Who is responsible for your data
The controller of the personal data collected on this website is the restaurant Kaze Sushi, Rua do Mesato, Porto.
For any question about your data, contact us by email at hello@mesato.pt.
The website is provided by M&M Lda, through the Mesato platform, which processes the data only on behalf of the restaurant and on its instructions (processor).
What data we collect
- Bookings: name, mobile number, email, day, time, number of people and any notes you write.
- Pick-up orders: name, phone number, pick-up day and time, the items you choose and any notes you write.
- Browsing: one technical session cookie, created only when you add something to an order or request a booking (see the cookie policy).
- Customer record: we group your bookings and orders by email (or phone), with any notes the team records to serve you better, such as your preferred table.
You do not need an account to book or order. We do not ask for payment details: orders are paid at the restaurant.
If you create an account («My account»)
The account is optional and free. It keeps your bookings and orders so you can find them on any device, at this and other restaurants that use the Mesato platform.
The account data (email, name, phone, email language and, if you sign in with Google or Facebook, the name and email that service sends us) is processed by Martins & Moscoso Lda (M&M Lda), which provides the Mesato platform, as controller. Legal basis: performance of the account agreement (Article 6(1)(b) GDPR). Contact: hello@mesato.pt.
The bookings and orders you make at Kaze Sushi remain processed by the restaurant, as described on this page. The account only links them to your email; each restaurant only sees what was done there.
If you do not use the account for 36 months, we warn you by email and delete it 30 days later. You can ask us to delete the account at any time at hello@mesato.pt; bookings and orders stay with the restaurant without your contact details.
If you sign in with Google or Facebook, that service's privacy policy also applies; we only receive your name and email.
What we use the data for
- To manage your booking or order and contact you about it, for example to confirm, change or cancel it. Legal basis: steps taken at your request and performance of a contract (GDPR, Article 6(1)(b)).
- To keep the website secure and working. Legal basis: the restaurant’s legitimate interest (GDPR, Article 6(1)(f)).
- To keep a history of your visits so we can serve you better. Legal basis: the restaurant’s legitimate interest (GDPR, Article 6(1)(f)).
- To send you news and offers by email, only if you ticked the box in the form. Legal basis: consent (GDPR, Article 6(1)(a)). You can withdraw it at any time, without affecting what was done before.
- To meet legal obligations, such as tax obligations, where they apply. Legal basis: GDPR, Article 6(1)(c).
If you mention allergies or other health information in the notes, we use it only to prepare your meal safely.
Without your consent we do not use your data for advertising. We do not sell it and we do not make automated decisions about you.
Who we share the data with
Only with those needed for the service to work: M&M Lda (Mesato), which provides the website, and the hosting, email and error-monitoring providers it uses (Sentry, with servers in the European Union), who are bound to process the data for this purpose only.
Error monitoring receives technical data only when something fails on the website (page address, browser, IP address and the error description). It does not use cookies and does not record what you do on screen.
We may also disclose it to the authorities when the law requires.
Website assistant
The assistant answers questions about Kaze Sushi automatically (menu, opening hours, bookings) and can record a booking or a contact request when you ask it to. Its answers are generated by artificial intelligence: check anything important with the team, especially allergies.
We keep the conversation (the messages, the language and the time) for 90 days, to answer with context, so the team can see it, and for security; after that it is deleted. Your IP address is only stored hashed, to limit abuse. Legal basis: steps taken at your request (Article 6(1)(b) GDPR) and the restaurant’s legitimate interest in answering and keeping the service secure (Article 6(1)(f)).
If you make a booking or leave a contact request in the conversation, that data follows the same rules as the form, described on this page. If you are signed in to your account, the assistant may suggest the account’s name and mobile number, which you confirm before sending.
To generate the answers, the conversation text is sent to Anthropic, PBC (United States), the provider of the artificial intelligence model, acting as a sub-processor of M&M Lda. The transfer outside the European Union is covered by the standard contractual clauses approved by the European Commission, in Anthropic’s data processing agreement. Anthropic does not use these conversations to train its models.
Please do not write payment details or sensitive information the restaurant does not need in the conversation.
How long we keep it
We keep your customer record and the contact details of your bookings and orders while you are a customer: after 24 months without visits, they are anonymised automatically. Anything the law requires us to keep longer, for example for tax purposes, is kept for the legal period.
Your rights
You can ask for access to your data, its correction or erasure and the restriction of processing, object to processing, ask for portability and withdraw consent to communications, by contacting us by email at hello@mesato.pt. We reply within one month.
If you believe your rights have not been respected, you can complain to the Portuguese data protection authority (CNPD): www.cnpd.pt
Changes to this policy
If this policy changes, the new version is published on this page with the date of the last update.
Last updated: 18 October 2026