Privacy Policy

1 Information We Collect

Account Information

• Phone number — used to create your account and to send one-time sign-in codes by SMS
• Name — as provided by a third-party reservation platform account you link
• Email address — used to send booking confirmations, receipts and account notices; for linked platforms it is also the login email we use to book on your behalf

Restaurant Platform Credentials

• Third-party reservation platform login (email and password) — encrypted and stored securely using AES-256 encryption; used solely to submit reservation requests on your behalf
• OpenTable credentials — encrypted and stored securely; used solely to submit reservation requests on your behalf
• Other platforms you choose to link (such as DoorDash, SevenRooms or Tock) — handled the same way, and only for the platforms you link

Booking & Usage Data

• Reservation details (restaurant, date, time, party size, status)
• Transaction history and credit balance
• Device information and IP address (for security and fraud prevention)
• Concierge chats — messages you send to the in-app concierge are stored with your account and processed by the AI providers listed in Section 3

Payment Information

Payment processing is handled by Stripe. We do not store your full credit card number. Stripe retains payment information in accordance with PCI-DSS standards. We store only a tokenized reference and last four digits for display purposes.

2 How We Use Your Information

We use the information we collect to:

• Create and manage your tablepass account
• Submit reservation requests on your behalf via the third-party reservation platforms you link
• Send booking confirmations, status updates, receipts and account notices by email and in the app
• Send one-time sign-in codes by SMS
• Process payments for confirmed reservations
• Prevent fraud and abuse of our service
• Improve our service and develop new features

3 Information Sharing

We do not sell or rent your personal information. We share it only with the service providers below, who process it on our behalf, and when the law requires.

• Reservation platforms (the third-party reservation platforms whose accounts you link) — the credentials you link are sent to that platform’s API to complete bookings. We act as your agent.
• IPRoyal — our traffic to reservation platforms is routed through residential proxy servers; the booking requests we make for you pass through them
• Stripe — payment processing and subscription billing
• Supabase — our database and sign-in system, where your account data is stored
• Amazon Web Services — hosting, and email delivery (Amazon SES)
• Resend — email delivery
• Twilio — one-time sign-in codes by SMS, and phone-number checks to block fraudulent sign-ups
• Anthropic — the in-app concierge is an AI assistant; your chat messages are sent to Anthropic to generate replies
• Braintrust — receives concierge chat transcripts so we can monitor the quality of the AI’s answers
• Sentry — error monitoring; receives technical details when something breaks, which can include your user ID
• Google Analytics, Google Tag Manager, Reddit Ads and Contentsquare — analytics, ad measurement and session replay, described in Section 7
• Clerk — sign-in for accounts created through Snag, which we operate
• Legal requirements — we may disclose information if required by law, court order, or governmental regulation

4 Data Security

We take data security seriously:

• Restaurant platform passwords are encrypted at rest using Fernet symmetric encryption (AES-256-CBC)
• All data transmitted between your browser and our servers is encrypted via TLS/HTTPS
• Access to production systems is restricted to authorized personnel
• We do not store your password in plain text at any point

5 Data Retention

We retain your account data for as long as your account is active. You can delete your account at any time from Settings in the app, or by emailing support@tablepass.nyc. Deletion cancels any subscription and stops all monitoring immediately; your personal data is then deleted within 30 days. Transaction records may be retained for up to 12 months for legal and accounting purposes.

Concierge chat messages are retained with your account and deleted on the same schedule.

6 SMS & Notifications

We use SMS for one thing: sending you a one-time code when you sign in. Message and data rates may apply. We do not send marketing or booking notifications by SMS. Booking confirmations, status updates and receipts are sent by email and shown in the app.

7 Cookies & Analytics

We use cookies and local storage to keep you signed in. We also load the following third-party scripts on our website:

• Google Analytics and Google Tag Manager — page views and usage statistics
• Reddit Ads pixel (loaded through Tag Manager) — tells Reddit when a sign-up came from one of our ads
• Contentsquare — session replay that records how pages are used, with typed text masked

These tools set their own cookies and can see your IP address and device details. You can opt out by using a browser content blocker or the Google Analytics opt-out add-on; the Service works without these scripts.

8 Your Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Ask us to unlink any linked third-party reservation platform credentials at any time by contacting support

9 Children’s Privacy

Our service is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors.

10 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Continued use of the service after changes constitutes acceptance of the updated policy.

11 Contact Us

If you have questions about this Privacy Policy or your data, contact us at: