Basil privacy policy

Basil is a product of Wave Marketing Ltd ("Basil", "we", "us", "our"). This policy explains how we collect, use, and protect personal data when restaurants and cafes ("Restaurants", "you") use Basil, and when their guests ("Guests") make bookings through it.

The short version

We collect account details from the restaurants who sign up to Basil, and reservation details from the guests they serve. We use this data to run the booking, payment, and guest-management features Basil provides. We don't sell personal data. Restaurants control their own guest data and can export or delete it at any time.

Two kinds of data we handle

We act as a data controller for: Restaurant account information (owner/staff names, emails, phone numbers, business details, billing information); website usage data (how visitors use bookwithbasil.com and app.bookwithbasil.com).

We act as a data processor for: Guest reservation data that a Restaurant collects through Basil (guest names, contact details, party size, dietary and accessibility information, visit history, notes, and payment details related to a booking).

If you're a Guest with a question about how a specific Restaurant is using your data, the Restaurant itself is the right place to start. If you're a Restaurant with questions about how Basil processes data on your behalf, contact us using the details below.

Information we collect

From Restaurants: name, email, phone number, business name, address, location details, billing and subscription information, login credentials, usage data.

From early-access applicants: name, email, optional phone number, restaurant name, number of locations, country, current booking setup, the main booking or service bottleneck, and an optional plan of interest. We also record email-confirmation status, referral attribution, any peer-pass redemption, and whether you separately opted in to Basil updates.

From Guests: name, email, phone number, reservation details (date, time, party size), dietary requirements, accessibility needs, occasion notes, payment or card-hold information processed via our payment providers (not stored by Basil directly), visit history and preferences where a Restaurant uses Basil's guest CRM features.

Automatically collected: IP address, browser type and version, device information, pages visited, time spent, referring pages, cookies and similar tracking technologies.

How we use this data

To provide the booking, payment, table management, guest CRM, and communication features of Basil; to process payments and payment holds via Stripe and Square; to send booking confirmations, reminders, and feedback requests on a Restaurant's behalf; to review early-access applications and communicate confirmation or invitation decisions; to count only distinct applicants who confirm their email toward referral priority; and, only when you opt in, to send approved Basil build notes and product updates. We also provide customer support, improve and maintain the Service, detect and prevent fraud, abuse, or technical issues, and meet legal obligations.

Payment processing

Basil Payments is powered by Stripe. Where a Restaurant connects Square, payment and gift card data may also be processed through Square. We do not store full card numbers ourselves. See Stripe's and Square's own privacy policies for details of how they handle payment data.

Cookies and analytics

We use cookies for essential site functionality, and (with your consent) for analytics via Google Analytics. Analytics cookies are not set until you've given consent via our cookie banner. You can manage or withdraw cookie consent at any time.

Data retention and deletion

Restaurants can export their guest and reservation data at any time, and request deletion or anonymisation, subject to any legal obligation to retain certain records. If a Restaurant's account is closed, we retain data only as long as necessary, then delete or anonymise it.

Early-access application records and their Basil Waitlist deal records in HubSpot are retained for up to 12 months from the application date, then deleted. We use HubSpot to review verified applications and manage cohort invitations. Contact records used for the waitlist, including contacts created by Basil, follow the HubSpot account’s contact-retention settings and may remain after the application and deal are deleted; you can request earlier deletion through the contact address below. Optional product updates stop when you unsubscribe or withdraw consent; applicants who unsubscribe may still receive essential confirmation or invitation messages about their application. Email providers may retain copies under their own retention policies.

Your rights (UK GDPR)

You have the right to access, correct, request erasure of, restrict or object to processing of, and request portability of your personal data, and to lodge a complaint with the ICO (ico.org.uk). For your Restaurant account, contact us directly. For a Guest booking, contact the Restaurant first, they control that data.

Sharing your data

We share data with payment providers (Stripe, Square), service providers who help us run Basil, and email and CRM providers. Twilio SendGrid processes waitlist confirmation, invitation, and separately consented update emails. HubSpot stores contact details and verified application information so Basil can review applications and manage invitations; pipeline decisions are checked against Basil's email verification and cohort-capacity rules. We may also share data with legal authorities where required by law. We do not sell personal data to third parties.

International data transfers

Where data is transferred outside the UK or EEA, we take steps to ensure it's protected to a standard consistent with UK data protection law.

Security

We use technical and organisational measures to protect personal data, including access controls, encryption in transit, and tenant data isolation between Restaurant accounts. No method of storage or transmission is completely secure.

Children's privacy

Basil is a business tool, not directed at anyone under 18, except where a Guest provides basic booking details as part of a family or group reservation made by an adult.

Changes to this policy

We may update this policy from time to time, posting the new version here with an updated effective date.

Contact us

Questions about this policy: hello@wave-marketing.co