How is customer phone number and order data stored, and is it GDPR compliant for international guests?

Voksha stores caller information, phone numbers, reservation details, order history, and any notes captured during a call, using encrypted storage rather than plain text logs. For most restaurants, the practical concern isn't a specific regulation, it's making sure a customer's phone number and dining preferences aren't sitting in an unsecured spreadsheet that any employee can access or export.

GDPR becomes relevant if your restaurant serves EU-based guests directly, for example a tourist-heavy location taking reservations from European visitors, or a restaurant group with a location in the EU or UK, since GDPR governs how personal data, including a phone number tied to a name, is collected, stored, and deleted on request. Voksha's Enterprise plan includes GDPR compliance for restaurants that need it at that level, most single-location restaurants serving primarily local or domestic customers won't need to worry about this in practice, but any restaurant with meaningful international tourism traffic should consider it.

HIPAA doesn't typically apply to restaurants since you're not handling protected health information, the one edge case is a restaurant running a catering or dietary-accommodation program tied to a hospital or care facility, where health-related dietary restrictions might cross into HIPAA territory depending on the arrangement. For the overwhelming majority of restaurants, the real data question is simpler: is your reservation and order data encrypted, is access limited to staff who need it, and can you honor a customer's request to have their information deleted. Voksha supports all three as standard practice, not just on Enterprise.