Privacy Policy

1. Two different roles — please read this first

• When you are our customer or website visitor, Cortable is the controller of your account, billing, website and usage data, and this Privacy Policy applies.
• When a restaurant uses the Platform to manage its guests and staff, the *restaurant* is the controller of that Guest and staff personal data, and Cortable acts only as a processor on the restaurant's behalf. That processing is governed by our Data Processing Agreement, not this Policy. If you are a restaurant guest or employee with a question about your data, please contact the restaurant directly; we will support them in responding.

2. The personal data we collect (as controller)

• Account & contact data — name, business name, email, phone, role, and login credentials of the people who set up and administer a CorTable account.
• Early-access / enquiry data — the details you submit through our website forms (e.g. restaurant name, name, email, phone) when you request access or contact us.
• Billing data — subscription and payment information. Card payments are handled by our payment processor (Stripe); we do not store raw card details.
• Usage, device & log data — how the Platform is used (feature usage, performance metrics, error logs), and technical data such as IP address, browser/user-agent, and audit-event records (action, actor, timestamp) created for security and integrity.
• Voice notes to Mick — When you send a voice note to Mick, CorTable stores the recording and its transcript with your account and restaurant conversation so you can replay the note and use Mick's reply. We send the recording to OpenAI to turn speech into text. The transcript is used to process your request: like a typed request, it is sent to Anthropic together with the relevant conversation history and the information Mick looks up to answer you, and if you ask Mick to read a reply aloud the reply text is sent to OpenAI to generate the audio. Recordings and transcripts can contain personal information, including information about people you mention. Restaurant guest and staff information is processed on the restaurant's behalf under our Data Processing Agreement.
• Communications — correspondence with us (e.g. support requests) and your marketing preferences.
• Cookies — see section 7.

3. Why we use it, and our lawful bases

We use anonymised and aggregated data to operate, secure, analyse and improve the Platform and to produce industry insights. Externally shared benchmarks are derived from a minimum of ten sites so that no individual, guest or customer can be identified.

4. Who we share it with

We do not sell personal data. We share it only with:

• Service providers (sub-processors) who help us run the Platform, under contract and only as needed:
• Amazon Web Services — hosting, database, file storage and OCR (UK, eu-west-2 region);
• Stripe — payment processing and subscription billing;
• Brevo (Sendinblue) — transactional and, where you have opted in, marketing email (EU/France);
• PostHog — diagnostics and product-usage analytics in our EU project. We use this information to understand which pages and features are used, identify workflow problems, and improve CorTable's reliability and usability. Approved events contain pseudonymous user or staff identifiers, venue identifiers, fixed event categories, platform, app version and timestamps; public and supplier page activity is sent as daily aggregate counts. Pseudonymous identifiers replace direct identifiers in these events, but may still relate to an individual;
• OpenAI — speech-to-text and text-to-speech for Mick. OpenAI receives the voice recordings you send to Mick so they can be turned into text, and the text of a Mick reply when you ask for it to be read aloud. This content is sent as submitted, not anonymised or aggregated;
• Anthropic — the AI model behind Mick. When you ask Mick something, Anthropic receives your typed request or voice-note transcript, the relevant conversation history and the venue information Mick retrieves to answer you, and returns the reply. Requests and transcripts are sent as entered, not anonymised or aggregated.
• Professional advisers (e.g. lawyers, accountants) under confidentiality;
• Authorities, regulators or other parties where required by law, to protect our rights, or in connection with a merger, reorganisation or sale of our business.

Our current sub-processor list is maintained and updated as described in our Data Processing Agreement.

5. International transfers

Some of our providers are outside the UK/Jersey (for example Stripe, OpenAI and Anthropic in the US). Where personal data is transferred internationally, we rely on an appropriate safeguard — such as the UK/EU adequacy arrangements, the EU–US Data Privacy Framework where the recipient is certified, and/or Standard Contractual Clauses with supplementary measures.

6. How long we keep it

We keep personal data only as long as needed for the purposes above: for the life of your account and a reasonable period afterwards; longer where the law requires (for example, financial records for six years) or where data is held in routine backups, which are deleted on their ordinary cycle. Anonymised and usage data may be retained indefinitely.

7. Cookies

The public website and its early-access signup form do not currently set cookies or use browser storage to track visitors, and do not display a cookie consent banner. The separate restaurant dashboard uses necessary session cookies to authenticate you and keep your account secure. For the public website, see our Cookie Policy. If we introduce cookies or similar technologies on the public website, we will explain their use and provide any consent or objection controls required before using them.

8. Your rights

Subject to the applicable data-protection laws, you have the right to access, rectify, erase, restrict or object to our processing of your personal data, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these, email hello@cortable.ai. We will respond within the time limits set by law. If you live in the United States, section 12 explains the additional state-law rights that may apply to you.

You also have the right to complain to a supervisory authority — the Jersey Office of the Information Commissioner (JOIC) or, for UK-resident individuals, the UK Information Commissioner's Office (ICO) — though we'd appreciate the chance to resolve your concern first.

9. Children

The Platform is a business tool and is not directed at children. We do not knowingly collect personal data from children.

10. Changes to this Policy

We may update this Policy from time to time. When we make material changes we will update the version and date above and, where appropriate, notify you.

11. Contact

Questions about this Policy or your personal data: hello@cortable.ai, or write to Cortable Limited at the registered office above.

12. United States residents

This section applies if you live in a US state whose privacy law applies to you and to us — for example the California Consumer Privacy Act (as amended by the CPRA) or the Colorado, Connecticut, Virginia and similar state privacy acts. It supplements the rest of this Policy, which continues to apply. The controller is Cortable Limited, the Jersey company identified above, and we serve US customers from the UK and Jersey as described in section 5 and below. Which state law, if any, applies depends on where you live and on statutory thresholds; this section describes rights where a law grants them and does not itself determine that a law applies.

• Two roles. For your CorTable account, billing, website and usage data we act as the business (controller) and this section applies directly. For restaurant guest and staff data we act as the restaurant's service provider (processor) under our Data Processing Agreement: guests and staff should send requests to their restaurant, which controls that data, and we help the restaurant respond.
• Categories, sources, purposes, recipients and retention. Sections 2 to 6 describe the categories of personal information we collect (account and contact, enquiry, billing, usage/device/log, communications and cookies), their sources (you, your use of the Platform and your restaurant), the purposes we use them for, the recipients we disclose them to (the service providers, professional advisers, authorities and other recipients in section 4) and how long we keep them.
• Sale, sharing and targeted advertising. We do not sell personal information (section 4), and we do not use or disclose it for cross-context behavioural (targeted) advertising. The providers in section 4 process personal information under contracts that limit their use of it to the services they perform for us. Our website, web Platform and app do not include advertising trackers or advertising SDKs. Our diagnostics and product-usage analytics (section 4) are performed by a service provider under contract and are pseudonymous, not anonymous. We do not currently process Global Privacy Control or Do Not Track browser signals; if we begin to sell or share personal information for targeted advertising, we will update this Policy and offer the required opt-out choices, including recognised browser signals, before doing so.
• Sensitive personal information. As a business, we do not collect sensitive personal information in order to infer characteristics about you; your account login credentials are used to sign you in and keep your account secure. Guest allergy and dietary information is processed on the restaurant's behalf as its service provider (section 1 and our Data Processing Agreement).
• Your rights. Depending on your state, you may have the right to know and access the personal information we hold about you and to receive it in a portable format; to correct inaccurate information; to delete it (subject to legal exceptions, for example financial records we must keep); to opt out of sale, sharing or targeted advertising and of certain profiling, where those activities take place (see our current practices above); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. Where your state provides a right of appeal, you may appeal our decision on a request by replying to our response, and if you remain dissatisfied we will tell you how to contact your state Attorney General.
• How to make a request. Email hello@cortable.ai or write to Cortable Limited at the registered office in section 11. We may verify your identity using the email address and other details held on your account or otherwise provided, and may ask for further information where reasonably needed; verification does not restart the response period below. An authorised agent may submit a request on your behalf with your signed permission; we may confirm the request with you directly. We respond within 45 days of receiving your request, or any shorter period your state law sets, and where the law allows we may extend once by up to a further 45 days, telling you why before the first period ends.
• Where your information is processed. Personal information about US residents is transferred to, stored and processed in the UK and Jersey (our hosting is in AWS's UK eu-west-2 region) and by the service providers in sections 4 and 5, some of which are in the US (Stripe, OpenAI and Anthropic); diagnostics and product-usage analytics run in PostHog's EU project. Our primary hosting for the Platform is in AWS's UK (eu-west-2) region.