Walk into Gramercy Tavern, Manhatta, or Union Square Cafe tonight. The host stand has an iPad. The iPad has a floorplan. The floorplan knows the diner's name, their last visit, what they spent, what they drink, who they came in with, and a system-generated tag that says "wine lover" or "positive reviewer."

Those three rooms run on SevenRooms. They are operated by Union Square Hospitality Group, named publicly as a SevenRooms customer in the company's own marketing. In August 2024, USHG's Chief Supply Chain and Technology Officer Kelly MacPherson went on the SevenRooms press wire with this line: "We have a wealth of data at our fingertips."

The wealth of data has a new owner.

---

In June, DoorDash closed a $1.2 billion all-cash acquisition of SevenRooms. The deal made SevenRooms a DoorDash subsidiary inside the company's commerce platform. SevenRooms is the customer relationship management software behind 13,000 restaurants and hotels worldwide, including Union Square Hospitality Group, Nobu, Marriott International, MGM Resorts, Mandarin Oriental, Wolfgang Puck Catering, and Bloomin' Brands.

Two days before the SevenRooms deal closed, DoorDash also acquired Symbiosys for $175 million. Symbiosys is an advertising technology company that places ads on Google, Meta, and other websites. Its product is targeted advertising sold to brands that want to reach defined audiences off-platform.

DoorDash's existing advertising business hit a $1 billion annual revenue run rate in 2024. The DoorDash ad team sells targeting on the company's own surfaces. With Symbiosys, that targeting now extends to the open web. With SevenRooms, the targeting data now includes the dine-in side.

---

A SevenRooms guest profile holds over 100 unique data points per person. The list is on SevenRooms' own product marketing page.

Full name. Email. Phone. Mailing address. Photo. Food allergies. Eating and seating preferences. Birthday. Anniversary. IP address. Lifetime spend across all visits. Itemized spend tied to specific menu items through 65-plus point-of-sale integrations. Visit frequency. Last visit date. Auto-generated behavioral tags including "wine lover," "steak lover," "positive reviewer."

A profile this dense is a behavioral asset. Not a reservation note.

When a guest books through OpenTable or Resy, those platforms own the booking record but have limited visibility into what happens after the guest sits down. SevenRooms has full visibility because operators pay for the integration with their POS. The host stand, the server's tablet, the back-end accounting system, all push back into the same profile.

Multiply across 13,000 venues. A database emerges. Anyone holding it can answer questions like: who in zip code 10003 spent over $400 at a steakhouse in the last six months, who orders bottle service after 11 p.m. on Thursdays, who has dietary restrictions matching this advertiser's product. A company that just spent $175 million on ad targeting infrastructure has reasons to ask those questions.

---

SevenRooms sold the platform to operators using a specific phrase. The phrase appears in operator testimonials still live on the SevenRooms marketing site as of this writing: "I love the SevenRooms philosophy that it's our guests, our data." That sentence was the pitch. Also the answer to the obvious operator question about where their customer information actually lived.

The answer was always: on SevenRooms servers, governed by the SevenRooms privacy policy, accessible to SevenRooms staff and to anyone the SevenRooms privacy policy classifies as an "Affiliate." The Affiliate clause is on the public privacy page. It permits sharing personal data with parent companies, joint ventures, and entities under common control.

In June, the parent company became DoorDash.

In the deal announcement, SevenRooms co-founder and CEO Joel Montaniel described the value of the acquisition in his own words: "delivering greater innovation, a direct channel to a network of millions of DoorDash consumers, more personalized guest relationships and elevated experiences that transform first-time diners into loyal regulars."

A direct channel to a network of millions of DoorDash consumers. That is the deal. The platform's value to its new parent is the operator's guest data flowing into a delivery company's consumer network. Said by the seller. Out loud. On the day the deal was announced.

---

The data was already moving before the acquisition. In late 2022, a third-party vendor breach exposed 427 gigabytes of SevenRooms-handled data spanning 86,847 files. Reservation lists. Customer records. Payment reports. Marketing files. API keys. BleepingComputer and Cyber Insider reported on the customer list affected. MGM Resorts, Mandarin Oriental, Bloomin' Brands, and Wolfgang Puck Catering were on it.

A breach with no commercial intent on the holder's side. Hundreds of thousands of guest records into the open anyway. Proof of concept. The data exists in a single, exfiltratable form. That single form has a new owner.

DoorDash also operates Wolt across European markets. The combined surface area now covers delivery, dine-in CRM, third-party ad inventory, off-platform retargeting, and direct-to-consumer subscriptions. No consumer food vertical the same company does not touch.

Restaurant Business reported on the day of the deal that "the combination has made some in the industry uneasy. They see some risk in a giant third-party delivery company gaining access to restaurants' first-party, on-premise business." One unnamed industry executive texted the reporter four words about it: "I really don't get it."

For New York operators, the math is direct. A restaurant on the Lower East Side running SevenRooms today is paying a monthly subscription that funnels guest behavioral data to the same parent company that takes up to 30 percent on every delivery order. The same parent company can package "diners who spent $200-plus at a French restaurant within two miles of [your restaurant] in the last 90 days" and sell that audience to anyone willing to bid on it. A competitor restaurant. A national chain about to open across the street. A landlord deciding what kind of tenant maximizes the next lease.

DoorDash already sells targeted display advertising to restaurants on its own platform. Symbiosys exists to extend that targeting off-platform. SevenRooms enriches the profile that gets targeted. The extraction is live.

The asymmetry is built into the deal. DoorDash now knows what every SevenRooms operator's diners spend, when they spend it, and what they ordered. No SevenRooms operator knows what DoorDash knows. The operator sees their own venue. The platform sees 13,000 venues, every guest that overlaps between them, and every itemized POS line. A chain considering a Manhattan expansion buys the market read off that database. The independent already paying the subscription has no comparable view in the other direction.

The operator built the inventory. By paying the subscription. Working the host stand. Training the staff to log notes. Integrating the POS. The targeting engine was built in another building. They are now the same building.

Pull the CRM contract. Read the data clauses with a hospitality attorney. Flag the words affiliate, parent, successor, and assignment. Flag the export rights. Flag the deletion rights.

Export the full guest list. The export function is documented in SevenRooms' admin tools. Run it. Save the file somewhere a future subscription cancellation cannot reach.

Know what leaves with the operator when the operator leaves. Know what stays. Know who else is renting access to the same data on the same servers.

The data was the product. The operator built the inventory. Decide what to build next.

Like this? Explore more from: