Last updated: October 12, 2026

Legal notice and privacy policy

At unonly we take the protection of your data seriously. Here we explain who we are, what information we process, for what purpose, and what your rights are.

This page is an English translation of the Spanish version, provided for convenience. In the event of any discrepancy, the Spanish version prevails.

1. Site owner

unonly is a digital studio run by a private individual. For any matter relating to this site or to your data, you can reach us at the email address below.

  • Data controller: Haonan Cheng
  • Contact email: haonicheng@gmail.com
  • Website: unonly.es

2. Purpose and terms of use

This website is informational and presents the services of the unonly studio. By using it, you agree to do so lawfully and in good faith.

The contents, design, the “unonly” brand and graphic elements are the property of their owner or are used with permission, and may not be reproduced without authorization.

3. Data we process

We process the data you voluntarily provide when you contact us:

  • Contact form: name, email address and the content of your message.
  • Email or WhatsApp communications: whatever data you choose to share in that conversation.
  • We do not collect special categories of data, build profiles, or make automated decisions.

4. Purpose of processing

We use your data solely to handle your enquiry, prepare a quote if you request one, and maintain the business communication you initiate. We will not send you unsolicited communications.

5. Legal basis

The legal basis is your consent when you contact us (Art. 6(1)(a) GDPR) and the implementation of pre-contractual measures at your request (Art. 6(1)(b) GDPR).

6. Data retention

We keep your data for as long as our relationship lasts and, afterwards, for the period legally required to address any potential liabilities. You may request its deletion at any time.

7. Recipients and processors

We do not sell or transfer your data to third parties. We rely on providers acting as data processors: Google (email), Meta Platforms (WhatsApp) and Vercel (site hosting). Some of them provide their services from the United States; such international transfers are covered by the EU Standard Contractual Clauses or other appropriate safeguards.

8. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as withdraw your consent, by writing to haonicheng@gmail.com. We will respond within the legally established timeframes.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Cookies

This website does not use analytics, advertising or tracking cookies. Only the technical cookies strictly necessary for it to function are used, where applicable. That is why we do not display a cookie banner.

10. Security and changes

We apply reasonable technical and organizational measures to protect your data. We may update this policy to reflect legal or service changes; the date at the top indicates the latest version.

App and management panel

The unonly app and management panel

Besides this website, unonly provides restaurants with an Android and iOS app and a web panel to manage their bookings, orders and team. This part explains what data they process.

Data we process

  • Your account: your email address or username, your name, your password (stored encrypted) and your role in each restaurant.
  • What the restaurant enters: bookings, waiting list, orders, notes and its guests' details (name, phone, email and remarks).
  • Your devices: the identifier used to send you notifications about new bookings and cancellations, your notification and language preferences and, if you activate a venue tablet, an identifier for that device.
  • The camera is only used to read the QR code that activates a venue tablet. The image is neither stored nor sent.
  • There is no advertising, third-party analytics or tracking, and the app does not access your location, contacts or microphone.

Purpose and legal basis

To give you access and provide the service the restaurant has contracted: signing in, managing bookings and notifying you of what happens. The legal basis is that contract (Art. 6(1)(b) GDPR).

We process the restaurant's guest data on behalf of the restaurant, which is its controller. We act as a data processor (Art. 28 GDPR) and use that data only to provide the service.

Where data is stored and who helps us

We do not sell or share this data. We rely on these data processors:

  • Supabase (database and sign-in): servers in London (United Kingdom) for restaurants in Spain and in the United States for those in Mexico.
  • Expo (United States): app updates and sending notifications, which are delivered by Google (Firebase Cloud Messaging) on Android and by Apple on iOS.
  • Vercel (United States): hosting of the web panel.
  • Resend (United States): booking confirmation and reminder emails sent by the restaurant.
  • Hetzner (Germany, EU): encrypted backups.

Transfers outside the European Economic Area rely on adequacy decisions (United Kingdom, and the United States for companies certified under the Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

How long we keep it

  • Your account data, for as long as you have the account. It is erased when you delete it (see below).
  • The restaurant's data, for as long as it uses unonly. If it closes its account, all of it is erased.
  • Encrypted backups rotate automatically and are gone after 6 months at most.

Delete your account

You can delete your unonly account (the same one for the app and the web panel) at any time, free of charge. There are two ways:

  1. In the app

    Open the unonly app and go to More → Account → “Delete my account”. Confirm and the account is deleted right away.

  2. By email

    Write to haonicheng@gmail.com with the subject “Delete my account” from your account's email address, or tell us your username and restaurant. We will confirm the deletion by email.

If you are the only owner of a restaurant, the app will not let you delete your account, so the restaurant is not left without an owner. Write to us and we will transfer ownership to someone else on the team or close the restaurant. Closing it also erases all of its data.

What is deleted

  • Your user and sign-in credentials (email or username and password).
  • Your name and your membership of restaurants, with your role.
  • Your devices' notification identifiers and your notification preferences.

What is kept

  • The restaurant's data (bookings, guests, notes, menu…): it belongs to the business and remains available to the rest of its team.
  • Encrypted backups, until they rotate (6 months at most). They are only used to restore the service after a failure.

Timeframes

  • In the app: immediately.
  • By email: within 30 days at most; usually within 2 or 3 business days.
  • Backups: 6 months at most.

Did you book at a restaurant that uses unonly? Your data is managed by that restaurant: ask it to erase it (its booking page's privacy policy explains how) or write to us and we will pass your request on.