Privacy Policy

Last updated: 24 August 2026

1. Who we are

Leesta is a table reservation platform for restaurants and bars in Cyprus, available through the Leesta app for diners and the Leesta Business app for venues.

The data controller is Dimitris Onisiforou, sole trader, trading as Leesta, of Andrea Syngrou 13, 4040 Limassol, Cyprus.

For any privacy matter, including to exercise your rights under this policy, contact privacy@leesta.cy.

2. What we collect

Account data — your full name and phone number, verified by SMS when you sign up.
Booking data — the venue, date, time, party size and table of each reservation, including cancelled bookings, completed bookings and recorded no-shows.
Messages — chats you send to venues or to Leesta support through the app.
Payment references — where a venue requires a deposit or a card hold, your card details are collected and held by Stripe. Leesta never sees or stores your card number. We store only Stripe's reference identifiers against your booking.
Device data — a push notification token, so we can notify you about your bookings.

We do not collect your location, we do not track you across other apps or websites, and we do not use advertising identifiers.

3. Why we use it, and our lawful basis

Creating and managing your reservations, and passing them to the venue you booked — performance of our contract with you (Art. 6(1)(b) GDPR).
Verifying your phone number by SMS — performance of our contract, and our legitimate interest in preventing fraudulent and abandoned bookings (Art. 6(1)(b) and 6(1)(f)).
Processing deposits and no-show holds on behalf of venues, through Stripe — performance of our contract with you (Art. 6(1)(b)).
Messaging between you and a venue, or you and Leesta support — performance of our contract, and our legitimate interest in resolving support requests (Art. 6(1)(b) and 6(1)(f)).
Recording attendance, including no-shows, and making that record visible to venues — our legitimate interests and those of venues (Art. 6(1)(f)). See section 4.
Sending push notifications about bookings, changes and waitlist offers — your consent, given when you allow notifications on your device (Art. 6(1)(a)). You can withdraw it at any time in your device settings without affecting your bookings.

4. Our legitimate interest in the no-show record

A reservation that is not honoured costs a venue a table it could have sold and cannot recover. We record whether each booking was attended, cancelled or missed, and we show a venue the count of previous no-shows for a diner booking with them.

We have weighed this against your interests. The record is a count of a factual event, not an assessment of your character; it is visible only to the venue you are booking with, never to other venues or to the public; it is not used to refuse bookings automatically, and no decision about you is made by automated means; and it is deleted on the schedule in section 7. We consider this a proportionate use that you would reasonably expect when booking a table.

A no-show older than 24 months is cleared and no longer shown to anyone.

You may object to this use at any time under Art. 21 GDPR by contacting us. If you object, we will stop showing the record to venues unless we can demonstrate compelling grounds that override your interests.

5. Who we share it with

The venue you book — your name, phone number, booking details and no-show count. See section 6.
Stripe Payments Europe, Ltd. — payment processing. Where a deposit or hold applies, the venue is the merchant of record for the charge. Stripe processes your card data as its own controller under its privacy policy.
Google Ireland Limited (Firebase) — our infrastructure provider, acting as our processor. Your data is stored in the European Union (region europe-west1).

We do not sell your data, we do not share it with advertisers, and we do not share it with venues you have not booked with.

Transfers outside the EEA. Our data is stored in the EU. Our providers may nonetheless access it from outside the EEA for support and operational purposes. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses under Art. 46 GDPR.

6. Venues, and what they may do with your data

When you book, Leesta and the venue each decide how your booking data is used, which makes us joint controllers under Art. 26 GDPR. The essence of our arrangement, which you are entitled to know, is this:

Leesta is your single point of contact. Send any request — access, correction, export, deletion, objection — to privacy@leesta.cy. We will action it on our side and pass it to the venue. You never have to contact a venue yourself, although you may also exercise your rights directly against either of us.
Venues receive your data only to manage your booking. Their agreement with us prohibits using it for marketing, adding you to a mailing or messaging list, exporting it, or passing it to anyone else.
If a venue contacts you for anything other than your booking, tell us. Write to privacy@leesta.cy. We can suspend or remove a venue from the platform for misusing diner data.

7. How long we keep it

Account data — until you ask us to delete your account. We complete deletion within 30 days of the request.
Booking history — kept for as long as your account exists, so that you can see your own reservations. Deleted within 30 days of you deleting your account. Venues keep an anonymised record of the reservation itself — date, time, party size and table — which is no longer linked to you.
No-show record — 24 months from the date of the missed reservation, then cleared. We cap this separately from the rest of your booking history because it is the only part that can count against you.
Messages — kept for as long as your account exists, so that you and the venue both keep the thread. Deleted within 30 days of you deleting your account.
Payment references — deleted with the booking they belong to. Stripe and the venue keep their own payment records under their own obligations, which we do not control.
Push notification token — until you sign out, uninstall the app, or turn notifications off.

8. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data deleted;
receive your data in a portable, machine-readable format;
restrict how we use your data;
object to processing based on our legitimate interests, including the no-show record (section 4);
withdraw consent to push notifications at any time, without affecting anything we did before you withdrew it.

To exercise any of these, contact privacy@leesta.cy. We respond within one month. You can also delete your account from within the Leesta app — see how to delete your account.

If you are not satisfied with how we handle your request, you may complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, 15 Kypranoros Street, 1061 Nicosia — www.dataprotection.gov.cy.

9. Security

Your data is held in Google Firebase in the European Union, protected by access rules that restrict each venue to its own bookings and each diner to their own account. Card data never reaches our systems. No system is perfectly secure; if a breach affects your personal data and puts you at high risk, we will tell you, and we will notify the Cyprus Commissioner within 72 hours as required by Art. 33 GDPR.

10. Children

Leesta is not directed at children. You must be 16 or older to create an account. If you believe a child has created an account, contact privacy@leesta.cy and we will delete it.

11. Changes to this policy

If we change how we use your data, we will update this page and change the date at the top. Where a change materially affects you, we will tell you in the app before it takes effect.