Last updated 18 August 2026
MesaAI is a booking and digital-menu service for restaurants, operated by dzn studios. This policy explains what we collect, why, and what you can do about it.
Two different groups of people are covered here: the restaurant staff who hold a MesaAI account, and the diners who book a table or read a menu. Where the two are treated differently, we say so.
The data controller is DZN Studios Ltd (company number 07078865), registered office International House, Mosley Street, Manchester, England, M2 3HZ. For anything in this policy, write to info@mesaai.dzn-studios.com.
Each restaurant is a separate controller for its own diners' booking data. MesaAI processes that data on their behalf, under their instructions.
When a QR menu is scanned we record the time, a two-letter country code and a hashed user-agent. We do not store the scanning device's IP address, and these records cannot be traced back to an individual diner.
A restaurant may connect its Google Calendar so that bookings appear alongside everything else in its diary. This is optional, and MesaAI works without it.
calendar.events) — to create a calendar entry when a table is booked,
update it when the booking changes, and remove it when the booking is cancelled.
The entry contains the party size, the guest's name and the booking reference.
calendar.readonly) — to see when the venue is already busy, so MesaAI
does not offer a table during an event the owner has blocked out. We read the start
time, the end time and the title of those events, and store the title only so the
owner recognises the entry in their MesaAI diary.
Google access and refresh tokens are encrypted at rest with authenticated encryption (AES-256-GCM or XSalsa20-Poly1305). The plaintext refresh token is never written to the database. Tokens are used only to make the calendar calls described above.
MesaAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: we do not use Google Calendar data for advertising, we do not sell it, we do not transfer it to third parties except as needed to provide the booking feature you asked for, and no human at dzn studios reads it except where you have asked us to help with a support problem or where the law requires it. We do not use it to train any AI or machine-learning model.
Disconnecting Google Calendar in Settings → Google immediately deletes the stored tokens and the mapping between MesaAI bookings and calendar entries. You can also revoke access from your Google account permissions page. Existing bookings in MesaAI are not affected either way.
Two features send data to Google's Gemini API: reading a photographed paper menu into a digital one, and filling in a restaurant's profile from its own website. In both cases what is sent is business information — menu photographs, public web pages — not diner data. Booking details are never sent to an AI model.
Profile autofill also queries OpenStreetMap for a venue's public address and phone number. Nothing about you is sent with that query beyond the restaurant's name and town.
Neither feature writes anything automatically. A person at the restaurant reviews every suggestion and accepts it field by field.
Subscription payments and booking deposits are handled by Stripe. Card numbers never reach our servers; we store only Stripe's reference for the payment.
Under the GDPR you may ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask for it in a portable format. Write to info@mesaai.dzn-studios.com and we will respond within one month.
If you are unhappy with our answer you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.
MesaAI sets one cookie, to keep you signed in. It is not used for tracking or advertising, and there are no third-party analytics cookies on the booking pages or the QR menus.
If this policy changes materially we will tell account holders by email before the change takes effect. The date at the top always reflects the current version.