Privacy and your data
Last updated: 12 October 2026
Onla Reserve lets diners find and book tables at restaurants in Dubai. This page explains what data we collect, how we use it, and what choices you have.
What we collect
Your account
When you sign in or make a booking you give us your mobile number, which we verify by a WhatsApp one-time code, and your name. We do not collect email addresses from diners; email is used only for restaurant staff accounts.
Your bookings
Each booking we store: the date, time, party size, venue, and any special requests, occasion or seating preference you add. The venue you book at can see these details.
Dining preferences and allergies
Dietary requirements and allergies are stored only when you choose to share them with a specific venue. Your choice is recorded and you can withdraw it at any time in the app.
Saved restaurants and alerts
Restaurants you save and availability alerts you set are stored in your account.
Ask queries
When you type in Ask, your words are sent to the AI services that power it (currently OpenRouter or OpenAI, and TypeSafe) so they can understand the request and write the reply. Onla does not store your Ask messages.
Usage analytics
We use PostHog, hosted in the EU, to see how Onla is used: which screens open, how long steps take, and error reports. Events never include your name, phone number, messages or booking references. In the app your account appears only as a pseudonymous ID (a one-way hash of your account ID). You can turn this off at any time in the app: You → Share usage data. The website sends the same kind of events without cookies or any ID that outlives the page. Our servers also count bookings per restaurant (channel, party size, status) with no guest details.
Cookies and sessions
When you sign in on the website we set one session cookie for api.onla.app (HttpOnly, Secure, SameSite=Lax). While you book, the site keeps your unfinished booking in your browser's session storage so a refresh does not lose it; it is cleared when you close the tab. We set no tracking or advertising cookies.
WhatsApp messages
Your confirmation, reminders and updates are sent through Meta's WhatsApp Cloud API. Your phone number is shared with Meta for message delivery.
Your location
The map is drawn by Mapbox, which receives the area of the map you are looking at. When you search near you, your device first asks for permission. If you allow it, the app sends your location to Onla to find restaurants nearby. We use it for that search only and do not store it.
What venues can see
The restaurant you book with sees your name, your booking details and any preferences you chose to share with it. If it is part of a restaurant group, the group's staff can see that booking too. No restaurant sees your bookings at other restaurants. Each restaurant or group owns its guest records.
How long we keep data
Your account
Your account data is kept for as long as you use it. An account not used for 12 months is recycled: the next sign-in on that number starts a fresh account. The old account's data is kept inaccessible for 30 days and then deleted.
Booking records
Booking records belong to the venue. They remain in the venue's records after your account is deleted.
Deleting your account
When you delete your account in the app (You → Delete my account), we delete it straight away, together with your saved restaurants, preferences and alerts. Bookings you made stay in the restaurants' records.
Your rights
- Delete your account: in the app, tap You → Delete my account.
- Request a copy or correction of your data: email us at hello@onla.ai and we will respond within a reasonable time.
- Withdraw preference sharing: in the app under Dining preferences.
Where data is processed
The Onla service currently runs on servers in Fujairah, UAE. Anonymous analytics are processed by PostHog in the EU. WhatsApp delivery is handled by Meta's infrastructure.
Contact
For privacy questions, email us at hello@onla.ai.
Legal entity
Onla is developed and operated under the service name "Onla". The legal entity details are not yet finalised and will be added here once established.