Privacy Policy

The restaurant you are contacting is the data controller: it decides why your data is used. Tavolo acts as its processor under a Data-Processing Agreement (GDPR Art. 28), handling the call and storing the booking or order on the restaurant's behalf.

To handle your request: your name, phone number, delivery address and language; the details of your reservation or order; and, if you consent, the call transcript and recording.

If you volunteer dietary or allergy information (e.g. "I'm coeliac"), it is used only to fulfil your order and is never used to profile you.

Taking your booking or order rests on performance of a contract (Art. 6(1)(b)). The audio recording of the call rests on your consent (Art. 6(1)(a)), and you can decline recording at the start of the call and we continue without it.

Card payments are handled by Stripe. Card numbers are tokenized in Stripe's systems, and Tavolo never sees or stores your full card number.

To run the service, the restaurant's processor (Tavolo) uses vetted providers: OpenAI (voice model), Twilio (telephony), Stripe (payments), Resend (transactional email), and Neon / Railway / Vercel (hosting). Staff sign-in runs on Tavolo's own servers, so no third party holds it. Where a provider is outside the EU, transfers rely on Standard Contractual Clauses or the EU-US Data Privacy Framework.

Each restaurant sets its own retention window; after it passes, inactive customer records are erased and call transcripts and recordings are redacted. You can ask the restaurant to delete your data at any time.

Under the GDPR you can request access, correction, deletion, portability, and object to processing. See the GDPR page for how to exercise them, or email hello@tavolo.io.

The pages above describe GUEST data, where the restaurant is the controller and Tavolo the processor. For its own business contacts Tavolo is the controller in its own right: the name, work email and phone of the people who run a restaurant using Tavolo, billing and payment records, and support correspondence.

That data is processed to provide and bill the service under Art. 6(1)(b), and to meet accounting and tax duties under Art. 6(1)(c). It is never sold, and it is not used to advertise to a restaurant's guests. Write to hello@tavolo.io to see, correct or delete it.