Privacy policy

1. Data controller

• Identity: Joan Sanfeliu Vilarrasa
• Tax ID (NIF): 79279716G
• Address: Barcelona, Spain
• Email: hola@taula.ai

Hereinafter, "the Controller". Given the nature and volume of the processing carried out, the appointment of a Data Protection Officer is not required. Nevertheless, the Controller will personally handle any query sent to the indicated email address.

2. Personal data processed

The Controller processes only the personal data strictly necessary for the purposes described in this policy. Specifically:

• Contact form, demo request and communications: name, email address, restaurant name (optional) and the content of the message that the user chooses to provide voluntarily when getting in touch and, if given, how they heard about taula.ai; in the demo request, also the town, the phone number and, if given, how bookings are handled today. Both forms on the Website send this data to the Controller's customer management system (CRM), together with the page they are sent from, the referring page and, if the address carries them, the campaign parameters (section 2 quinquies).
• Business contacts: business name, the person's name and professional contact details, where the contact came from and a record of the conversations and, if the contact arrives through a web form, the IP address and browser it was sent from, in the Controller's customer management system (CRM) (section 2 quinquies).
• Registration and use of the platform: account and identification data (name, email, access credentials managed securely) necessary to create and administer the user account in the management dashboard (app.taula.ai) and to provide the contracted services, and the business data the restaurant enters there, such as the name and the Google listing it chooses when building its website.
• Billing and payment data: identification, tax and billing data necessary to contract the subscription service, and the plan, the billing period and, on the Basic plan, the monthly count of online bookings. Payment data —card details or, where the customer chooses direct debit, the bank account number (IBAN) and the SEPA mandate— is handled directly by the payment provider Stripe; the Controller stores neither full card details nor the IBAN in its systems. Invoicing and accounting are handled with Stripe and with the Holded software (section 6).

The Website may use Google Analytics 4 for statistical purposes only, and only if the visitor accepts it in the cookie notice: until then no analytics cookie is installed. No tracking cookies are used for advertising purposes and no profiling is carried out. For more information, see the Cookies Policy.

2 bis. Data processed on behalf of the restaurant (processor role)

This is the most important part of this policy and it is worth reading slowly, because here taula.ai does not act as controller.

When a restaurant uses the platform, personal data about its guests is recorded there: name, phone number, email address, language, party size, date and time of the booking, table assigned, visit history, no-shows, internal notes written by the restaurant's staff and, where applicable, food allergies and intolerances. When the service becomes available and the restaurant enables it, also the booking reminder sent by WhatsApp (section 6).

For this data the controller is the restaurant, which decides what is collected and why. taula.ai acts solely as a processor (Art. 28 GDPR), processing it only on the restaurant's instructions and in order to provide the contracted service. The terms of that arrangement are set out in the Data Processing Annex, which forms part of the contract with every customer.

Allergies and intolerances may constitute health data (Art. 9 GDPR). taula.ai provides the field as a service tool, but it is for the restaurant to have a valid legal basis for collecting it —normally the guest's explicit consent—, to inform the guest and not to record more than is necessary.

Retention periods on behalf of the restaurant. Bookings and customer cards are kept for up to 24 months from the diner's last visit and are automatically deleted every night once that period has passed. If a restaurant stops using the service, all its bookings and customer cards are deleted 30 days later, once the recovery period has elapsed. The restaurant may request early deletion of a specific card at any time.

If you are a guest and wish to exercise your rights over this data, please contact the restaurant where you booked, as it is the one that decides on it. If you write to us, we will pass your request on to the restaurant and let you know.

2 ter. Artificial intelligence features

The platform uses AI models at three specific points:

• Reading and translating the menu: when the restaurant uploads a PDF or a photograph of its menu, it is processed by a model to extract dishes and prices, and to produce the versions in the languages the restaurant itself chooses.
• Generating the restaurant's website: when the restaurant requests it from the dashboard, at sign-up or later, the website's texts are drafted by a model from the business details the restaurant confirms at sign-up, the text of its current website if it gives one, its menu and the photographs it supplies. The business's Google listing (looked up with the Google Places API) only serves to suggest those details in the form: nothing from Google is sent to the model. This is only done for accounts with an active service. The Controller does not review the draft before showing it: the restaurant reviews it, can generate it again and approves it before publication (section 2 quater).

This processing takes place through Amazon Bedrock, within AWS infrastructure in the European Union. Under the terms of that service, the data sent is not used to train models and is not shared with the model providers for that purpose.

No decisions are taken based solely on automated processing that produce legal effects on individuals or similarly significantly affect them (Art. 22 GDPR), and no profiling is carried out. The platform does apply automatic rules that each restaurant configures: if a table is free according to the capacity and opening hours the restaurant has defined, the booking is confirmed immediately; if the restaurant has enabled manual confirmation, it remains pending until the restaurant validates it; and if it has enabled reconfirmation, a booking the guest does not reconfirm within the margin set by the restaurant is released automatically, which the guest is always warned about beforehand. These are availability calculations on parameters set by a person, not an assessment of the guest. In any case, the guest can book by phone and speak directly with the restaurant.

2 quater. Restaurant websites on taula.ai subdomains

Each customer restaurant may have a website published on a taula.ai subdomain bearing its business name (for example, yourname.taula.ai) or, on the Pro plan, on its own domain. The content of that site —texts, photographs, menu, opening hours and contact details— is decided and approved by the restaurant, which is responsible for it towards visitors (the site's template, code and design belong to taula.ai, on a rental basis, under section 9 of the Terms) and must identify itself there with its own legal notice and privacy policy, using the details it gives taula.ai at sign-up. taula.ai hosts and maintains it as a processor on the restaurant's behalf, under the terms of the Data Processing Annex.

Visitors to these sites provide no personal data unless they make a booking, in which case section 2 bis applies. To serve the page and protect it from abuse, the server temporarily processes the visitor's IP address, under the same conditions and legitimate interest as on the Website (section 4).

The files of these sites are stored on AWS in the eu-west-3 region (Paris) and served with Amazon CloudFront, as explained in section 6.

2 quinquies. Business contacts and the customer management system (CRM)

What data, and from where. When a restaurant or a professional contacts the Controller (by email or phone, or, while it was available, through the optional contact box on the website preview), or replies to a contact from the Controller, the Controller stores in its customer management system (CRM) the business name, the person's name and professional contact details, a record of the conversations and where the contact came from: the page or campaign it came from. When the contact arrives through a web form that sends it straight to the CRM (on taula.ai, the contact form and the demo request form and, while it was available, the website preview's contact box), the CRM also stores, for every form it receives and not only those with a box ticked, the IP address and browser (the identifier the browser sends, or "user agent") it was sent from, and uses the IP address in a per-minute submission counter. When a new contact comes in, the CRM sends an email notice to the Controller's mailbox. The CRM is the Controller's own and is hosted on AWS in the eu-west-3 region (Paris).

Purpose and legal basis. To handle the request, which is a pre-contractual measure at the data subject's request (art. 6.1.b GDPR), and to follow it up commercially. Anyone who ticked the contact box gave their consent (art. 6.1.a GDPR); it was optional and nothing else depended on it (art. 7.4 GDPR), and it can be withdrawn at any time by writing to hola@taula.ai. In other cases, the follow-up relies on the Controller's legitimate interest in replying to those who have approached it (art. 6.1.f GDPR), and the data subject may object at any time. By email, the Controller only sends commercial communications to those who have asked for them or consented to them (art. 21 of the Spanish LSSI). The data on where the contact came from relies on the legitimate interest in knowing which channels work. The IP address and browser of forms are stored for security —limiting bulk submissions, detecting automated ones and investigating abuse— and to be able to show when and from where the form was sent and consent was given (art. 7.1 GDPR), on the Controller's legitimate interest (art. 6.1.f GDPR); they are kept with the contact, for the periods in this section. The per-minute counter expires after a few minutes and the system deletes it automatically, normally within a few days. The IP address and browser are also kept, with the time and address of the request, in the CRM's technical logs (on AWS, in the same region), which are deleted automatically after fourteen (14) days; if a submission is rejected —for a wrong key, too many submissions in a minute or because it looks automated—, those logs are the only place they are kept.

How long. For as long as a conversation or proposal is ongoing and, if the contact does not lead to a contract, for up to two (2) years from the last contact. After that, or earlier if the data subject withdraws consent, objects or asks for erasure, the data is deleted from the CRM, except for anything that must be kept blocked to address possible liabilities (art. 32 LOPDGDD). If the data subject signs up to taula.ai, the periods in section 5 apply.

The public preview, withdrawn. The website preview without an account that was available on the “Your website” page is no longer offered: the website is built from the dashboard, with an account (section 2 ter). Preview requests made before, with the phone number, email and IP address linked to them, expire seven (7) days after the request and, from then on, are not used for anything; the system deletes them automatically shortly afterwards, normally within a few days. The daily per-IP counter expired after two (2) days and is deleted in the same way.

3. Purposes of processing

Personal data will be processed for the following purposes:

• To respond to queries, requests for information or other requests submitted by the user, and to follow up business contacts (section 2 quinquies).
• To create and manage the user account and enable access to and use of the taula.ai platform.
• To provide the micro-services and tools contracted by subscription and to support the user.
• To publish and maintain the restaurant's website on its taula.ai subdomain or, on the Pro plan, on its own domain.
• To manage billing, subscription payments and compliance with applicable accounting, tax and administrative obligations.
• To send, where applicable, communications related to the requested or contracted services (operational notices, changes to the service, etc.).

Today the Controller does not send commercial communications. If in the future it sends them to its customers about its own services similar to those contracted, it will do so under article 21.2 of the Spanish LSSI and its legitimate interest (art. 6.1.f GDPR), and the customer will be able to object at sign-up, from their profile in the dashboard and through the unsubscribe link that every message will carry, simply and free of charge.

4. Legal basis for processing

The legal bases that legitimise the processing of the data are the following:

• Consent of the data subject (art. 6.1.a GDPR), given when submitting the contact form or initiating communication with the Controller, or when ticking the optional contact box that the website preview had (section 2 quinquies).
• Performance of a contract to which the data subject is party, or the application of pre-contractual measures at their request (art. 6.1.b GDPR), in particular for the creation of the account and the provision of the subscription service.
• Compliance with legal obligations applicable to the Controller, in particular in tax, commercial and accounting matters (art. 6.1.c GDPR).
• Legitimate interest of the Controller in maintaining the customer relationship, responding to communications received, following up business contacts (section 2 quinquies), ensuring the security of the platform —including the temporary processing of the IP address of anyone making a booking or viewing a menu in a counter that is only valid for the current hour, to prevent bulk requests and abuse; after that hour the counter is no longer used for anything and the system deletes it automatically, normally within a few days—, storing the IP address and browser of the web forms that reach the CRM for their security and as proof of consent (section 2 quinquies), and retaining the related documentation (art. 6.1.f GDPR).

5. Retention period

The data will be retained for as long as strictly necessary to fulfil the purposes for which it was collected and, in any case, for the periods legally required to address any liabilities arising from the processing.

Communications received and business contacts that do not result in a contractual relationship will be retained for up to two years from the last contact (section 2 quinquies). Data linked to the account and to the provision of services will be retained for the duration of the contractual relationship and, subsequently, for the limitation periods of the resulting legal actions, as well as those required by tax, commercial and accounting regulations (generally, up to six years).

6. Recipients and disclosures

Personal data will not be disclosed to third parties, except by legal obligation or where strictly necessary for the provision of the requested service.

For the development of its activity, the Controller relies on the following service providers, which act as data processors, subject to the corresponding contractual obligations and to data protection regulations:

• Amazon Web Services EMEA SARL (AWS): cloud infrastructure, database, identity management, email delivery and the Controller's CRM. Booking, account and CRM data, and outgoing email, are processed and stored in the eu-west-3 region (Paris); inbound email to the domain and the Website, with the booking page and the menu, in the eu-west-1 region (Ireland); restaurant websites (section 2 quater), in the eu-west-3 region (Paris); and processing with artificial intelligence models (Amazon Bedrock, section 2 ter) uses inference profiles that only route to AWS regions in the European Union. This data is not stored outside the European Union.
• Amazon CloudFront (AWS): AWS's content delivery network, which serves the public pages (the Website, the booking page, the menu and the restaurants' websites) from the point of presence that is fastest for the visitor. Visitors in the European Union are normally served from Europe, and the restaurants' websites are only served from points of presence in Europe, North America and Israel. Where a visitor connects from outside the European Economic Area, their IP address and request may be processed at a point of presence outside it, solely to serve the page. That transfer relies on the European Commission's adequacy decisions (such as those for the United Kingdom, Switzerland, Canada and Israel, and the EU-US Data Privacy Framework, to which Amazon.com, Inc., including AWS, adheres) and on the standard contractual clauses in the AWS data processing addendum.
• Stripe Payments Europe, Ltd. (Ireland): payment processing and subscription billing, by card or by SEPA Direct Debit. Card data, the bank account number (IBAN) and the SEPA mandate are processed directly by Stripe; taula.ai does not store them in its systems. In addition to the subscription payment, where the restaurant enables booking deposits, Stripe processes the guest's payment data on behalf of the restaurant, which is the seller. taula.ai neither accesses the card details nor receives that money.
• Holded Technologies, S.L. (Spain): the Controller's invoicing and accounting software. It receives the billing data of customers who pay the subscription (name or company name, tax ID, address, email, items and amounts) to handle the Controller's invoicing and accounting. The data is hosted in the European Union.
• Meta Platforms Ireland Ltd. (WhatsApp Business Platform): when the service becomes available and only if the restaurant enables the WhatsApp booking reminder under Notices, to send it to the guest on the restaurant's behalf, as a sub-processor. It receives the guest's phone number, the language of the message, the restaurant's name, the date and time of the booking, its code (or, if it has none, the party size) and the guest's personal link to manage the booking, with which it can be changed or cancelled. Meta returns to taula.ai the message's delivery status and, if the guest replies, the reply: it is not read or stored, and the guest receives, once a day at most, an automatic notice that the number only sends notifications, for which a counter with their phone number is kept for two (2) days. Meta may process this data outside the European Union relying on the EU-US Data Privacy Framework, to which Meta Platforms, Inc. adheres, and on the standard contractual clauses in its data processing terms. Until the service is available, Meta receives no data and reminders are sent by email.
• Google Ireland Ltd.: the Google Places API, when the restaurant looks up its business listing at sign-up or when building its website from the dashboard: it receives only the business name or link that is typed, never guest data or the phone number or email of the person asking. Google Workspace, the Controller's mailbox, where emails to hola@taula.ai and the CRM notices arrive; Google may process this data outside the European Union under the EU-US Data Privacy Framework and standard contractual clauses. And Google Analytics 4 for statistical purposes on the website, and only if the visitor accepts analytics cookies; Google may process this data outside the European Union under the EU-US Data Privacy Framework and, where applicable, the European Commission's standard contractual clauses. The details are in the Cookies Policy.
• Cal.com, Inc. (USA): the calendar where the thirty-minute demo is booked, linked from the Website at cal.com. It only processes data if the user opens the calendar and books a call: their name, email address and whatever they write in it. Transfers to the USA rely on the EU-US Data Privacy Framework and, as a fallback, on standard contractual clauses.

The Controller will ensure that these providers are located in the European Economic Area or, failing that, that they provide adequate safeguards for international transfers in accordance with articles 44 et seq. of the GDPR.

7. Rights of the data subject

The user may exercise the following rights at any time:

• Access to their personal data.
• Rectification of inaccurate or incomplete data.
• Erasure of the data when, among other reasons, it is no longer necessary.
• Objection to processing for reasons related to their particular situation.
• Restriction of processing in the cases provided for by law.
• Portability of the data to another controller, where processing is based on consent or on a contract.
• Withdrawal of consent given, without affecting the lawfulness of the prior processing.
• Not to be subject to automated individual decisions, including profiling, with legal effects.

To exercise these rights, the user may contact the Controller in writing by email at hola@taula.ai, clearly indicating the right they wish to exercise and attaching, where necessary, a copy of their identity document or other means of proving their identity.

If you have not received a reply within one month, or the reply does not satisfy you, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es).

8. Security measures

The Controller has adopted the technical and organisational measures necessary to guarantee the security of personal data and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data and the risks to which it is exposed.

Notwithstanding the above, the user acknowledges that security measures on the internet are not impregnable and that sending information over the network entails certain risks assumed by the user.

9. Accuracy of the data

The user guarantees that the personal data provided is truthful, accurate, complete and up to date, and undertakes to notify any changes. The user will be solely responsible for any direct or indirect damage that may be caused to the Controller or to third parties as a result of providing inaccurate, incomplete or outdated data.

10. Modifications

The Controller reserves the right to modify this Privacy Policy in order to adapt it to legislative or case-law developments or to changes in its activity. Modifications shall take effect from their publication on the Website.