Privacy policy

Updated 5 November 2026.

Who we are

Tables & Floors is operated by Tables & Floors Limited (company number 17535128), of 50 Princes Street, Ipswich, Suffolk IP1 1RJ ("we"). For anything about personal data, email support@tablesandfloors.com.

Two kinds of data, two roles

We handle personal data in two roles. For the accounts, billing and support of the restaurants that subscribe, we are the controller: we decide what is collected and why. For the reservations, guest names and contact details that a restaurant records or receives through its booking form, the restaurant is the controller and we are its processor: we hold and process that data only on the restaurant's instructions, under the data-processing terms in our terms of service. Guests should direct questions about their booking data to the restaurant they booked with.

This website

The pages at tablesandfloors.com (/home, /features, /pricing, /privacy, /terms and the guides under /guides) set no cookies and load no analytics or advertising scripts. Our hosting provider records standard server logs (IP address, requested page, browser type and time) for security and to keep the service running, and the application records request timings and errors in Microsoft Azure Application Insights for the same reason. Logs and telemetry are kept for 90 days. If you email us, we keep the correspondence for as long as we need it to answer you and to keep a record of the enquiry.

Restaurant accounts and billing

When a restaurant subscribes we process, as controller:

• the owner's name, email address and password (stored as a hash);
• the business name, venue name, venue address and time zone;
• staff accounts, with name and email address;
• billing details: the billing name and address, the country the business declares, its tax number if it gives one (for a US business, its legal name and EIN), the subscription state and invoice history. Card details are entered on, and stored by, our payment provider, Stripe; we never see the card number;
• support correspondence.

We use this data to provide the service, to bill for it and to answer support requests, on the basis that it is necessary to perform our contract with the restaurant and, for records we are obliged to keep, to comply with the law. When a subscription ends, we delete its staff accounts six months later, so that a restaurant that rejoins can carry on where it left off. We keep the business's account details (the business and venue names, the owner's name and email address, and the subscription history) and its billing records for six years: billing records because tax law requires it, and account details in our legitimate interest in keeping a record of our customers and handling any later query or dispute.

Reservations and guests

As processor for each restaurant we hold:

• for every reservation: the guest's name, party size, date and time, any notes staff or the guest added, and the table assigned;
• for bookings made online: the guest's phone number and email address, and a private link that lets the guest change or cancel the booking;
• an audit trail of who created or changed each reservation and when.

Booking notes can contain health information that a guest chooses to give, such as an allergy or an accessibility need. This is special category data under the UK GDPR. We handle it like the rest of the booking: only so the restaurant can prepare for the visit, shown only to that restaurant's staff, and to our support staff when the restaurant asks us to add or correct its bookings, never included in booking emails, and removed with the guest's other details under the rules below. When a guest adds notes online, the booking form asks for their explicit consent to the restaurant using any health details in them, and we record when it was given. The restaurant decides whether to ask for this information and is responsible for having a lawful condition to use it.

We use this data only to run the restaurant's reservations and to send the guest the confirmation, change and cancellation emails the restaurant has asked us to send. We do not use guest data for marketing and never sell it; it is disclosed only to the providers named below, to deliver the service. How long a restaurant keeps its reservation history is the restaurant's decision: we delete or anonymise guest details when the restaurant asks us to. Six months after the end of its subscription we delete its guests' personal data, or anonymise it so that no guest can be identified. The restaurant can ask for an export of its bookings within 30 days of the end of its subscription. Deleting or anonymising a guest's details includes their booking notes. Database backups are deleted after 30 days, and copies of booking emails held by Resend expire under its own retention period unless we ask it to remove them sooner.

A restaurant that joins can email us an export of its upcoming bookings from its previous system, and we add them for it. We use the file only for that, add only the details its service needs, and keep it apart from ordinary support emails: we delete the email, its attachment and any copy we made once the restaurant confirms its bookings are in, or 30 days after it arrived, whichever comes first.

Where data is processed and who helps us

• The application runs on Microsoft Azure in the United Kingdom: the website and the reservation app in UK West, and background work, such as sending booking emails, in UK South (London). The database is provided by Neon and held in London, on Amazon Web Services.
• Booking emails to guests, and our emails about a restaurant's account to its owner and to ourselves, are sent through Resend, from its European region in Ireland. Resend stores the emails it sends, and their delivery records, in the United States.
• Our email addresses (support@ and sales@) are hosted by IONOS, which holds the emails you send us, including any booking files sent to us to import, in its data centres in the European Union.
• Subscription payments are taken by Stripe, which is the controller of the card data it collects; see Stripe's own privacy policy.
• Request telemetry is held in Microsoft Azure Application Insights in the United Kingdom (UK West).

Where a provider processes data outside the United Kingdom, we rely on an adequacy decision (which covers Ireland and the rest of the European Economic Area), the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, as applicable.

Security

Every connection uses HTTPS. Each restaurant's data is separated from every other restaurant's in the database and in the application. Staff passwords are stored as salted hashes, and sign-in is rate limited and locks after repeated failures.

Your rights

Under the UK GDPR you can ask for a copy of the personal data we hold about you, ask us to correct or delete it, object to or restrict its processing, and complain to the Information Commissioner's Office (ico.org.uk). Email support@tablesandfloors.com. If you are a restaurant's guest, the restaurant is the controller of your booking data, so please ask the restaurant; we will help it respond.

Changes

We will post changes to this policy here, with the date, and tell subscribing restaurants by email about any change that affects how their or their guests' data is handled.