Privacy Policy

The restaurant you are contacting is the data controller — it decides why your data is used. Tavolo acts as its processor under a Data-Processing Agreement (GDPR Art. 28), handling the call and storing the booking or order on the restaurant's behalf.

To handle your request: your name, phone number, delivery address and language; the details of your reservation or order; and, if you consent, the call transcript and recording.

If you volunteer dietary or allergy information (e.g. "I'm coeliac"), it is used only to fulfil your order and is never used to profile you.

Taking your booking or order rests on performance of a contract (Art. 6(1)(b)). The audio recording of the call rests on your consent (Art. 6(1)(a)) — you can decline recording at the start of the call and we continue without it.

Card payments are handled by Stripe. Card numbers are tokenized in Stripe's systems — Tavolo never sees or stores your full card number.

To run the service, the restaurant's processor (Tavolo) uses vetted providers: OpenAI (voice model), Twilio (telephony), Stripe (payments), Clerk (staff sign-in), and Neon / Railway / Vercel (hosting). Where a provider is outside the EU, transfers rely on Standard Contractual Clauses or the EU-US Data Privacy Framework.

Each restaurant sets its own retention window; after it passes, inactive customer records are erased and call transcripts and recordings are redacted. You can ask the restaurant to delete your data at any time.

Under the GDPR you can request access, correction, deletion, portability, and object to processing. See the GDPR page for how to exercise them, or email hello@tavolo.io.