• Pricing
Revasi
Log inBook a demo
Demo
Pricing

Book a demo.

Tell us about your venue. We’ll walk you through the system that seats Locavore NXT, Soléa, Empat Group and other venues across Bali every day.

Rather talk now? Message us on WhatsApp

We’ll open WhatsApp with these details, ready to send. See how we handle them in our privacy policy.

Revasi

The reservation system built for high-end venues.

System status

Product

  • Revasi Pro
  • Revasi Lite
  • Pricing
  • Log in

Resources

  • Why Revasi
  • Case studies
  • Blog
  • Contact
  • Developers

Company

  • About
  • Talk to us

© 2026 Revasi · Made by Pandu & Digics with care in Indonesia

Privacy policyCookie policy

Last updated: November 2026

Privacy Policy

This policy explains what personal data we collect when you use Revasi to make a reservation at our partner restaurants and bars, how we use it, and what rights you have. It applies to guests booking through our platform and to visitors of revasi.net.

Contents

  1. 1. Who we are
  2. 2. Personal data we collect
  3. 3. Why we process your data and our legal basis
  4. 4. Dietary and health-related information
  5. 5. Who we share your data with
  6. 6. International data transfers
  7. 7. How long we keep your data
  8. 8. Your rights
  9. 9. Cookies
  10. 10. Security
  11. 11. Children
  12. 12. Changes to this policy

1. Who we are

The Revasi reservation platform is operated by Revasi (“Revasi”, “we”, “us”, “our”). The Service is accessible via revasi.net and the venue booking pages of the restaurants and bars that use Revasi (collectively, the “Service”).

This policy applies to reservations made at the restaurants and bars that use Revasi. The venue you book with decides what it needs to know in order to host you, and keeps its own guest records. Revasi runs the platform that holds them and handles your data on that venue’s instructions. Where this policy says “we”, it means Revasi and the venue you are booking with, unless the sentence names one of them.

For questions about this policy or to exercise your data rights, contact us at privacy@revasi.net.

2. Personal data we collect

When you make or manage a reservation, or use a Revasi account, we collect:

  • Identity data: first name, last name, salutation
  • Contact data: email address, phone number, country
  • Reservation data: date, time, party size, dining preferences, special occasions
  • Party composition: how many of your party are adults and how many are children. We store the number of children; the number of adults follows from your party size.
  • Nationality: where you are from, at venues that ask for it. Where a venue asks, answering is optional unless that venue has marked the question required, and you can always choose “prefer not to say” instead of naming a country.
  • Language: the language you choose on the booking page, kept with your reservation so that our emails about it reach you in the same language.
  • How you reached us: the page that referred you to the booking form, and any campaign tags carried in the link you followed — a newsletter, a social post, a venue’s own website or an ad. We keep them with the reservation so the venue can see which of its links bring bookings. This is about the link, not about you: it says nothing we did not receive from the link itself.
  • Accommodation: where you are staying during your visit, if you tell us — the property name as you enter it, and, where you pick a result from the address search, the town, country and map coordinates of that property. You can instead indicate that you live locally, and you may leave the field blank.
  • Post-visit reviews: the ratings you give (overall, food, service, atmosphere) and any comments you write, where you choose to leave them after your visit
  • Dietary information: allergies, dietary restrictions, and food preferences you choose to share (see Section 4)
  • Payment data: masked card number and payment reference (full card details are handled by our payment processor, Xendit — we never store your full card number)
  • Marketing preferences: your opt-in or opt-out status for email communications from each venue
  • Guest profile data: categories and notes recorded by venue staff to personalise your experience, such as VIP status, visit frequency, cancellation history, and labels (e.g. “returning guest”, “influencer”). You have the right to access and object to this categorisation — see Section 8.
  • Revasi account data: if you create a Revasi account, your email address, your sign-in sessions, and the one-time codes we email you to sign in (stored only in scrambled form, and valid for 5 minutes). Anything else on your profile is optional and only there if you add it: your name, phone number, profile photo, nationality, country and city of residence, birthday and anniversary, job title and workplace, social media profiles and website, dietary needs and allergies, and the language you would like our emails in.

3. Why we process your data and our legal basis

PurposeLegal basis (GDPR)Legal basis (Indonesian PDP)
Processing and managing your reservationContract (Art. 6(1)(b))Contractual necessity (Art. 20(2)(b))
Sending the messages your booking needs — confirmation, a reminder before your visit, a reminder on the day itself, a request to reconfirm where your venue asks for one, and a cancellation notice — by email in the language you chose, and by WhatsApp at venues that have connected itContract (Art. 6(1)(b))Contractual necessity (Art. 20(2)(b))
Emailing you after your visit to ask how it went, and for a reviewLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
Emailing you that a table has opened up, where you joined a waitlist and asked to be toldConsent (Art. 6(1)(a))Consent (Art. 20(2)(a))
Asking where you are from, at venues that include the question, to understand who a venue is hosting and prepare service accordinglyLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
Recording which link or campaign your booking came from, so a venue can see which of its own channels bring bookingsLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
Answering a question a venue added to its own booking form, in order to host you as that venue needs toContract / explicit consent where the answer concerns health (Art. 6(1)(b), 9(2)(a))Contractual necessity / explicit consent (Art. 20(2)(b), 20(2)(a))
Running your Revasi account at your request: signing you in, keeping your profile, and filling in your details when you bookContract (Art. 6(1)(b))Contractual necessity (Art. 20(2)(b))
Preparing your dining experience (dietary & special occasions)Explicit consent (Art. 9(2)(a))Explicit consent (Art. 20(2)(a))
Sending marketing and promotional emails about the venue you booked and the other venues in its group, including news, events, and offers to add upgrades or enhancements to your reservation

4. Dietary and health-related information

Dietary restrictions you provide (such as allergies, halal, coeliac, or other food preferences) may reveal information about your health or religious beliefs. Under GDPR Article 9 and Indonesian PDP Article 4, this is treated as sensitive personal data. We collect it only to prepare your dining experience and do not share it with any third party outside of the kitchen team at the venue you are visiting. You are not required to provide this information to complete your booking. If you save dietary needs or allergies to your Revasi account, they fill in your future bookings and reach each venue you book in the same way. You can change or remove them on your account at any time. A question a venue has added to its own booking form can ask about food or health as well — whether a particular ingredient works for you, for instance. Those answers are treated exactly as described above: used only to prepare your meal, shared only with the kitchen team at the venue you are visiting, and never disclosed through the partner interface in Section 5.

5. Who we share your data with

Your personal data reaches the services listed below and nobody else, except as the rest of this section describes. Each is bound by a Data Processing Agreement. Which of them apply to you depends on the venue you are booking: several are connected by the venue itself, and where a venue has not connected one, nothing reaches it.

  • Resend (Resend, Inc., USA) — sends transactional and reminder emails (booking confirmation, reminders, and cancellations, the sign-in codes for your Revasi account, and the notice our own team receives when you request a demo) on our behalf. We share your name and email address, and the details you enter in a demo request, with Resend solely to deliver these messages.
  • Xendit (PT Xendit Pembayaran Indonesia) — processes card payments, the card authorisations some venues hold as a booking guarantee, and, where your venue has them enabled, bank transfers paid to a virtual account. We share the minimum data required to create a payment request. Which of these you are offered, if any, depends on the venue and on what you are booking; many bookings take no payment at all.
  • Cal.com (Cal.com, Inc., USA)— schedules the demo call when you book one on our demo page. We share your name, email address, your venue’s name and your time zone with Cal.com solely to book the call and send you its invitation.
  • Supabase (Supabase Inc., USA) — our database and infrastructure provider. All data described in this policy is stored on Supabase-managed servers.
  • Vercel (Vercel Inc., USA)— hosts the Service and serves every page and booking request. Your requests pass through Vercel’s infrastructure, and its server logs hold the usage data described in Section 2.
  • LocationIQ — provides the address search behind the accommodation question, at venues that ask it. What you type into that field is sent to LocationIQ so it can return matching places; the place names and map data it returns come from OpenStreetMap. Nothing is sent until you start typing there, and if you leave the field blank, or tell us you live locally, nothing is sent at all.
  • Meta (WhatsApp Business Platform)— delivers WhatsApp messages about your booking, at venues that have connected WhatsApp. We share your phone number, your name and the booking details the message itself contains. Most venues message you from their own WhatsApp number; if your number is international, the message may instead come from Revasi’s number. Venues that have not connected WhatsApp send you nothing this way.
  • Point-of-sale systems, at venues that connect one (for example Moka)— the one entry on this list that sends data to us rather than receiving it. We receive that venue’s bills: the amount, the table, what was ordered and, where the venue recorded them on the bill, a name, phone number or email address. We use them only to link each bill to the reservation it belongs to, so the venue can see what a visit was worth. They stay with that venue and are not shown to any other, and we send the point-of-sale system nothing about you.

6. International data transfers

Some of our service providers are located outside Indonesia and the European Economic Area (EEA). Where personal data is transferred internationally, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and, for transfers from Indonesia, we ensure safeguards equivalent to those required by Indonesian PDP Law (UU No. 27/2022) Article 56. Specifically: Resend, Cal.com, Supabase and Vercel are US-based and operate under Standard Contractual Clauses (and equivalent data-processing agreements) for these transfers. LocationIQ, which serves the accommodation address search, and Meta, which delivers WhatsApp messages at venues that use them, also process data outside Indonesia under the same safeguards. If you would like a copy of the applicable transfer mechanism, contact us at privacy@revasi.net.

7. How long we keep your data

We retain personal data only as long as necessary:

  • Reservation records: 3 years from the reservation date, after which records are anonymised or deleted. Accommodation details and post-visit reviews are part of the reservation record and are removed with it.
  • Marketing contact lists: until you withdraw consent or request deletion
  • Revasi account: until you delete it. Deleting your account removes your profile, profile photo and sign-in sessions straight away. Your bookings stay with the venues you booked, for the reservation-record period above, and your marketing preferences stay as they are until you change them. Sign-in sessions end after 180 days without use.
  • Payment references: 5 years, as required by Indonesian tax regulations
  • Activity logs: 12 months
  • Ad click references: 90 days from the booking, after which the click is removed from the booking and from its history. Your answer to the measurement question is kept, as the record of what you agreed to.

8. Your rights

Under GDPR and Indonesian PDP Law (UU No. 27/2022), you have the following rights regarding your personal data:

  • Right to access: request a copy of the personal data we hold about you
  • Right to rectification: ask us to correct inaccurate or incomplete data
  • Right to erasure: request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements
  • Right to portability: receive your data in a structured, machine-readable format
  • Right to withdraw consent: withdraw marketing consent at any time via the unsubscribe link in any email, or by contacting us
  • Right to object: object to processing based on legitimate interests
  • Right to restrict processing: request that we limit how we use your data

To exercise any of these rights, email privacy@revasi.net with your name, email address, and the right you wish to exercise. We will respond within 30 days. If you have a Revasi account, you can also see and correct your profile, change your marketing preferences for each venue, and delete your account yourself at revasi.net/account. Deleting your account closes it, but it does not erase your bookings from the venues’ records. To ask for that, email us as above. Indonesian residents may also lodge a complaint with the Badan Siber dan Sandi Negara (BSSN). EU/EEA residents may lodge a complaint with their local data protection authority.

9. Cookies

We use essential cookies to keep your session active during the booking process, to keep you signed in to your Revasi account, and to remember your sidebar preferences in the admin panel. Advertising cookies are used on revasi.net to measure Revasi’s own Google ads (not in the EEA, the UK or Switzerland), and at venues that measure their Google ads, only after you allow it on that venue’s booking page. For full details, see our Cookies Policy.

10. Security

We implement technical and organisational measures to protect your personal data, including row-level security on our database, encrypted connections (TLS), and access controls limiting data access to authorised staff only. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within the timeframe required by law (72 hours under GDPR, and within 3×24 hours under Indonesian PDP Law (UU No. 27/2022) Article 46) and will inform affected individuals without undue delay.

11. Children

Our Service is not directed at children under the age of 17. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our platform, please contact us at privacy@revasi.net and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date below and, where required by law, notify affected users by email. Continued use of the Service after a change constitutes acceptance of the updated policy.

Questions? Email privacy@revasi.net.

Back to Revasi

  • Usage data: pages visited on our platform (collected via server logs)

    • Which of these questions you are actually asked depends on the venue. Dietary restrictions, special occasions, accommodation and nationality are each a setting the venue controls: it can leave a question out of its booking form altogether, offer it as optional, or make it required before a booking can be completed. Two venues using Revasi may therefore ask you for different things, and a question you answered at one venue is not put to you at another. Venues can also add questions of their own — about a set menu, an arrival time, an activity, or anything else they need in order to host you. Those answers are stored with your reservation and are visible to that venue alone. Where a venue’s own question asks about food or health, we treat the answer as sensitive personal data in the same way as Section 4 describes.

    When you request a demo of Revasi, we collect your name, your venue’s name and your email address and, if you give them, your phone number, how many covers you serve, a note, and the time you choose for the call. We also record which page of our site you sent the request from.

    Consent (Art. 6(1)(a))
    Consent (Art. 20(2)(a))
    Guest profiling by venue staff (VIP status, visit labels, preferences) to personalise serviceLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
    Recording where you are staying, to plan service and arrivalsLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
    Collecting and acting on your post-visit reviewLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
    Recording who made a booking, where someone books on your behalf (a hotel concierge, travel agent or venue staff member)Contract / legitimate interests (Art. 6(1)(b), 6(1)(f))Contractual necessity / legitimate interests (Art. 20(2)(b), 20(2)(f))
    Improving our service and analysing venue performanceLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
    Measuring which of Revasi’s own Google ads lead to demo requestsLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
    Complying with legal obligationsLegal obligation (Art. 6(1)(c))Legal obligation (Art. 20(2)(c))

    What we email you, and what you agreed to. These are not one setting, and they do not all rest on the same permission:

    • Your confirmation, your reminders and your cancellation notice— including the reminder on the day of your visit, and a request to reconfirm at venues that ask for one. They reach you by email, and by WhatsApp as well at venues that have connected it. These are how a reservation is managed rather than messages about it, so we send them without asking separately and you cannot turn them off while the booking stands. Cancelling the booking stops them.
    • The review request after your visit— sent once, after you have dined, because how service went is how the venue improves it. This rests on legitimate interests rather than consent, which means you can object at any time and we will stop sending it: see Section 8.
    • A waitlist offer— sent only if you joined a waitlist and ticked “Email me if a table opens up”. You asked for this one specifically, and we use it for nothing else: it tells you about the date and service you waited for, it is recorded separately from any marketing permission, and it is never treated as one. It stops once the table is taken or the request expires, and you can ask us to take you off the list at any time.
    • News, events and offers to add upgrades— marketing, sent only where you opted in, and only for the venue or group you opted in to. Each venue is its own separate choice. Every one of these emails carries an unsubscribe link, and withdrawing that consent changes nothing above it.
  • Google Ads, at venues that use it— some venues advertise on Google. At those venues, and only if you allow it on the booking page, we send the venue’s own Google Ads account a record that your booking came from one of its ads: an ad click reference, the booking time and value, and a scrambled (hashed) copy of your email address and phone number. Google uses it to measure that venue’s ads. We do this on the venue’s instruction, and you can change your answer at any time on our Cookies Policy.
  • Google Ads, for Revasi’s own ads— Revasi advertises on Google to reach venues. If you arrive at revasi.net from one of those ads and then request a demo, we keep the ad click reference with your request and send Google a record of it, with a scrambled (hashed) copy of your email address, so we can see which ads bring enquiries. A tap on one of our WhatsApp links is counted too. For visitors in the EEA, the UK and Switzerland we keep no ad click and send no email address, and Google’s tag sets no cookies. Ad personalisation stays off. See our Cookies Policy.

    • Two further routes are worth setting out on their own, because in both it is the venue, or you, rather than Revasi who decides where your data travels.

    Your Revasi account.One account works at every venue using Revasi. When you book, your profile fills in your details, and what you book with reaches that venue like any booking. Venues you book may also see your profile, so they can prepare for your visit. Your visit history is shared only within a venue’s own group: a venue can see that you have dined at another venue in its group, never at a venue outside it. Your profile photo is shown only to you, and your account profile is not shared through the partner API described below.

    Venue-authorised integrations.The venue or venue group you book with may connect its own service providers (for example a guest-relationship or CRM system) to Revasi through our partner API. Where it does, we share your identity data, contact data, reservation details, accommodation details, post-visit reviews, visit history, and marketing preferences with that provider on the venue’s instructions and under a data-processing agreement. Where someone booked on your behalf, their name and contact details are shared as the booker. This access is limited to the venues that provider works for, is read-only, and can be revoked by the venue at any time.

    The structured dietary and health information you give us, and private notes recorded by venue staff, are never shared through this interface. Review comments are your own free text and are shared as written — so if you would rather something stayed between you and the venue’s team, leave it out of the comment box or contact us at privacy@revasi.net.

    We do not sell your personal data, and we do not share it with data brokers.