Who we are
“HeyMesa”, “we”, “us” and “our” refer to the operator of the HeyMesa service at heymesa.app. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You can reach us about privacy at any time at hello@heymesa.app or through our contact form.
What we collect
Information you give us
- Account: your name, email address and password. We never store your password itself, only a salted cryptographic hash of it.
- Profile (optional): mobile number, profile photo, home city, preferred language, dietary needs or seating preferences, and, if you give them, your home and/or work address (a street or just a suburb). We use these addresses only to work out travel times to restaurants; we never give them to a restaurant.
- Booking requests: what you ask HeyMesa for, such as city, area, cuisine, budget, date, time, party size, and any notes for the restaurant (for example an allergy or an occasion).
- Messages to us: what you send through the contact form, with your name and email.
Information created when you use HeyMesa
- Bookings: the restaurant, date, time, party size, booking reference, status (confirmed or cancelled) and a timeline of what HeyMesa did, including transcripts of calls made to restaurants on your behalf.
- Confirmations: the text of SMS confirmations and cancellations sent to you.
- Technical data: a sign-in session identifier, and standard server logs from our hosting provider (such as IP address, browser type, time and page requested) used for security and troubleshooting.
We do not ask for payment card details, and we do not knowingly collect sensitive information. If you choose to tell us about a health-related dietary need (for example a severe allergy), we use it only to pass it on to the restaurant for your booking, with your consent.
How we use it
- To find restaurants that match your request, check availability, make, change and cancel bookings, and send you confirmations.
- To run your account: sign you in, remember your details so HeyMesa doesn't ask every time, and show your bookings.
- To answer messages you send us and provide support.
- To keep HeyMesa secure, prevent misuse and fix problems.
- To improve HeyMesa, using aggregated or de-identified information where we can.
We do not sell your personal information, and we do not use it for third-party advertising. We will only send you marketing if you ask for it, and every marketing message will include a way to opt out, as required by the Spam Act 2003.
AI and phone calls
HeyMesa is an AI agent. Your messages are processed by an AI model to understand your request and decide what to do next. When a restaurant only takes bookings by phone, HeyMesa may call it using an automated voice. On every call HeyMesa says that it is an automated assistant booking on behalf of a named customer, and it shares only what the restaurant needs for the booking.
Calls may be recorded and transcribed so that HeyMesa can confirm the details back to you and keep an accurate record. Where the law of the state or territory requires it, the restaurant is told about the recording at the start of the call. AI can make mistakes: always check the confirmation HeyMesa sends you.
Who we share it with
Restaurants. When you ask HeyMesa to book, we give the restaurant (directly, by phone, or through its booking system such as ResDiary, SevenRooms, OpenTable or Now Book It) the details needed: the name and mobile number for the booking, date, time, party size and your notes. The restaurant then handles that information under its own privacy policy.
Service providers who process information for us under contract, and only to run HeyMesa:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database: accounts, bookings, messages | Sydney, Australia |
| Railway | Hosting the website and app | Singapore |
| Anthropic | AI model that understands requests and runs the agent | United States |
| Google (Places API) | Restaurant search, details and photos; travel times from the addresses you give us (Routes API) | United States and other countries |
| Cloudflare | Domain name and DNS | Global network |
| SMS and voice providers (when enabled) | Sending confirmations and placing calls to restaurants | Australia and United States |
We may also disclose information if required or authorised by law, to protect someone's safety, or as part of a sale or restructure of the service (in which case this policy continues to apply).
Overseas storage and processing
Our main database is in Australia, but some of the providers above process information overseas, mainly in Singapore and the United States. We take reasonable steps, as required by APP 8, to make sure they protect it in a way consistent with the Australian Privacy Principles.
Cookies and local storage
HeyMesa uses one essential cookie (mesa_sid) to keep you signed in. It is HttpOnly, sent only over secure connections, and expires after 30 days or when you sign out. Your browser's local storage keeps your language choice and the identifier of your current conversation. We do not use advertising or cross-site tracking cookies.
How long we keep it
- Account and profile information: while your account is open. When you ask us to close it, we delete or de-identify it within 30 days.
- Bookings and their timelines: while your account is open, and up to 2 years after the booking date for records and disputes, unless you ask us to delete them sooner.
- Conversations with the agent: kept only as long as needed to complete your request; they are not used to build advertising profiles.
- Contact form messages: up to 2 years.
Security
We use encrypted connections (HTTPS), hashed passwords, access controls that keep each person's bookings visible only to them, and a database account that can reach only HeyMesa's own tables. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
Your choices and rights
- Access and correction: you can see and edit most of your details on your profile page, or ask us for a copy of the personal information we hold about you.
- Deletion: you can ask us to delete your account and personal information.
- Optional details: mobile number, photo and preferences are optional, although HeyMesa needs a name and a mobile number to make a booking with most restaurants.
- Anonymity: you can browse heymesa.app without an account; booking requires one, because restaurants need to know who the table is for.
Make any request by email to hello@heymesa.app or through the contact form. We may need to confirm your identity and will respond within 30 days.
Complaints
If you have a concern about how we handle your information, please contact us first and we will try to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Changes to this policy
We may update this policy as HeyMesa changes, for example when real phone calls or new channels are switched on. We will post the new version here with a new effective date and, for significant changes, let you know by email or in the app.