Politique de confidentialité

Combined policy for Eleaters and Restaurateurs
Version: 1.0
Effective Date: [Launch Date]
Last Updated: 30 October 2026
Applies to: Eleat Technologies Inc. (Alberta, Canada) and Eleat Technologies Limited (Hong Kong)

1. About this policy

This Privacy Policy explains how Eleat handles personal information when people use the Eleat mobile application, website, restaurant administration tools, reservation-routing features, reviews, Feeds, Zaryna, support and related services. It is written for both Eleaters and Restaurateurs.

In Hong Kong, Eleat Technologies Limited is the Eleat company responsible for the Platform in that market. In Canada, Eleat Technologies Inc., an Alberta corporation, is the Eleat company responsible for the Platform in that market. In this policy, both are called “Eleat”, “we”, “our” or “us” as the context requires.

This policy is intended to operate consistently across Hong Kong and Canada. Where a mandatory privacy rule gives a person stronger rights or imposes a stricter duty, that rule applies.

2. Eleat vocabulary

Eleater means a person using Eleat.

Guest means a person physically present in a restaurant.

Restaurateur or restaurant means the hospitality business using Eleat.

Platform means the Eleat application, website, backend and related services.

Reservation provider means an external booking service or restaurant-controlled booking page.

A reservation click is not a booking. A self-reported “Yes, I made a reservation” is not a confirmed reservation. Eleat records the Eleater’s statement about the outcome of a reservation journey; confirmation remains with the restaurant or reservation provider.

3. What Eleat is

Eleat is a behavioural hospitality discovery platform. It helps Eleaters decide where to go and what to eat by surfacing restaurants, Happy Hour, Daily Deals, Last-Minute Specials, Game Day experiences, Feeds, reviews and other restaurant information. Eleat is not a food-delivery service, not a payment processor for Eleaters, and not the restaurant’s reservation system.

4. Personal information Eleat holds about Eleaters

4.1. Account and profile information

Internal account identifier and Eleater ID.

First name, last name and preferred display name.

Email address and mobile number.

Whether the email or phone door used to join was verified.

Preferred language, locale, Zaryna voice locale, preferred currency and market.

Date of birth collected during signup.

Profile picture, selected city, cuisine preferences and dietary flags if provided.

Optional gender and languages spoken.

Notification preferences for WhatsApp, email and in-app notices. Eleat has no SMS or push-notification channel in this version.

Account status information, including login time, deletion status, bans or suspensions.

4.2. Authentication and security records

A password hash, never the plain password, where the Eleater has a password.

Verification-code records containing the destination, purpose, a hash of the code, expiry time and whether it was used.

A token-version value used to invalidate older sessions after certain security events.

Verification codes expire after 10 minutes. The current session token configuration uses a 30-day expiry. Eleat does not have a per-device session list or a “your devices” screen in this version.

4.3. Discovery and behavioural information

Search queries and craving or intent text.

Restaurants, deals, menu items, campaigns, sports events, carousels and screens interacted with where those event fields are used.

Saved restaurants and saved Feed posts.

Restaurant share events.

Reservation-intent events such as source screen, stage, requested time, party size, occasion, outcome, device and locale.

Zaryna recommendation records, including what was asked and which restaurants were surfaced.

Status or loyalty event records captured in the background where those structures are used.

The analytics event endpoint can also receive arbitrary metadata supplied by a client screen. Eleat does not claim that this field is limited to a fixed list of values.

4.4. Reviews and visit records

Review stars, score-card ratings, written review text, recommendation response and uploaded photos or videos.

The restaurant response to a review.

A visit record showing whether attendance was confirmed, self-reported or otherwise recorded.

A review may be published only when Eleat has a verified dining visit under the current review rule.

A published review displays the Eleater’s sanctioned shown name: preferred or first name plus last initial. The Eleater ID can also appear beside a published review under the current implementation.

4.5. Reservation information

Restaurant, provider, source channel and source screen.

Times when the Eleater left Eleat for the provider and returned.

The Eleater’s self-reported reservation outcome.

Party size, requested date and time, seating type and occasion.

Special requests.

Dietary notes and allergy information entered for that reservation. These are treated as sensitive safety information and stay on the reservation record rather than being copied to the Eleater profile.

Contact name, contact phone and contact email entered for that reservation.

Attendance, door attribution and related provenance records when used.

Calendar-addition, detail-capture and pre-order-offered fields when used.

4.6. Information about other Guests

An Eleater may provide a Guest name, phone number or email as part of a reservation. A restaurant may also create a door-arrival or invitation record containing a Guest name and contact details. Those people may not have an Eleat account. In this version, the schema contains door-arrival and door-invite structures but the backend does not currently use them.

4.7. Support, moderation and account-enforcement information

Support-ticket text and internal resolution notes.

Suspension scope, reason, start/end time, appeal text, internal note and, where Zaryna issued a permitted suspension, AI reasoning.

Moderation reports and moderation decisions.

Private restaurant ratings about an Eleater, including stars and an internal free-text note. The note is visible to that restaurant and Eleat Super Admin for oversight, but not to the Eleater or other restaurants under the current schema.

5. Location information

Eleat can use latitude and longitude supplied with a discovery search or Zaryna request to narrow results. Under the current backend, those request coordinates are used for the request and are not stored against the Eleater by those flows. Reverse-geocoding results may be cached using coordinates rounded to about 110 metres and are not tied to a user ID.

The database also contains fields for an Eleater’s live coordinates and saved-address coordinates. The current backend does not write the live-location profile fields. Saved-address fields exist, but the schema does not state a current backend use for them beyond storing the address record.

6. Information Eleat holds about Restaurateurs and restaurant staff

Restaurant owner account details and the same basic account fields used for a signed-in Eleat account.

Restaurant name, phone, address, city, location, market, district, timezone, currency and default locale.

Business Registration or Business Number, company registration number where applicable, and normalized matching keys.

A verification-document URL, identity status and rejection reason where used.

Group ownership declarations and group notes.

Subscription plan, founding-program fields, billing status and processor customer reference.

Restaurant team membership, role, state and invited email.

Restaurant team-policy settings stored in the schema; the current screen does not save those toggles yet.

7. How Eleat collects information

7.1. Joining and signing in

An Eleater can join and sign in with their email address and a password, or with Google. When joining by email, Eleat sends a six-digit code to that email address to confirm it. If an Eleater forgets their password, Eleat emails a six-digit code so they can choose a new one; saving the new password signs out every other session. Sign-in by WhatsApp is built but not yet switched on; Eleat does not send codes by SMS.

When an Eleater chooses Sign in with Google, Google shares their name, email address, profile picture and a Google account ID with Eleat. Eleat keeps the name, email address and Google account ID, and uses them only to create and sign in to their Eleat account; it does not keep the profile picture. Eleat never receives their Google password, never posts to their Google account, and never reads their contacts, Gmail, Drive or any other Google data. They can remove Eleat's access at any time in their Google Account (Security → Third-party connections); their Eleat account stays, and they can use Forgot password on the sign-in screen to set a password and sign in with their email instead.

7.2. Using Eleat

Eleat collects information when an Eleater searches, interacts with restaurant content, uses Zaryna, begins a reservation journey, answers return questions, writes a review, saves or shares content, changes settings or contacts support. Restaurateur information is collected through restaurant onboarding, team access, restaurant administration, billing and operational use.

8. Why Eleat uses personal information

Create, secure and administer accounts.

Show content in the chosen language and locale.

Provide restaurant discovery and distance-based results.

Operate Zaryna and return relevant restaurant recommendations.

Route an Eleater to a restaurant’s chosen reservation provider and record the Eleater’s own stated outcome.

Verify dining visits for review eligibility.

Publish and moderate reviews and restaurant responses.

Operate support, account enforcement, fraud prevention and abuse controls.

Provide restaurant analytics using the data actually available to those services.

Run restaurant subscription billing.

Improve the Platform using interaction and analytics records.

Maintain platform integrity, legal records and audit trails where implemented.

9. Zaryna and AI

Zaryna uses Google Gemini when the AI service is configured. For Eleater concierge requests, the prompt sent to the model contains the Eleater’s free-text question, public information about candidate restaurants (including how far each one is) and public live-game information. When the Eleater is signed in, Zaryna also receives information that lets her personalise her suggestions: the Eleater’s first name; restaurants they have saved, visited, reviewed, shared or started a reservation with; Feed posts they have liked; their food, dietary and allergy preferences, budget, preferred distance and languages spoken; their age expressed only as a decade (for example “30s”); and their gender, only where they chose to give one. The concierge prompt does not include the Eleater’s email address, phone number, exact date of birth or exact coordinates.

When an Eleater uses the microphone, the recording of their spoken question is sent to Google Gemini so it can be written down in the language spoken. Eleat does not keep the recording; only the written question is used, as if it had been typed.

For restaurant insights, Eleat can send the restaurant’s own aggregate analytics and restaurant name. For review assistance, Eleat can send review text and rating, or sets of review text for summarization. The reviewer’s name is not included in the review-reply prompt. Menu and beverage helper features send restaurant-supplied menu or deal content.

The schema contains a Zaryna reservation-session table capable of storing a full conversation transcript tied to an Eleater, but the current backend does not write to that table.

10. External service providers

10.1. Google Places and geocoding

When configured, Google can receive typed place text, a latitude/longitude used as an optional location bias, a selected place ID, or coordinates for reverse geocoding. Eleat does not send the Eleater’s name, account ID, email or phone as part of those geocoding calls.

10.2. Reservation providers

Reservation providers such as OpenTable, Resy, SevenRooms, BistroChat, OpenRice, Chope, Inline, Eats365, Tock or another restaurant-selected provider operate their own booking pages. For most restaurants, Eleat opens the provider’s own booking page, and information typed there is collected by that provider under its own terms and privacy practices. Where a restaurant has connected its provider to Eleat: (a) the provider tells Eleat what happens to a booking that came from Eleat — made, changed, cancelled, seated or no-show — so it shows in the Eleater’s Reservations and the restaurant’s; and (b) the Eleater may book inside Eleat. When they tap Book, Eleat sends the provider their name, email address and mobile number, the booking details and anything they entered for the restaurant (occasion, requests, dietary notes), only to make that booking. Eleat does not take payment or card details; a time that needs a card is booked on the provider’s own page.

10.3. Restaurant billing processors

Airwallex is configured for Hong Kong and Southeast Asia restaurant subscription billing when credentials are present. Helcim is configured for Canada/US billing when connected. Airwallex receives the restaurant contact email in the hosted-checkout request. Helcim receives restaurant contact name, business name and email in its customer request. Eleat does not store card number, expiry date or CVV. Card details are entered in the processor’s own checkout or modal.

10.4. Other service providers

Google provides Sign in with Google (section 7.1). Resend delivers Eleat's emails, such as sign-in codes; it receives the email address and the message. TheSportsDB provides sports schedules for Game Day; Eleat sends it no personal information. WhatsApp/Meta delivery is built but not yet switched on. Eleat does not describe a service as active until it is actually connected.

11. What a restaurant can see about an Eleater

Restaurants can see information needed for the Eleat features they use. The current backend can return a shown name and Eleater ID with reviews. The reservation list can return reservation fields including contact name and contact phone, and can attach Guest names, phone numbers and emails. Order-detail code can return account phone and email, although ordering is not part of the launch version. A restaurant can also see its own private rating and note about an Eleater.

Restaurants can also see aggregated statistics about the Eleaters who interacted with their restaurant on Eleat, such as age bands (for example 25–34) and the share of each gender, alongside counts of views, saves, reviews and reservation clicks. These statistics combine many Eleaters and never include a name, contact detail, exact date of birth or Eleater ID. A breakdown is shown only when at least 50 Eleaters are in the group, and any band with fewer than 10 Eleaters is shown as “fewer than 10” rather than as a number, so that the statistics cannot reasonably be used to identify an individual. Gender is counted only where an Eleater chose to give it.

There is a known contradiction between the current restaurant-admin screen and the backend: the screen says a restaurant will never see phone or email, while the API currently returns some of those fields. This policy follows the actual backend and does not repeat the screen’s stronger promise. The product should resolve that contradiction before launch.

12. What other Eleaters and the public can see

There is no public Eleater-profile route in the current backend. Published reviews are publicly readable and can show the Eleater’s shown name, Eleater ID, rating, review text and uploaded media. Languages spoken are not shown publicly. Private restaurant notes about an Eleater are not shown to the Eleater or other restaurants.

13. Eleat Super Admin access

Eleat Super Admin functions can access platform-wide reviews, reservations, orders and support records. Reservation detail can include dietary notes and contact details. Admin write actions are recorded in an immutable audit log. Read access is not currently logged. Eleat therefore does not claim that every view of personal information is access-audited.

14. Marketing and consent

The database contains fields named data_processing_consent, marketing_consent, consent_at and behavioral_tracking_consent. The current backend and screens do not write or read those fields, and they default to false. Eleat therefore does not claim that those database fields currently record consent.

Where applicable law requires consent for direct marketing, marketing communications or a new use of personal information, Eleat will need to obtain the legally required consent before using the information for that purpose. In Hong Kong, silence is not treated as consent for direct marketing.

15. Cookies and tracking

The current Eleat web and prototype code does not implement a cookie-consent mechanism. Eleat does operate an analytics-event endpoint, including for signed-out traffic, and that endpoint does not currently have a consent gate. The separate Cookie & Tracking Statement explains the current position in more detail. Eleat does not claim that analytics tracking is consent-based in this version.

16. Security measures that exist today

Passwords are hashed with bcrypt.

Verification codes are generated using cryptographically secure randomness and only a hash of the code is stored.

Verification codes expire and are rate-limited.

Authentication checks account status and token version on protected requests.

Deployed configuration refuses weak JWT secrets and refuses to run without a database connection string.

CORS uses an allowlist rather than a wildcard.

Security headers are applied, including HSTS, nosniff, frame denial, no-referrer and a restrictive permissions policy.

JSON request bodies are capped at 1 MB.

Database queries are parameterized.

The production Postgres database is described in the project source of truth as not being exposed to the public internet.

Airwallex webhooks are signature-verified.

Service keys are server-side environment secrets and are not intended to be exposed to the browser.

Eleat does not claim controls that are not implemented. In this version there is no MFA, no per-device session list, no breached-password screening, no field-level encryption implemented by the Eleat repository, no Eleater IP log, no CAPTCHA, no WAF, and no audit record of who merely viewed personal information.

17. Retention

Some records have defined lifetimes. Verification codes last 10 minutes. Session tokens are configured for 30 days. Door invitations contain an expiry time. Timed suspensions end according to their end time.

Most other records do not yet have a documented retention period or automated purge rule. This includes analytics events, notifications, reservation-intent events, Zaryna recommendation records, support tickets, audit logs and several other records. Eleat therefore does not promise a specific retention period for those records in this version. Hong Kong privacy law requires personal data not to be kept longer than necessary for the purpose for which it is used, and Eleat’s retention implementation should be brought into line with that obligation before launch.

18. Account deletion

An Eleater can permanently delete an Eleater account using the deletion function built for Eleaters. Deletion is not the same as deactivation. The deletion function removes the Eleater profile, saved addresses, saved restaurants, saved Feed posts, notifications, carts, loyalty points and sponsored-crawl passport records. It clears email and phone from the account row, resets verification and notification preferences, disables the account and records the deletion time. The deleted account cannot be restored through that function and the cleared email or phone is free to be used for a future new account.

Deletion does not remove every record associated with the former account. Reviews are deliberately retained so an Eleater cannot change a restaurant’s historical score by deleting an account. The profile carrying the author’s name is removed, so the retained review loses that profile identity. Reservations, visits, support tickets, analytics events, restaurant shares, status events, private restaurant ratings, Zaryna recommendations, reservation-intent events, suspensions and some other records are not cleared by the current deletion function. Reservation records can therefore continue to contain contact details and dietary notes after account deletion. Database backups can also continue to contain older copies until those backups age out.

This is the actual current implementation. It needs a product and legal decision before launch on which surviving records should be deleted, anonymized, retained for integrity, or retained for legal reasons.

19. Access and correction rights

Hong Kong law gives data subjects rights to request access to and correction of their personal data. Alberta privacy law also provides access and correction rights, and Canadian privacy law imposes access obligations where applicable. Eleat’s current product does not provide a self-service full-data export. The settings endpoint returns only a limited subset of account information.

Jusqu’à a self-service export exists, access or correction requests must be handled manually through Eleat’s privacy contact. Eleat should publish a working privacy contact and the applicable company address before this policy goes live. Nothing in this policy limits a statutory right that applies even though the product does not yet automate the request.

20. International processing

Eleat operates across Hong Kong and Canada and uses service providers that may process information outside the Eleater’s market. The production database is currently described in the project source of truth as hosted on Render in Singapore. Google AI and geocoding services and restaurant billing processors may process information in locations determined by those providers. Eleat remains responsible for its own legal obligations when using service providers.

21. Children and age information

Eleat collects date of birth at signup. The previous alcohol age-gate logic is off in the current product. This policy does not claim that Eleat currently blocks alcohol-related content based on age. Before launch, Eleat should align the signup terms, alcohol presentation and any minimum-age rule with the actual product decision and applicable law.

22. Changes to this policy

Eleat may update this policy when the Platform or legal requirements change. The version and last-updated date will be changed when a revised policy is published. A material change to how personal information is used should be communicated in a way appropriate to the significance of the change.

23. Privacy contact

Before publication, Eleat must insert a working privacy contact and the registered or business address for each operating company:

Hong Kong: Eleat Technologies Limited — [Hong Kong registered office address] — [privacy contact email]Canada: Eleat Technologies Inc. — [Alberta registered office address] — [privacy contact email]

For a Hong Kong data-access or correction request, the published contact should be the person and address designated to receive the request. For Canadian privacy questions or access requests, the same contact can coordinate the response for the applicable Eleat company.

24. Legal framework

For Hong Kong, this policy is drafted with the Personal Data (Privacy) Ordinance (Cap. 486) and its Data Protection Principles in mind. For Canada, it is drafted with Alberta’s Personal Information Protection Act and, where applicable, the federal Personal Information Protection and Electronic Documents Act in mind. Mandatory law applies even where this policy is silent.

Revision history

Version

Date

Change

Owner

1.0

18 September 2026

Initial combined Privacy Policy based on the 18 September 2026 Eleat Personal Data Inventory.

Eleat Technologies