Before a hotel group or restaurant brand adopts any guest-facing channel, someone sensible asks: where does the data go, who touches card numbers, and what happens when a guest invokes their GDPR rights? Those are the right questions. Here are straight answers.
What data exists, and where it lives
- ✓ Guest conversations: stored to process orders and maintain service history. Access is restricted to the venue's authorized accounts.
- ✓ Order records: menu items, modifiers, table, timestamps — the minimum needed to run service and accounting.
- ✓ Preferences (language, allergies, favorites): stored to personalize service, deletable on request.
- ✓ Nothing is sold, shared, or used for advertising. Ever. The data belongs to the guest relationship, not to a data broker.
PCI: the part that should worry you least
MezaTab never stores card numbers. Payments run through licensed, PCI-DSS-compliant processors using hosted flows — the guest enters card details on the processor's secure page, not in your systems. Your venue's PCI scope stays minimal, the same as (or smaller than) taking cards at a counter today.
GDPR fundamentals, handled
- ✓ Lawful basis: guests explicitly opt in by messaging your number and can opt out at any time with a single word.
- ✓ Data minimization: the system collects what service requires — nothing more.
- ✓ Right to access/erasure: guest data can be exported or deleted on request, with venue-level tooling to action both.
- ✓ Retention policies: configurable retention windows so transcripts and records age out on your schedule.
The checklist your IT team will ask for
- 1 Where is data hosted, and is it encrypted at rest and in transit?
- 2 Which sub-processors touch guest data (hosting, payments, messaging), and under what agreements?
- 3 How are venue staff authenticated, and can access be role-restricted and revoked?
- 4 What is the breach-notification process?
- 5 How quickly can a guest's data be deleted end-to-end?
We answer all five in a single document written for legal and IT reviewers — not marketing.
WhatsApp itself is end-to-end encrypted for message content, and Meta operates the platform under its own GDPR obligations. Combined with processor-side payment handling, the practical result is this: the safest guest-data setup your venue has ever run may be the one with no hardware and no forms at all.
Ready to make this yours?
MezaTab is $20/week flat — no commissions, no hardware, no app downloads. Most venues go live in under a week.
Get the one-pager you can share with your legal/IT team →