This policy explains what personal data Stagee collects, why we collect it, and what you can do about it. It is written in plain language. If anything is unclear, write to us at hello@stagee.ai.
1. Who we are
Stagee is a brand operated by Francisco Coelho, Portuguese tax number 274923238, registered at Avenida Pedro Nunes 86, 4405-687 Miramar, Vila Nova de Gaia, Portugal. For GDPR purposes, we are the data controller when you visit our website or create an account.
When our voice agent answers calls on behalf of a restaurant, the restaurant is the data controller for the end-caller's data. Stagee acts as a processor. See our Data Processing Agreement (DPA).
2. What data we collect and why
2.1 When you visit stagee.ai
We collect basic technical data (IP, browser, pages visited), essential functional cookies, and (if you agree) analytics cookies. Legal basis: legitimate interest and consent.
2.2 When you book a demo or contact us
We collect your name, email, restaurant name, and message. Legal basis: pre-contractual measures at your request. Retention: 24 months from last contact, or until you ask for deletion.
2.3 When you create an account
We collect identification data, payment data (processed by Stripe - we don't store card numbers), account configuration (voice, reservation rules, hours, FAQ), and usage logs. Legal basis: contract performance. Retention: while account is active, plus 5 years after deletion (Portuguese tax law).
2.4 When our agent answers a call
The restaurant is the controller. Stagee acts as a processor on its behalf. We process call audio (real-time, for speech recognition), transcribed text, reservation data (name, party size, date, time, preferences, allergies), and the caller's phone number (stored only as an irreversible cryptographic hash - we cannot retrieve the original number).
Calls are recorded in audio. The audio file is stored in a private Cloudflare R2 bucket with EU jurisdiction, retained for 90 days with automatic deletion. Access is exclusively via short-lived signed URLs generated after verifying restaurant ownership. Call transcripts and structured call events are retained for 365 days. The consent log is retained for 730 days. Operational logs are retained for 90 days. All periods have automated daily purge.
3. Who we share data with
We work with sub-processors. The full list is at sub-processors. Main ones: Supabase (Ireland EU), Vercel (Ireland EU, Dublin), Soniox and AssemblyAI (STT, EU via LiveKit Inference), Google Gemma and OpenAI (LLM, EU via LiveKit Inference), Cartesia (TTS, EU via LiveKit Inference), Cloudflare R2 (EU), LiveKit (Frankfurt EU), LiveKit Observability (Frankfurt EU), Langfuse (EU), Telnyx (Germany EU), Upstash (EU), Stripe (Ireland EU).
Where sub-processors are based outside the EU, transfers are secured by EU Standard Contractual Clauses (Article 46 GDPR).
We don't sell your data. We don't use your data to train third-party AI models. We don't use your data for advertising.
4. Your rights
Under GDPR you have rights to access, rectification, erasure, restriction, portability, objection, withdrawing consent, and lodging a complaint with the Portuguese DPA (CNPD, www.cnpd.pt).
Write to hello@stagee.ai. We respond within 30 days.
If you are an end-caller, the restaurant is the controller of your data. Contact the restaurant directly, or we can forward your request.
5. Security
- Encryption in transit (HTTPS, TLS 1.2+) and at rest (AES-256).
- Application-layer field encryption for sensitive fields.
- Per-restaurant database isolation.
- Cryptographic hashing of phone numbers with restaurant-specific salt.
- Restricted admin access with mandatory two-factor authentication (2FA).
- Append-only audit log of all administrative actions.
- Database backups being configured.
We do not hold ISO 27001 or SOC 2 certification. Our scale doesn't yet justify the investment, but the roadmap includes getting there.
6. Cookies
Essential cookies only, plus optional analytics. No marketing or retargeting cookies. We currently use Plausible Analytics (cookieless), so no banner is shown.
7. Children
Our platform is intended for restaurant businesses and their staff. We do not direct services to minors under 16.
8. Changes to this policy
We may update this policy. The date at the top reflects the latest version. For substantial changes, we notify platform customers by email.
9. Contact
- Email: hello@stagee.ai
- Address: Francisco Coelho · Avenida Pedro Nunes 86, 4405-687 Miramar, Vila Nova de Gaia, Portugal
- Supervisory authority: Comissão Nacional de Protecção de Dados (CNPD) · www.cnpd.pt.