Privacy Policy

1. Two different roles — please read this first

• When you are our customer or website visitor, Cortable is the controller of your account, billing, website and usage data, and this Privacy Policy applies.
• When a restaurant uses the Platform to manage its guests and staff, the *restaurant* is the controller of that Guest and staff personal data, and Cortable acts only as a processor on the restaurant's behalf. That processing is governed by our Data Processing Agreement, not this Policy. If you are a restaurant guest or employee with a question about your data, please contact the restaurant directly; we will support them in responding.

2. The personal data we collect (as controller)

• Account & contact data — name, business name, email, phone, role, and login credentials of the people who set up and administer a CorTable account.
• Early-access / enquiry data — the details you submit through our website forms (e.g. restaurant name, name, email, phone) when you request access or contact us.
• Billing data — subscription and payment information. Card payments are handled by our payment processor (Stripe); we do not store raw card details.
• Usage, device & log data — how the Platform is used (feature usage, performance metrics, error logs), and technical data such as IP address, browser/user-agent, and audit-event records (action, actor, timestamp) created for security and integrity.
• Communications — correspondence with us (e.g. support requests) and your marketing preferences.
• Cookies — see section 7.

3. Why we use it, and our lawful bases

We use anonymised and aggregated data to operate, secure, analyse and improve the Platform and to produce industry insights. Externally shared benchmarks are derived from a minimum of ten sites so that no individual, guest or customer can be identified.

4. Who we share it with

We do not sell personal data. We share it only with:

• Service providers (sub-processors) who help us run the Platform, under contract and only as needed:
• Amazon Web Services — hosting, database, file storage and OCR (UK, eu-west-2 region);
• Stripe — payment processing and subscription billing;
• Brevo (Sendinblue) — transactional and, where you have opted in, marketing email (EU/France);
• OpenAI and Anthropic — AI/ML services, provided with anonymised or aggregated operational data.
• Professional advisers (e.g. lawyers, accountants) under confidentiality;
• Authorities, regulators or other parties where required by law, to protect our rights, or in connection with a merger, reorganisation or sale of our business.

Our current sub-processor list is maintained and updated as described in our Data Processing Agreement.

5. International transfers

Some of our providers are outside the UK/Jersey (for example Stripe, OpenAI and Anthropic in the US). Where personal data is transferred internationally, we rely on an appropriate safeguard — such as the UK/EU adequacy arrangements, the EU–US Data Privacy Framework where the recipient is certified, and/or Standard Contractual Clauses with supplementary measures.

6. How long we keep it

We keep personal data only as long as needed for the purposes above: for the life of your account and a reasonable period afterwards; longer where the law requires (for example, financial records for six years) or where data is held in routine backups, which are deleted on their ordinary cycle. Anonymised and usage data may be retained indefinitely.

7. Cookies

We use strictly necessary cookies to run the Platform and keep you signed in securely, and — with your consent where required — a limited set of analytics cookies to understand and improve how the site and Platform are used. You can control non-essential cookies through our cookie banner and your browser settings.

8. Your rights

Subject to the applicable data-protection laws, you have the right to access, rectify, erase, restrict or object to our processing of your personal data, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these, email hello@cortable.ai. We will respond within the time limits set by law.

You also have the right to complain to a supervisory authority — the Jersey Office of the Information Commissioner (JOIC) or, for UK-resident individuals, the UK Information Commissioner's Office (ICO) — though we'd appreciate the chance to resolve your concern first.

9. Children

The Platform is a business tool and is not directed at children. We do not knowingly collect personal data from children.

10. Changes to this Policy

We may update this Policy from time to time. When we make material changes we will update the version and date above and, where appropriate, notify you.

11. Contact

Questions about this Policy or your personal data: hello@cortable.ai, or write to Cortable Limited at the registered office above.