Privacy

Guests at a table

When a waiter opens a table, we create a session identified by a random token. Scanning the code binds that token to the browser on the guest’s phone, and tapping Call records that a call was raised on that table at that time.

That session holds the token, which restaurant and which table it belongs to, and its timestamps. It does not hold a name, an email address, a phone number or a payment detail, because the guest is never asked for any of them. The session expires on its own — three hours by default — after which the code cannot raise another call.

A guest therefore cannot be identified from what we store. The restaurant knows who was at the table; we only know that a table called.

Accounts, for restaurant staff

Managers and waiters have accounts. For each one we store a name, an email address, a password and — where a venue uses them — a short PIN for confirming actions on a shared screen. Passwords and PINs are stored hashed, never in a form we or anyone else can read back.

Alongside that we keep what the account is connected to: the venues it belongs to, the tables it is assigned to, and the record of calls it opened or answered. That history is what makes the reporting in the app work.

The contact form

If you write to us through the contact form, we ask for your name, your email address and your message. That message is emailed to our own inbox and is not saved to our database. It lives in our mailbox, like any other email, until we delete it.

If you are not signed in, the form runs an anti-spam check by Cloudflare Turnstile before it will send. Cloudflare receives your IP address and some technical details about your browser in order to tell a person from a bot. It is not a tracking cookie, it does not follow you across sites, and we do not receive anything from it beyond a pass or fail.

Email we send

Every email TableCall sends is transactional: it is a direct response to something you or your manager did. This is the complete list.

Email verification

Sent once, to the address you signed up with, to confirm it is yours.

Password reset

Sent only when somebody asks to reset the password on that address.

Waiter invitation

Sent to a member of staff when the manager of their venue invites them to it.

Registration and operational notices

Sent to us, not to you, when an account is created or a background job fails.

Contact-form delivery

Your message, delivered to our own inbox so that a person can reply to it.

We send no newsletters, promotions or announcements, and we operate no mailing list — so there is no subscription to manage and nothing to opt out of. If that ever changes, it will be something you are asked to opt into, and this page will say so before the first one is sent.

Cookies and technical logs

We set one cookie: the session cookie that keeps you signed in, or that binds a guest’s browser to the table they scanned. There are no advertising, analytics or tracking cookies, and no third-party trackers on this site.

Our servers keep the ordinary technical records any web application keeps — the IP address and browser user-agent attached to a session, and application error logs. These are used to keep the service running and secure, not to build a profile of anyone.

Who else handles the data

We keep this list short deliberately. Two providers are involved, and neither is given data for their own purposes:

• Amazon Web Services — hosting, the database and outbound email, in their Ireland (eu-west-1) region.
• Cloudflare — domain name service, forwarding for mail sent to our contact address, and the anti-spam check on the contact form.

We do not sell, rent or trade personal data, and we do not share it with advertisers or data brokers. We would disclose data only where the law requires it.

Keeping and deleting

Table sessions expire by themselves within hours of being opened. Account data is kept while the account exists.

You can delete your own account from within the app. Doing so removes it from the service immediately; a copy is retained briefly so that an accidental deletion can be reversed and so the venue’s call history stays coherent, and is then removed permanently. You can also ask us to delete it outright, or to send you a copy of what we hold, and we will do that.

Security

The site is served over HTTPS only. Passwords and PINs are hashed. The database is not reachable from the public internet. Access to a venue’s data is limited to the staff linked to that venue, and a waiter sees only the tables they are assigned to.

Questions, or a request

Ask us anything about this page, or make a request about your own data, through the contact form. If we change this policy we will update the date at the top, and material changes will be announced in the app.