Privacy Policy

TalkTable (operator details will be added before launch) provides a QR-code menu, ordering and AI assistant service to restaurants at talktable.app.

• Legal name: [LEGAL NAME]
• Registered address: [REGISTERED ADDRESS]
• Company registration (CRO) number: [CRO NUMBER]
• Privacy contact: privacy@talktable.app

We are not currently required to appoint a Data Protection Officer [TO CONFIRM]. Questions about this policy or your data go to the privacy contact above.

Under the EU General Data Protection Regulation (GDPR) we play two different roles:

• Controller for restaurant accounts (owners, managers and staff who sign in to TalkTable), for the optional TalkTable diner account described in section 4, and for running and securing the service itself.
• Processor for the restaurant when a diner uses a restaurant's table page to browse, chat with the AI assistant, order or call staff. The restaurant decides why and how that data is used; we handle it on the restaurant's instructions under a data processing agreement [DPA TO BE PUBLISHED].

If you are a diner and want to exercise your rights over an order you placed at a restaurant, you can contact that restaurant directly, or contact us and we will pass your request on and help the restaurant respond.

When a restaurant signs up or invites team members, we collect and store:

• Name, email address, role (owner/admin or staff) and staff type (waiter, chef, manager).
• A password hash (bcrypt). We never store your password in readable form.
• Restaurant details: name, web address (slug), timezone, currency, language, plan and trial status.
• Sign-in sessions (a random token and its expiry), password-reset tokens and staff invites (the invitee's name, email and role).
• An activity log of actions taken in the dashboard — for example menu or price changes, orders marked preparing/served, staff invited — linked to the user who did them.
• Conversations with the admin AI assistant (your messages and its replies), menu photos you upload for the AI to read, and menu item images. A temporary chat (the ghost icon in the assistant) is not saved and not used to improve the assistant: only token and cost records and the changes you confirm are kept, and its messages are sent to OpenAI with storage turned off (OpenAI's abuse-monitoring retention still applies).

Why and on what legal basis

• To provide the service you signed up for — performance of a contract (Art. 6(1)(b) GDPR).
• To keep the service secure, prevent abuse, debug problems and understand usage — our legitimate interests (Art. 6(1)(f)).
• To send service emails such as invites and password resets — performance of a contract. We do not send marketing emails today; if we start, we will ask first where the law requires it.

Diners do not need an account to use a restaurant's table page. When you scan a table QR code, we process the following on the restaurant's behalf:

• Table session and orders: the table, the items, sizes, options and quantities you order, notes you add (for example “no onions” or an allergy note), order status and timestamps.
• Optional name: if you type a name when placing an order, it is shown to the restaurant's staff with the order and kept with the order and table session.
• AI assistant chats: the messages you type to the AI waiter, its replies, and questions you ask about a specific dish. These are stored so the conversation can continue and so the restaurant can review how the assistant is performing.
• Voice ordering: if you use the microphone, the recording is sent to our AI provider for transcription. We do not store the audio recording; we keep the resulting text.
• Service requests and feedback: calls for a waiter or the bill, table-change requests and any note you add, plus feedback on AI answers (for example which suggestions you tapped, added or removed).
• Activity events: a record of what happened on the page (menu searches, items viewed or added, AI messages sent, orders placed). Each event may carry the text involved (for example a search term or message). To protect privacy we do not store your IP address: we store a one-way, salted hash of it, plus a coarse device category such as “Safari Mobile · iOS”, to help detect abuse. A random identifier kept in your browser links events from the same visit.

Phone calls to a restaurant's AI phone agent

Some restaurants forward their phone line to TalkTable's AI phone agent, which answers questions about the restaurant and its menu and can pass the call to a member of staff. The agent tells you at the start of the call that you are speaking with an AI. For each call we process:

• Your phone number (caller ID, if not withheld) and the restaurant number you called, so the call reaches the right restaurant and staff can call you back. It is removed after 90 days.
• A text transcript of the call, so the restaurant can check what was said and we can fix mistakes. It is deleted after 30 days. Calls are not recorded: we never store the audio.
• Call details: when it started and ended, what it was about (for example opening hours or a menu question), whether it was passed to staff, and its cost to run.
• Orders and bookings by phone: if you order or book, the name, items, collection or delivery time, delivery address and Eircode (for delivery), party size and any notes you give, so the restaurant can prepare, deliver or seat you. We text the payment link, order confirmation or booking confirmation to the number you called from.
• Returning callers: if the restaurant has it switched on, it remembers the name you gave and your last phone order (and last delivery address) against your number, only for that restaurant, so next time the agent can offer “the same as last time?”. It never reads them out unless you ask, and you can ask the agent to forget you at any time. Remembered details are deleted 12 months after your last call or order.

The call audio passes through our telephony provider (Twilio) and our AI provider (OpenAI) in real time to understand you and reply. Caller ID is not treated as proof of who you are.

Optional diner account

You can choose to sign in with a one-time email link (“magic link”). This account is provided by TalkTable and works across every restaurant that uses TalkTable, so for it we act as controller. It stores:

• Your email address and, if you add them, your name and preferred language.
• Dietary preferences, favourite foods and allergies you choose to record. Allergy and dietary information can reveal health information, which is a special category of data; we only store it because you enter it, and we rely on your explicit consent (Art. 9(2)(a) GDPR). You can remove it at any time from your account page.
• A visit history: the restaurant name, items and total for orders you place while signed in.

If the restaurant has personalised suggestions switched on, your name, preferences, allergies and recent visits (including visits to other TalkTable restaurants) are given to the AI assistant so it can make relevant, allergy-aware suggestions. They are not shown to restaurant staff.

Why and on what legal basis

• Orders, service requests and chats: processed for the restaurant, which relies on performing its contract with you (taking your order) and its legitimate interests (running and improving its service).
• Diner account: performance of a contract with you, and your explicit consent for allergy and dietary data.
• Security and abuse prevention (for example the hashed IP): our and the restaurant's legitimate interests.

Please do not type sensitive information you do not need to share (such as health details beyond an allergy note, or payment details) into chats or order notes.

TalkTable uses OpenAI's API to power the AI waiter, reading menu photos, translating menus and transcribing voice orders. When you use these features, the relevant text, image or audio — together with the restaurant's menu and, for signed-in diners, the account context described above — is sent to OpenAI to generate a response.

Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models by default. OpenAI may keep API data for a limited period for abuse monitoring [TO CONFIRM retention period and zero-data-retention eligibility].

The AI phone agent works the same way: the call audio is streamed to OpenAI to understand the caller and speak the reply, and is not stored by us. It answers only from the restaurant's own information in TalkTable (hours, menu, prices and the allergen details the restaurant has entered); where those details are missing it says it cannot confirm them and offers to pass you to staff.

The AI does not make decisions that have legal or similarly significant effects on you. Its answers are suggestions; a diner always confirms an order, and staff handle it.

Improving the AI: to make the AI waiter and assistant more accurate, we keep short, de-identified summaries of AI conversations that went wrong (for example a question the AI misunderstood, or an answer our safety checks had to correct). Before a summary is stored, names, contact details, numbers, links and account or session identifiers are removed, and it is not linked to you or your device. Summaries are used only by TalkTable to find and fix problems, are never sold or used for advertising, are not used to train OpenAI's models, and are deleted after 12 months. Our legal basis is our legitimate interest in keeping the service safe and working well. We do not train or fine-tune any AI model on your data. A restaurant can opt out of this for its own diners at any time (Settings > Privacy & data), after which no new examples are taken from that restaurant; you can also ask us to stop at any time by contacting us. The restaurant Assistant also remembers, for each restaurant only, which of its earlier answers the staff kept (the question without names or contact details, and which report or action answered it); these stay inside that restaurant and go when the staff member is removed. Across restaurants that have not opted out, it learns only common, de-identified phrasings (used by several restaurants or people), which are never shown to anyone.

We do not sell personal data and we do not use advertising or analytics trackers. We share data only with:

• The restaurant you are ordering from: its staff see your orders, notes, optional name, service requests, and its admins can see chats and activity for their restaurant.
• Amazon Web Services (AWS) — hosting, database, file storage, staff sign-in (Amazon Cognito, stored in Ireland), sending email including sign-in, password-reset and sign-up verification codes (Amazon SES, United States), website protection (AWS WAF), threat monitoring (AWS GuardDuty) and transactional text messages such as order confirmations (AWS End User Messaging).
• OpenAI — AI chat, menu photo reading, translation, voice transcription and the AI phone agent's conversation.
• Stripe — card payments (on the restaurant's own Stripe account) and TalkTable's subscription billing.
• Twilio — receiving phone calls that a restaurant forwards to its AI phone agent, and passing calls on to staff.
• The restaurant's POS provider — only when a restaurant connects its till (for example through Deliverect): the order (items, notes, allergies, pickup time and the name and phone number given for it) is sent to the restaurant's own POS so the kitchen can make it.
• Namecheap — our domain registrar only; it does not receive diner or restaurant data through the service.
• Authorities or others where required by law, or to protect our rights, users or the public.
• A buyer or successor if the business is sold or reorganised, under the same protections.

We will update this list, and notify restaurant customers, before adding a new sub-processor.

Our hosting and database run on AWS in the EU (Ireland, eu-west-1). The exceptions are listed below. OpenAI processes data in the United States.

Our website firewall logs (see Security) are stored by AWS in the United States (us-east-1), because AWS runs its global edge firewall from that region. Sign-in, password-reset and sign-up verification emails are sent by Amazon SES in the United States (us-east-1). Staff sign-in accounts (Amazon Cognito) are stored in Ireland (eu-west-1). These transfers to AWS are covered by AWS's Data Processing Addendum and the EU Standard Contractual Clauses.

Where personal data is transferred outside the European Economic Area, we rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses, together with the providers' security measures [TO CONFIRM each provider's certification / SCC status].

We keep personal data only as long as needed. Current defaults:

• Restaurant accounts and their data: for as long as the account is active, then deleted within [TO CONFIRM — e.g. 90 days] of closure, except where we must keep records for legal or tax reasons.
• Sign-in sessions: 30 days for restaurant users, 90 days for diner accounts, or until you sign out. Expired sessions, sign-in links and password-reset links are deleted 7 days after they expire.
• Diner email sign-in links: valid for 30 minutes and single-use.
• Staff invitations that are never accepted: deleted 30 days after they expire.
• Orders and table sessions: kept for the restaurant as its records, but the name and any notes typed by the diner (on the order, its items, waiter or bill requests, and the table), allergies, phone number and delivery address are removed after 90 days. Items, prices and totals are kept.
• AI chats with diners: deleted 90 days after the last message. Restaurant staff's saved assistant chats: deleted 12 months after the last message. TalkTable staff's own operator assistant chats: deleted 90 days after the last message.
• AI chat statistics (which dishes were suggested, clicked or ordered): the diner's typed text is removed after 30 days and the record is deleted after 90 days.
• Activity events: after 30 days, any text you typed (searches, messages, notes, voice transcripts), the name you gave and the hashed IP address are removed; the event itself is deleted after 13 months. Restaurant admins can also delete events older than 7, 30 or 90 days at any time, except security, payment, receipt and team records, which are kept for the full 13 months.
• Menu demand summaries (weekly counts of dishes guests searched or asked for that are not on the menu): only phrases asked by at least 3 separate guests are kept, with personal details removed and no link to any guest; deleted after 24 months.
• AI usage and cost records (token counts and costs, no chat text): deleted after 12 months.
• The record of changes the restaurant's Assistant proposed and whether they were kept (the kind of change, the outcome and an internal id of what it changed; no chat text): deleted after 13 months.
• De-identified summaries of AI conversations that went wrong (used to improve the AI): deleted after 12 months.
• The restaurant Assistant's examples of what worked (a staff member's question with names and contact details removed, and which report or action answered it) and de-identified phrasings learned across restaurants: deleted 12 months after they were last seen.
• Requests and bug reports a restaurant sends to the TalkTable team (with their replies and the attached diagnostic details, from which guest names, phone numbers and emails are removed automatically): deleted 12 months after the request is closed; open requests are kept until they are closed.
• Diner accounts: until you delete the account, or deleted automatically (as if you had deleted it) after 24 months without a sign-in or visit.
• Voice recordings: not stored by us. Phone calls to the AI phone agent are not recorded.
• Phone orders: the name, phone number, delivery address and notes are removed after 90 days (items, prices and totals are kept as the restaurant's records). Table bookings: the name, phone number and notes are removed 90 days after the booking date. Returning-caller details: deleted 12 months after the last call or order.
• POS connection logs (menu syncs, orders sent to the restaurant's till and their status; no names or phone numbers): deleted after 90 days.
• AI phone agent calls: the text transcript is deleted after 30 days; the caller's phone number (and the number on any text message we sent) after 90 days; the remaining call record (time, duration, topic, outcome, cost) after 13 months.

We use only what is strictly necessary for the service to work, so we do not show a cookie banner. We use no advertising or analytics cookies.

• qts_session — keeps restaurant staff signed in (HTTP-only, 30 days).
• qts_diner — keeps a diner signed in to their optional account (HTTP-only, 90 days).
• tt_dine — a random token that ties your phone to the table you scanned, so only you can order, call staff or ask for the bill there (HTTP-only; it ends after at most 3 hours, or 90 minutes without use).
• talktable.lang.<table> — remembers the menu language you chose at that table (1 year). It is set only for that table's page.
• qts_auth_step — carries a staff member between the password step and the second sign-in step (verification code or authenticator set-up); it is sealed, HTTP-only and expires after 10 minutes.
• qts_diner_otp — carries a diner between asking for a sign-in code and entering it; it is sealed, HTTP-only and expires after 10 minutes.
• qts_support — set only for TalkTable support staff while they view a restaurant that has granted them a support session; it is HTTP-only and expires after 30 minutes.

Your browser's local/session storage is used on the table page to:

• keep a random session identifier for the AI chat and for linking activity events to one visit;
• remember the name you typed for orders, so you are not asked again;
• remember which menu section you were viewing, and small UI reminders.

You can clear these at any time in your browser settings.

Staff timing insights. Restaurants can see how long kitchen and floor tasks take, by team and time of day. Timings per individual staff member are shown only if the restaurant turns that on, and only to the restaurant's owners. TalkTable makes no automated decisions about staff.

We use encryption in transit (HTTPS), hashed passwords, random session tokens, per-restaurant access controls, and restrict access to production systems. Text typed by diners (and diner identifiers) is redacted or pseudonymised in our internal platform-wide activity view; only the restaurant sees it. No system is perfectly secure; if a breach affects your data, we will notify you and the regulator where the law requires.

Protection against automated attacks

• Our website sits behind AWS WAF, a web application firewall. To block automated attacks it inspects requests (IP address, browser signals and request path). We keep logs only of requests it blocks or challenges, for 90 days, with cookies and authorization headers removed. AWS stores these logs in the United States (us-east-1).
• Sign-in codes, password-reset codes and sign-up verification codes are sent by Amazon SES in the United States (us-east-1). Staff sign-in accounts (Amazon Cognito) are stored in Ireland (eu-west-1).
• Amazon Cognito threat protection uses the IP address and device or browser information of sign-in attempts to detect risky sign-ins and passwords known to have been leaked.
• AWS GuardDuty monitors our AWS account for threats.

Our legal basis is our legitimate interest in keeping the service and your account secure.

Under the GDPR you have the right to:

• Access and portability. Signed-in diners can use “Download my data” on their account page to get one machine-readable file with their profile, preferences and allergies, visits, orders, AI chats we still keep, and activity history.
• Rectification — correct inaccurate data (for example in your profile).
• Erasure. Signed-in diners can use “Delete my account & data” on their account page. This permanently deletes the diner account, its preferences and allergies, visit history and sign-in links, and anonymises activity events linked to the account: the account link is removed and any text you typed (searches, AI messages, notes, voice transcripts) is removed from those events. Orders you placed remain with the restaurant as its records. Restaurant users can ask us to delete their account by email.
• Portability — receive data you gave us in a machine-readable format.
• Object to processing based on legitimate interests, and restrict processing in some cases.
• Withdraw consent at any time, for example by removing allergy information.

To exercise any right, email privacy@talktable.app. We will reply within one month. We may need to verify your identity first.

You can also complain to the Data Protection Commission (Ireland) at www.dataprotection.ie, or to the supervisory authority where you live or work. We would appreciate the chance to address your concern first.

TalkTable is not directed at children under 16, and we do not knowingly create accounts for them. A child may use a table page with a parent or guardian, who is responsible for the order. If you believe a child has given us personal data, contact us and we will delete it.

We will update this page when our practices change and change the “Last updated” date. For significant changes we will notify restaurant account holders by email in advance.