 1 year.

Cookies on manager.mesea.ro

__Host-mesea_session
Keeps you signed in to Mesea Manager.
How long: At most 12 hours; it ends after 2 hours without use.
__Host-mesea_2fa
Remembers your sign-in while you enter the code we emailed you.
How long: At most 30 minutes.
__Host-mesea_csrf
Makes sure every change really comes from you, not from another site.
How long: As long as you stay signed in.

Kept in your browser's storage

alfi_cart_idalfi_cart_user_id
Your cart and your seat at the table.
How long: Until the cart closes.
alfi_last_sent_order_ids
The orders you've just sent, so the menu can show you how they're doing.
How long: Until the cart closes or you clear your browser's storage.
alfi_assistance_last_request
When you last called a waiter, so the button takes a short pause.
How long: Until you clear your browser's storage.
mesea_localealfi_orders_localemesea_manager_localemesea_demos_locale
Your language on mesea.ro, on the menus, in Mesea Manager and on the demo videos page.
How long: Until you clear your browser's storage.
mesea_manager_nav_sections
Which groups of the Mesea Manager menu you folded away.
How long: Until you clear your browser's storage.

Who else handles it

The restaurant you order from or book with sees what you share with it, and so do the people on its team who need it. Beyond that, these providers handle data for us, only to run Mesea:

Our servers and database run in data centres in Romania (ROMARG and GTS Telecom), with a copy of the database at Hetzner in Germany.
Cloudflare carries the traffic to Mesea's sites, stores our files and database backups in the EU (R2) and hosts restaurant websites (Pages).
ROMARG, in Romania, hosts our email: it sends sign-in codes, booking and order emails, invoices and newsletters, and receives the notices about emails that couldn't be delivered.
web2sms sends sign-in codes by text message, when you sign in with your phone number.
Google provides Google sign-in, if you choose it; the address search on mesea.ro and turning a location you share into an address (Google Maps Platform, asked by our server, so Google doesn't see your IP address); the map you confirm your place on, which your browser loads from Google only when you reach that step; and the fonts on mesea.ro.
The OpenStreetMap Foundation, in the United Kingdom, serves the map on a restaurant's page: your browser asks it for the map tiles only when you scroll to it, so it sees your IP address and the area shown, not your address.
Glovo, for restaurants that sell through it, sends us the orders you place in its app and receives the restaurant's menu and the progress of your order.
The payment processor each restaurant chooses takes card payments on its own secure page, under its own privacy policy, which you'll see there. We send it only what the payment needs (see "Paying online" above), and we never see your card details.
ANAF, the Romanian tax authority, receives the invoices restaurants issue, through e-Factura.
Grafana Labs keeps our request logs, with the IP address and browser, in Grafana Cloud's Germany region.
Anthropic (Claude) helps restaurants read their supplier invoices, which can carry a person's name and details, a sole trader's for instance. Our team works with Claude too when it sets up and runs a restaurant on Mesea, so Claude sees what the team opens for that restaurant, orders and bookings included. OpenAI or Mistral do the same work only if we choose them for a task.

Data outside the EU

Our servers, our database and its copies, our files, our email and our logs (Grafana Cloud, Germany) are in the European Union.

The OpenStreetMap Foundation is in the United Kingdom, which the European Commission has decided protects data to the EU's standard (Art. 45 GDPR).

Cloudflare, Google and Anthropic are U.S. companies, and so is OpenAI, when we choose it. Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework; with each of them, data reaches the U.S. under the European Commission's standard contractual clauses, as chapter V of the GDPR requires.

How long we keep it

As long as each purpose needs, and no longer:

Sign-in codes, verification codes and password reset links: they expire within an hour at most, and we delete them a day after they expire.
Signing in on mesea.ro and the menus: 30 days without use, 90 days at most. In Mesea Manager: 2 hours without use, 12 hours at most. We delete the record of each sign-in (IP address and browser) a day after it ends.
Your account and saved addresses: until you ask us to erase them.
Orders and bookings: after 2 years we take your name, phone number, address, comments and notes out of them; the amounts stay, for the restaurant's books. Sooner, if you ask us to erase your details.
Online payments and refunds: after 2 years we take out what ties them to you (your account, your name on a refund request, the reason you wrote and the restaurant's answer); the amounts stay, for the restaurant's books. Sooner, if you ask us to erase your details.
Delivery proof: 180 days after the handover, then we delete the deliverer's locations and name from it. The deliverer's live position is deleted the moment the order is handed over.
The record of changes staff make: 3 years, then we delete it. When we erase a person, their details come out of it sooner.
Receipts, invoices and e-Factura records: 10 years, as Romanian accounting law requires (Legea contabilității nr. 82/1991).
Your details on delivery-app orders: 30 days after the order, then they're deleted.
Newsletters: until you unsubscribe, or until 3 deliveries in a row fail. After that nothing more is sent, and your address stays marked as unsubscribed until you ask us to erase it. If you sign up again after unsubscribing, we email you a link to confirm; until you do, nothing changes, and the request is deleted once you use it or after 7 days.
Database backups: one every 10 minutes, each deleted after 30 days.
Log files on our servers: one hour. Request logs in Grafana Cloud: for as long as needed to run and secure the service. Error reports in Bugsink: 60 days.

Your rights

At any time, free of charge, you can ask us:

to see the data we hold about you, and get a copy;
to correct it, if something is wrong;
to erase it — we take out your account and everything that identifies you, except what the law makes us keep, such as receipts and invoices;
to pause using it, for example while we check something you've pointed out;
to receive it in a common format, so you can take it elsewhere;
to stop using it where we rely on our legitimate interest;
to withdraw your consent — for a newsletter, the unsubscribe link in every email does it at once.

Write to [email protected] from the address on your account, or tell us the phone number you sign in with. We'll answer within a month. You can sign out, and delete your saved addresses, yourself at any time.

For orders, bookings and newsletters, we pass your request to the restaurant, which decides about its own records, and help it answer you.

If you think we got something wrong, tell us and we'll put it right. You can also complain to ANSPDCP, Romania's data protection authority: dataprotection.ro.

How we protect it

Everything travels encrypted. Staff sign in with a password and a code we email them; diners with a code or link that works once, for 10 minutes. Passwords, sign-in codes and session keys are stored only as secure fingerprints, never as they're, and each person reaches only what their role allows.

Changes to this policy

When what we do with your data changes, we update this page, with a new version number and date at the top.

Write to us

A question, a request, or something that worries you? Write to us at [email protected] and we'll get back to you.