Privacy policy
Last updated 25 October 2026
This page explains what TableDesk collects, why, who sees it, how long we keep it and what you can ask us to do with it. We have tried to write it the way we would explain it across the bar.
1. Who we are
TableDesk is restaurant and bar management software with a point-of-sale system. It runs on our cloud, or on a small box inside a venue. In this policy, “TableDesk”, “we” and “us” mean the people who run it.
For anything in this policy, write to support@tabledesk.app.
2. Your venue’s data and ours
Two kinds of data pass through TableDesk, and the law treats them differently.
- Data about our customers. The accounts of venue owners and managers, how they sign in, and their billing. We decide what happens to this data, so we are its controller.
- Data a venue puts into TableDesk. Its staff, its guests’ bookings, its orders and its reports. The venue decides what to record and why, so the venue is the controller and we are its processor: we keep and handle that data only to run the service for the venue, and never for our own purposes. If you are a venue’s guest or a member of its staff, the venue is the first place to ask about your data; we will help it answer.
3. What we collect
Venue owners and managers
- Your email address and your password, which we store only as a one-way hash that cannot be turned back into the password.
- If you sign in with Google or Apple: the account id that provider gives us, and for Apple, a token we keep encrypted so we can disconnect your Apple account when you close yours.
- Your sessions and devices: the device model, operating system, app version, language and time zone, so you can see where you are signed in and sign a device out.
- The invitations you send to colleagues: who was invited, to which venue and when.
- For paid plans, your billing details. Payments are taken by Stripe; we never see or store your full card number.
Staff (recorded by the venue)
- Name, and whatever else the venue chooses to add: phone, date of birth, photo, email and a note.
- A 6-digit PIN for signing in at the till, stored only as a one-way hash with an extra secret kept outside the database.
- Clock-ins and timesheets, and which orders, voids, discounts and approvals each person made, because that is how a venue keeps its cash honest.
- A photo taken at clock-in, only if the venue switches this on. It is off unless they do.
Guests (recorded by the venue)
- Ordering from a table’s QR code: no name, phone or email. We keep a random key for the phone’s browser so the same phone stays on the same table’s order, and the waiter calls made from it.
- Online bookings: the name, phone, email, language and note a guest gives, stored encrypted.
- Takeaway, delivery and house accounts: the name, phone and address the venue takes down.
- Drinks that need an ID check: only which staff member checked and when. Nothing about the guest or their ID is stored.
- Photos on an order that staff take, for example of a complaint or a breakage. Location and camera details are removed from every photo when it is uploaded.
Technical data
- Our servers log each request they receive: the address it came from, what was asked for, and the time. Before anything is written, links that would open a guest’s booking or a table, sign-in tokens and searches for a guest’s phone or email are blanked out. The content of what you send is never logged.
- We use our own monitoring, run on our own servers, to see errors and slow pages. We use no advertising or analytics trackers, on this website or in the app.
4. Why we use it
| What we do | Legal basis |
|---|---|
| Run your account and the service you signed up for: sign-in, syncing your devices, emailing you invitations and password resets | Our contract with you |
| Bill your plan and keep invoices | Our contract with you, and the law, which requires us to keep accounting records |
| Keep the service secure: stop break-ins, limit abuse, find and fix faults | Our legitimate interest in a service that is safe for every venue on it |
| Tell you about changes to the service, your plan or these terms | Our contract with you |
| Handle a venue’s staff and guest data | The venue’s instructions; the venue chooses its own legal basis |
We do not sell personal data, use it for advertising, or use a venue’s data to train anything.
5. Who we share it with
We share data only with the companies that help us run TableDesk, and only what each one needs:
- Our hosting provider, which runs the servers our cloud is on.
- A second storage provider, which keeps our encrypted database backups and copies of photos away from our servers. It holds them encrypted with a key only we have, and cannot read them.
- Cloudflare, which sits in front of tabledesk.app to keep it fast and protected from attacks, and stores the photos uploaded to our cloud and our app updates.
- GitHub (GitHub Pages), which serves this website, tabledesk.app, and so sees the address and browser of everyone who opens it.
- Resend, which delivers our emails: invitations, password resets and booking confirmations.
- Google (Firebase Cloud Messaging) and Apple (Push Notification service), which deliver notifications to your devices.
- Google and Apple again, when you choose to sign in with them. In a web browser, the screens that offer Apple sign-in load Apple’s sign-in script from Apple as they open, so the button works at the first press; Apple then sees your browser and its address, whether you use the button or not.
- Stripe, which takes payments for paid plans.
We may also share data if the law requires it, for example a court order, and we will tell you first where we are allowed to.
6. Self-hosted and Offline boxes
On the Self-hosted and Offline plans, TableDesk runs on a box in the venue and its data stays there. We cannot see it.
- A Self-hosted box talks to our cloud only for what the venue uses: its public menu, delivering its emails and notifications, and downloading updates. Guest booking details pass through our cloud until the box collects them.
- Three channels are off unless the venue turns them on: health reports about the box (never the content of orders or messages), summary figures the owner can check from home, and remote access to the box. Remote access is encrypted between the owner’s device and the box, so we only carry it and cannot read it.
- An Offline box never connects to us at all.
- Backups a box makes are encrypted with a key only the venue holds. We cannot open them.
7. How long we keep it
| Data | Kept for |
|---|---|
| Server request logs | Up to 10 days |
| A QR ordering session at a table | 1 day |
| Guests’ contact details from bookings, takeaway and delivery | 90, 180 or 365 days, as the venue chooses, then forgotten |
| Clock-in photos | 90 days, then up to 45 days more in our locked, encrypted off-site copy |
| Data exports you download | 7 days, then deleted from our servers; up to 45 days more in our locked, encrypted off-site copy |
| Sign-in sessions | 30 days after last use |
| Box health reports (when switched on) | 30 days |
| Audit trail of voids, discounts and approvals | As long as the venue’s other records, at least 5 years, because tax rules can ask a venue to show it |
| Invoices and billing records | As long as accounting law requires |
| A venue or organization you delete | 30 days, so a mistake can be undone, then deleted |
| Your account after you close it | Your sign-in details are deleted at once. Your name stays on the records of venues you worked at, as it does on a paper receipt. If you owned a venue whose plan was paid for in the last 120 days, or a payment for it was refunded or disputed, we keep a one-way code made from your email and Google or Apple sign-in for 180 days, and where a payment was refunded or disputed until it is settled, so the same sign-in cannot start a new plan before then. The code cannot be turned back into your email. |
| Backups of our cloud database | About 5 weeks, then up to 45 days more in a locked copy, so that an attack on our servers cannot wipe the backups. Every copy is encrypted under a key only we hold, and deleted data is gone from them once that time has passed. A copy we make just before an update to our servers is deleted at our next update once it is 5 weeks old |
A cloud organization that never took an order is deleted once it has not been used for a year, after we have emailed its owners twice, or when its last owner closes their account. One that has taken orders is kept until an owner deletes it, because its records may be needed for tax.
8. How we protect it
- Everything travels encrypted (HTTPS), except one thing: a guest’s phone on a venue’s own Wi‑Fi talks to the venue’s box over plain HTTP, inside that network, when the venue chooses that its QR codes work there.
- Sensitive fields, such as guests’ contact details and sign-in tokens, are encrypted in our database with AES-256.
- Passwords and PINs are stored only as one-way hashes.
- The app’s own database on each phone, tablet and computer is encrypted, with its key kept in the device’s secure storage. A browser, and a computer with no secure storage, has nowhere to keep that key apart from the data: there the app keeps only a copy of what it last read, unencrypted, holds no unsent work, and forgets the copy when you sign out.
- Only the few people who run TableDesk can reach our servers, and our operator tools sit behind a password and a second factor.
No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.
9. Data outside your country
Some of the companies in section 5 are based in the United States or work from several countries. Where data leaves your country, we rely on the protections the law provides for that, such as the European Commission’s standard contractual clauses.
10. Cookies and browser storage
- This website sets no cookies. It remembers your light or dark choice in your browser, and nothing else.
- The web app keeps your sign-in in your browser’s storage, so you stay signed in. Signing out removes it.
- A venue’s public menu keeps your cart, your table session and your light or dark choice in your browser. It sets no cookies.
None of this tracks you across other websites.
11. Your rights
Depending on where you live, you can ask us to:
- show you the personal data we hold about you, and give you a copy;
- correct it;
- delete it;
- limit how we use it, or object to a use;
- send it to you or to another service in a common format.
You can do much of this yourself: change your details in the app, download your venue’s data from Backups, and close your account from your account settings. For anything else, email support@tabledesk.app. We answer within one month. If your data was recorded by a venue, we will pass your request to the venue and help it answer.
You can also complain to the data protection authority where you live or work. In North Macedonia that is the Personal Data Protection Agency (azlp.mk).
12. Children
TableDesk accounts are for businesses and their staff, and are not meant for anyone under 16. If you believe a child has given us their details, email us and we will delete them.
13. Changes to this policy
When we change this policy, we update the date at the top. If a change matters to how your data is used, we email account owners before it takes effect.
14. Contact
Email support@tabledesk.app.