• Pricing
Revasi
Log in
Pricing

Book a demo.

Tell us about your venue. We’ll walk you through the system that seats Locavore NXT, Soléa, Empat Group and other venues across Bali every day.

Rather talk now? Message us on WhatsApp

We’ll open WhatsApp with these details, ready to send. See how we handle them in our privacy policy.

Revasi

The reservation system built for high-end venues.

System status

Product

  • Revasi Pro
  • Revasi Lite
  • Pricing
  • Log in

Resources

  • Why Revasi
  • Case studies
  • Blog
  • Contact
  • Developers

Company

  • About
  • Talk to us

© 2026 Revasi · Made by Pandu & Digics with care in Indonesia

Privacy policyCookie policy

Last updated: October 2026

Privacy Policy

This policy explains what personal data we collect when you use Revasi to make a reservation at our partner restaurants and bars, how we use it, and what rights you have. It applies to guests booking through our platform and to visitors of revasi.net.

Contents

  1. 1. Who we are
  2. 2. Personal data we collect
  3. 3. Why we process your data and our legal basis
  4. 4. Dietary and health-related information
  5. 5. Who we share your data with
  6. 6. International data transfers
  7. 7. How long we keep your data
  8. 8. Your rights
  9. 9. Cookies
  10. 10. Security
  11. 11. Children
  12. 12. Changes to this policy

1. Who we are

This Privacy Policy applies to reservations made at our partner restaurants and bars, operated by PT Locavore Nusantara Indonesia (“Locavore Group”, “we”, “us”, “our”). The Service is accessible via revasi.net and the venue booking pages of our partner restaurants and bars (collectively, the “Service”).

For questions about this policy or to exercise your data rights, contact us at privacy@revasi.net.

2. Personal data we collect

When you make or manage a reservation, or use a Revasi account, we collect:

  • Identity data: first name, last name, salutation
  • Contact data: email address, phone number, country
  • Reservation data: date, time, party size, dining preferences, special occasions
  • Accommodation: where you are staying during your visit, if you tell us — the property name as you enter it, and, where you pick a result from the address search, the town, country and map coordinates of that property. You can instead indicate that you live locally, and you may leave the field blank.
  • Post-visit reviews: the ratings you give (overall, food, service, atmosphere) and any comments you write, where you choose to leave them after your visit
  • Dietary information: allergies, dietary restrictions, and food preferences you choose to share (see Section 4)
  • Payment data: masked card number and payment reference (full card details are handled by our payment processor, Xendit — we never store your full card number)
  • Marketing preferences: your opt-in or opt-out status for email communications from each venue
  • Guest profile data: categories and notes recorded by venue staff to personalise your experience, such as VIP status, visit frequency, cancellation history, and labels (e.g. “returning guest”, “influencer”). You have the right to access and object to this categorisation — see Section 8.
  • Revasi account data: if you create a Revasi account, your email address, your sign-in sessions, and the one-time codes we email you to sign in (stored only in scrambled form, and valid for 5 minutes). Anything else on your profile is optional and only there if you add it: your name, phone number, profile photo, nationality, country and city of residence, birthday and anniversary, job title and workplace, social media profiles and website, dietary needs and allergies, and the language you would like our emails in.
  • Usage data: pages visited on our platform (collected via server logs)

3. Why we process your data and our legal basis

PurposeLegal basis (GDPR)Legal basis (Indonesian PDP)
Processing and managing your reservationContract (Art. 6(1)(b))Contractual necessity (Art. 20(2)(b))
Sending transactional emails (confirmation, reminder, cancellation)Contract (Art. 6(1)(b))Contractual necessity (Art. 20(2)(b))
Running your Revasi account at your request: signing you in, keeping your profile, and filling in your details when you bookContract (Art. 6(1)(b))Contractual necessity (Art. 20(2)(b))
Preparing your dining experience (dietary & special occasions)Explicit consent (Art. 9(2)(a))Explicit consent (Art. 20(2)(a))
Sending marketing and promotional emails about Locavore Group venues, including news, events, and offers to add upgrades or enhancements to your reservationConsent (Art. 6(1)(a))Consent (Art. 20(2)(a))
Guest profiling by venue staff (VIP status, visit labels, preferences) to personalise serviceLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
Recording where you are staying, to plan service and arrivalsLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
Collecting and acting on your post-visit reviewLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
Recording who made a booking, where someone books on your behalf (a hotel concierge, travel agent or venue staff member)Contract / legitimate interests (Art. 6(1)(b), 6(1)(f))Contractual necessity / legitimate interests (Art. 20(2)(b), 20(2)(f))
Improving our service and analysing venue performanceLegitimate interests (Art. 6(1)(f))Legitimate interests (Art. 20(2)(f))
Complying with legal obligations

4. Dietary and health-related information

Dietary restrictions you provide (such as allergies, halal, coeliac, or other food preferences) may reveal information about your health or religious beliefs. Under GDPR Article 9 and Indonesian PDP Article 4, this is treated as sensitive personal data. We collect it only to prepare your dining experience and do not share it with any third party outside of the kitchen team at the venue you are visiting. You are not required to provide this information to complete your booking. If you save dietary needs or allergies to your Revasi account, they fill in your future bookings and reach each venue you book in the same way. You can change or remove them on your account at any time.

5. Who we share your data with

We share your personal data only with the following processors, each bound by a Data Processing Agreement:

  • Resend (Resend, Inc., USA) — sends transactional and reminder emails (booking confirmation, reminders, and cancellations, and the sign-in codes for your Revasi account) on our behalf. We share your name and email address with Resend solely to deliver these messages.
  • Xendit (PT Xendit Pembayaran Indonesia) — processes credit card payments and deposit authorisations. We share the minimum data required to create a payment request.
  • Clerk (Clerk, Inc., USA) — manages authentication for our administrative staff. Guest personal data is not shared with Clerk.
  • Supabase (Supabase Inc., USA) — our database and infrastructure provider. All data described in this policy is stored on Supabase-managed servers.

Your Revasi account.One account works at every venue using Revasi. When you book, your profile fills in your details, and what you book with reaches that venue like any booking. Venues you book may also see your profile, so they can prepare for your visit. Your visit history is shared only within a venue’s own group: a venue can see that you have dined at another venue in its group, never at a venue outside it. Your profile photo is shown only to you, and your account profile is not shared through the partner API described below.

Venue-authorised integrations.The venue or venue group you book with may connect its own service providers (for example a guest-relationship or CRM system) to Revasi through our partner API. Where it does, we share your identity data, contact data, reservation details, accommodation details, post-visit reviews, visit history, and marketing preferences with that provider on the venue’s instructions and under a data-processing agreement. Where someone booked on your behalf, their name and contact details are shared as the booker. This access is limited to the venues that provider works for, is read-only, and can be revoked by the venue at any time.

The structured dietary and health information you give us, and private notes recorded by venue staff, are never shared through this interface. Review comments are your own free text and are shared as written — so if you would rather something stayed between you and the venue’s team, leave it out of the comment box or contact us at privacy@revasi.net.

Point-of-sale systems, at venues that connect one.Some venues connect their point-of-sale system (for example Moka) to Revasi. We then receive that venue’s bills: the amount, the table, what was ordered and, where the venue recorded them on the bill, a name, phone number or email address. We use them only to link each bill to the reservation it belongs to, so the venue can see what a visit was worth. They stay with that venue and are not shown to any other.

6. International data transfers

Some of our service providers are located outside Indonesia and the European Economic Area (EEA). Where personal data is transferred internationally, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and, for transfers from Indonesia, we ensure safeguards equivalent to those required by Indonesian PDP Law (UU No. 27/2022) Article 56. Specifically: Resend, Clerk, and Supabase are US-based and operate under Standard Contractual Clauses (and equivalent data-processing agreements) for these transfers. If you would like a copy of the applicable transfer mechanism, contact us at privacy@revasi.net.

7. How long we keep your data

We retain personal data only as long as necessary:

  • Reservation records: 3 years from the reservation date, after which records are anonymised or deleted. Accommodation details and post-visit reviews are part of the reservation record and are removed with it.
  • Marketing contact lists: until you withdraw consent or request deletion
  • Revasi account: until you delete it. Deleting your account removes your profile, profile photo and sign-in sessions straight away. Your bookings stay with the venues you booked, for the reservation-record period above, and your marketing preferences stay as they are until you change them. Sign-in sessions end after 180 days without use.
  • Payment references: 5 years, as required by Indonesian tax regulations
  • Activity logs: 12 months
  • Ad click references: 90 days from the booking, after which the click is removed from the booking and from its history. Your answer to the measurement question is kept, as the record of what you agreed to.

8. Your rights

Under GDPR and Indonesian PDP Law (UU No. 27/2022), you have the following rights regarding your personal data:

  • Right to access: request a copy of the personal data we hold about you
  • Right to rectification: ask us to correct inaccurate or incomplete data
  • Right to erasure: request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements
  • Right to portability: receive your data in a structured, machine-readable format
  • Right to withdraw consent: withdraw marketing consent at any time via the unsubscribe link in any email, or by contacting us
  • Right to object: object to processing based on legitimate interests
  • Right to restrict processing: request that we limit how we use your data

To exercise any of these rights, email privacy@revasi.net with your name, email address, and the right you wish to exercise. We will respond within 30 days. If you have a Revasi account, you can also see and correct your profile, change your marketing preferences for each venue, and delete your account yourself at revasi.net/account. Deleting your account closes it, but it does not erase your bookings from the venues’ records. To ask for that, email us as above. Indonesian residents may also lodge a complaint with the Badan Siber dan Sandi Negara (BSSN). EU/EEA residents may lodge a complaint with their local data protection authority.

9. Cookies

We use essential cookies to keep your session active during the booking process, to keep you signed in to your Revasi account, and to remember your sidebar preferences in the admin panel. Advertising cookies are set only at venues that measure their Google ads, and only after you allow it on that venue’s booking page. For full details, see our Cookies Policy.

10. Security

We implement technical and organisational measures to protect your personal data, including row-level security on our database, encrypted connections (TLS), and access controls limiting data access to authorised staff only. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within the timeframe required by law (72 hours under GDPR, and within 3×24 hours under Indonesian PDP Law (UU No. 27/2022) Article 46) and will inform affected individuals without undue delay.

11. Children

Our Service is not directed at children under the age of 17. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our platform, please contact us at privacy@revasi.net and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date below and, where required by law, notify affected users by email. Continued use of the Service after a change constitutes acceptance of the updated policy.

Questions? Email privacy@revasi.net.

Back to Revasi

Legal obligation (Art. 6(1)(c))
Legal obligation (Art. 20(2)(c))

Google Ads, at venues that use it.Some venues advertise on Google. At those venues, and only if you allow it on the booking page, we send the venue’s own Google Ads account a record that your booking came from one of its ads: an ad click reference, the booking time and value, and a scrambled (hashed) copy of your email address and phone number. Google uses it to measure that venue’s ads. We do this on the venue’s instruction, and you can change your answer at any time on our Cookies Policy.

We do not sell your personal data, and we do not share it with data brokers.