Privacy notice

1. Who is responsible

Barak Tal, trading as BaReco, is the data controller: the person responsible for deciding how your personal information is used. Contact barak@barecoldn.com with privacy questions or requests. This notice will be updated if the business operator changes.

2. What I receive

• Your name, email, preferred contact method and phone number if you choose calls or texts.
• Your chosen service and restaurant brief, including plans such as date, time, party size, location, budget, occasion and preferences.
• Correspondence and booking details from you, restaurants or an organiser acting for your party.
• Service amount, payment status, checkout reference and, for members, a subscription reference provided by Stripe.
• Technical connection information processed by hosting and payment providers, such as IP address and browser details. My website uses a hashed IP-and-time identifier to limit repeated submission attempts.

If you provide another person's details, make sure they know about this notice and provide only what is necessary. Do not submit their health information through the form.

3. When your brief is saved

Pressing Continue to payment sends and saves your brief before Stripe checkout opens. Abandoned or unsuccessful checkouts can therefore leave unpaid requests. The server marks a request paid only after verifying Stripe's payment notification.

I need your name, email and brief to handle a request, and your phone number if you choose calls or texts. Without required information I cannot accept it through the form. Never put card details, passwords or identity documents in your brief or messages.

4. Purposes and lawful bases

• Providing the service: research, communication, restaurant arrangements and membership administration. My basis is taking steps at your request before a contract and performing the contract.
• Operating and protecting the business: preventing abuse, investigating errors and handling complaints or disputes. My basis is legitimate interests in these activities, balanced against your rights.
• Legal obligations: keeping records required for applicable accounting, tax and other legal duties.

Recommendations and arrangements are handled by Barak. Payment status checks are automated, but BaReco does not make solely automated decisions about you with legal or similarly significant effects. Submitting a brief does not sign you up to marketing.

5. Allergies and sensitive details

Allergies, medical conditions and some accessibility or religious information can be particularly sensitive. Keep the online brief to ordinary booking preferences. If an arrangement needs sensitive details, contact Barak to agree how they will be handled and give specific, explicit consent before sending them. The general form checkbox is not consent to process sensitive information.

Where I rely on explicit consent, you can withdraw it by emailing barak@barecoldn.com. This does not undo earlier lawful processing but may prevent me from arranging that requirement. Confirm important allergy requirements directly with the restaurant.

6. Payment information

You enter payment details on Stripe-hosted checkout, not the BaReco form. My website does not receive or store your full card number or CVC. Stripe processes payments and monthly subscriptions; BaReco stores references and status to match a payment with a request.

Stripe also uses information for its own purposes, including fraud prevention and regulatory duties. See Stripe's privacy policy. This notice is about information use, not a guarantee of restaurant availability or a replacement for service terms.

7. Sharing and service providers

• Barak: requests appear in the protected admin area. New paid-request notification emails contain only a request reference, service type and admin link—not the client's name, email, phone number or brief. Notifications sent before 3 October 2026's security update may still contain those details until removed from the inbox and provider records.
• OpenAI Sites and hosting infrastructure, including Cloudflare: website delivery and request storage.
• Stripe: email, service, amount and request reference for checkout. The website does not send the restaurant brief to Stripe.
• Resend and Google Workspace: sending notifications and operating the business email inbox. Your chosen email or telephone services also handle direct communications.
• Restaurants and requested suppliers: necessary information to enquire, reserve or arrange your request, such as booking name, party size and relevant preferences. They may have their own privacy notices.
• Advisers and authorities: where necessary for a legal duty or claim.

Requests are not published on the website or sold as a customer list.

8. International processing

Technology providers operate internationally, so information may be processed outside the UK, including in the United States. I do not promise UK-only storage. The arrangements differ by provider; contact Barak for details of the applicable transfer arrangements and safeguards. Provider information is available from OpenAI, Cloudflare, Resend, Google and Stripe.

9. Retention and deletion

My retention policy for restaurant briefs is:

• Abandoned, unpaid briefs: 30 days after submission.
• Paid clients' briefs: 12 months after the client's last request or the end of their membership, whichever is later. Requests made directly by email, text or phone count as requests too.

Before deletion, Barak checks whether a request is still being arranged, membership is active, or information is needed for an unresolved payment, refund, complaint, dispute or legal obligation. Where necessary, relevant information is kept for longer and reviewed when that reason ends. Accounting and payment records are handled separately; keeping a transaction record does not mean keeping the full restaurant brief or detailed preferences.

These periods are applied through manual review; automatic deletion is not currently enabled. Reviews must cover the website database and relevant email or message copies. You can ask Barak to review or delete information at any time; if information must be kept for a legal reason I will explain why. Restaurants and payment providers may retain independent records under their own policies.

10. Cookies, fonts and browser storage

The form saves a random request reference and receipt token in browser session storage to check payment status. It does not store the brief or card details there. Close your browser session on a shared device because someone using it may see the payment confirmation.

The current site code does not add advertising pixels or analytics trackers. Google Fonts receives connection information to deliver fonts. Hosting security, administrator sign-in and Stripe checkout may use necessary cookies or similar technologies, explained in their own notices.

11. Security

The site uses HTTPS, server-side admin access checks, protected server credentials, browser security headers and verification of Stripe payment notifications. These reduce risk, but no website, email service or internet transmission can be guaranteed completely secure. Report a suspected exposure to barak@barecoldn.com without including additional sensitive details.

12. Your rights and complaints

Depending on the circumstances and lawful basis, you can request access, correction, deletion, restriction or a portable copy of certain personal information. You can withdraw consent where it is relied on. I may need proportionate information to verify your identity before disclosing records.

Right to object: you can object to processing based on legitimate interests because of your particular situation, and to direct marketing at any time.

Email barak@barecoldn.com. I will respond within the applicable legal time limit and explain any lawful extension or exception. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, without first complaining to BaReco.

13. Updates

The date above identifies this notice. I will update it when the operator, service or data practices change and give further notice where required.