Privacy Policy

1. Who we are

Makan is a discovery and reservation platform for bars and restaurants, currently focused on Baku, Azerbaijan. We operate makan.rest (the guest app), the venue dashboard used by restaurants and bars, public venue menus, the WhatsApp and Telegram booking assistant, and the business waitlist site.

For questions about this policy or your personal data, write to studio@makan.rest. We operate from Baku, Azerbaijan, and handle personal data in line with the Law of the Republic of Azerbaijan on Personal Data.

2. Data we collect from guests

If you browse venues you can do so without an account. When you book a table, message Makan, or sign in to see your bookings, we collect:

Your name and phone number.
WhatsApp and/or Telegram identifiers when you write to our assistant or receive booking messages.
The text of those conversations, including drafts of a booking, so we can complete the reservation and remember useful preferences (for example language, party size habits, or notes you share).
Reservation details: venue, date and time, party size, table when assigned, status (requested, confirmed, seated, cancelled, no-show), optional notes, and a short meetup code the host may use to find you.
Post-visit feedback if we ask how the night went: your replies, a transcript of that chat, and a summary we generate (type of feedback, topics, sentiment). You can opt out of these check-ins.
Sign-in: we send a one-time code on WhatsApp or Telegram. Codes are stored only as a hash and expire quickly. A session cookie keeps you signed in on the guest app.
A city preference saved in your browser so the guest app can remember Baku (or another city we add later).
If a venue requires a deposit: payment status and a payment reference from ePoint. We do not store full card numbers.

3. Data we collect from venues and staff

If you create or join a venue on Makan we collect:

Staff name and email. Sign-in uses a one-time code sent by email (not a password). Codes are hashed and short-lived. A session cookie keeps the dashboard signed in.
Venue profile: name, address, map coordinates, district, description, type and tags, opening hours, public contact phone, WhatsApp contact (we send a message so you can approve the number), Instagram handle after verification, reservation rules (advance windows, confirmation timing, no-show grace, deposits).
A Google Place match when you search for your venue during signup or profile setup (place ID, address, hours, and public place context). If Google is unavailable we fall back to OpenStreetMap Nominatim.
Photos and menu images you upload. They are stored with our object storage provider (Cloudflare R2) and may appear on the public guest app and in the assistant.
Floor layout, tables, zones, and menu categories and items you configure.
Staff you invite (name, email, role: owner, manager, host, or analyst) and the actions they take in the dashboard (audit log).
Guest records for people who book with you, plus customer lists you import (phone, name, optional notes) and notes your team adds.
Instagram verification data (username, Instagram-scoped ID, automated match notes, and our review outcome) and WhatsApp number verification.

4. Venue waitlist and marketing site

If you ask to join Makan from our business site we collect your email, venue name, and optional phone and city. We store that request and may send it to HubSpot so we can follow up. That site may also use Meta (Facebook) Pixel and Conversions API and PostHog so we can understand sign-ups and improve the page. Those tools set their own cookies on that site. The guest app does not use those marketing pixels.

5. How we use personal data

To show live venues, menus, and availability, and to take, confirm, remind, seat, and cancel reservations.
To run the WhatsApp and Telegram assistant, including handing a chat to the venue when a human should take over.
To send confirm and cancel links, meetup codes, and (unless you opt out) a short post-visit feedback chat, then share useful feedback with the venue.
To let venue staff run the floor, guest list, menu, and Instagram or WhatsApp connection.
To verify that a WhatsApp number or Instagram account belongs to the venue.
To process a booking deposit when the venue requires one.
To keep the service secure (rate limits, fraud and abuse prevention, audit logs).
To contact venues who requested access.
To comply with law and respond to lawful requests.

We do not sell personal data.

6. Who we share data with

A reservation only works if the venue can host you. When you book, we share with that venue what they need: your name, phone, party size, date and time, notes, meetup code, booking status, and relevant feedback. Venue staff with access to that venue can see this in the dashboard. We do not share your guest profile with other venues unless you book with them or a venue imports you as an existing customer.

We use processors who help us run Makan. They only get what they need for their task:

Meta — WhatsApp Business messaging and Instagram login/verification.
Telegram — messages when you use Telegram.
Resend — staff sign-in and invitation emails.
Google — Maps/Places and timezone for venue addresses; Gemini models to help verify Instagram accounts and to power the booking assistant.
Other AI providers that host models we use for the assistant and feedback summaries.
ePoint — booking deposits in AZN.
Cloudflare R2 — venue and menu images.
OpenStreetMap / Nominatim — map tiles on the guest search map and geocoding fallback.
HubSpot, Meta Pixel, and PostHog — only on the venue waitlist/business site, as described above.
Hosting, database, and cache providers that store the platform (including PostgreSQL and Redis).

We may disclose data if required by Azerbaijani law or to protect guests, venues, or Makan from harm or fraud.

7. Cookies and similar storage

Essential session cookies on the guest app and venue dashboard so you stay signed in. These are not used for advertising.
Browser local storage on the guest app for your city, and on the venue dashboard for language and a few UI preferences.
On the business waitlist site only: Meta Pixel cookies (such as _fbp) and any cookies PostHog sets, if those tools are enabled.

8. How long we keep data

We keep guest and venue accounts, bookings, message history, guest memory, and feedback while they are needed to provide the service, let a venue honour past and upcoming reservations, and handle disputes or no-shows. One-time sign-in codes expire within minutes and are not used as long-term passwords.

If you ask us to delete your guest profile we will remove or anonymise what we can, except records we must keep (for example a paid deposit reference, or data a venue still needs to finish a live reservation). Imported customer lists stay until that venue deletes them or we are required to erase them.

9. Your rights

Subject to Azerbaijani personal data law, you can ask us to access, correct, or delete your personal data, or to restrict optional processing. Guests can opt out of post-visit feedback. You can cancel a booking with the cancel link we send or by writing to the assistant.

Email studio@makan.rest from the phone number or staff email we have on file, and tell us whether you are writing as a guest or as venue staff. We may need to verify it is you before we change or delete data.

10. Children

Makan is not directed at children under 16. We do not knowingly collect personal data from them. If you believe a child has booked or messaged us, contact studio@makan.rest and we will delete the data.

11. International processing

Some processors (for example Meta, Google, Cloudflare, HubSpot, and AI model hosts) may process data outside Azerbaijan. We use them because the messaging, maps, storage, and assistant features cannot run without them. If this is not acceptable, please do not use those features (for example, do not message the assistant or connect Instagram).

12. Changes

We will post updates on this page and change the “Last updated” date. If a change is material we will try to notice you through the app or by message where we can.