Privacy notice

Last updated 25 October 2026

TableTango is a reservation service for independent UK restaurants, operated by TableTango Ltd, a company registered in England & Wales (company no. 17287615) whose registered office is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. For the personal data we control — your account details and any enquiries you send us — TableTango Ltd is the data controller, and we are registered with the UK Information Commissioner’s Office (ICO), registration reference ZC178111. This page explains, in plain English, what personal information passes through TableTango, why, and what your rights are. Questions or requests: hello@tabletango.co.uk.

The short version

We collect what a booking needs — your name, a way to reach you (a phone number and/or an email address), party size, date and time — and use it to make, manage and remind you about that booking. If the restaurant holds a card to secure your table, Stripe collects the card itself — we never see the full number — and we keep only the record needed to run and account for that hold.
We never sell your personal data, and TableTango never uses it to market to you. A restaurant may ask, when you book, whether you would like their news and offers by email or text — both boxes start empty, either or neither is fine, your booking is unaffected either way, and you can change your mind at any time from the ‘News & offers preferences’ link in your booking confirmation and reminder emails or on the booking page straight after you book, or by asking the restaurant. Unless you choose that, the messages a restaurant sends through us are about your booking (confirmation, reminder, waitlist and cancellation) and, after a visit you actually had, one short message asking how it went. We tell you about that one when you book, and you can decline there and then. It offers two things side by side: a private reply that goes only to that restaurant, and an optional public Google review. Neither is required, both are offered to every guest whatever they thought (a review link is never hidden behind a good rating), nothing is ever published on your behalf, and every such message has a link to stop them — open it, tap ‘Stop feedback requests’, and that restaurant won’t send another. The Google link goes through tabletango.co.uk first, so the restaurant can see how many guests opened it. We keep only the date it was first opened (an automatic link check by your email or phone provider can count too), never whether you went on to leave a review. We show the restaurant a monthly total, not a list of which guests opened the link. That date is deleted with the feedback record. A restaurant can switch post-visit messages on or off. If it enables them, only guests who were told at the time of booking and did not decline can receive one.
Essential storage supports things like restaurant logins and your cookie choices. Optional Google Ads measurement for restaurant signups runs only after you accept it on our restaurant information pages; rejecting it does not affect signup or the service. It is separate from a restaurant's guest marketing choices. Booking pages embed no third-party maps or trackers that load automatically: your browser makes no connection to Google (or any other third party) just from viewing a booking page. A “Get directions” link is provided, and it only contacts Google if you choose to click it (details below).
Ordinary table-booking recovery. For an ordinary table booking made through the form, the booking page saves a reference to the restaurant and the booking attempt in your browser so it can check the result after an interrupted request. New recovery records do not contain your name, contact details or special requests. If the outcome is uncertain, the page keeps the same attempt reference while it checks, rather than treating a timeout as a new booking. An older version of the page may have left more detailed recovery information in the browser; the new version does not automatically remove every older copy.

What we collect, and why

When you book a table — your name, a phone number (mobile or landline) and/or an email address, party size, date and time, and any notes you add (like "birthday" or dietary needs). We need a way to reach you about the booking. Online bookings require an email address for your booking confirmation and booking updates, including reminders where enabled. Most restaurants also require a mobile number. Trehellas House Hotel & Restaurant accepts a landline instead, or an email address without a phone number for ordinary table bookings; its event bookings still require a phone number. Restaurants may also record a landline when taking a booking themselves. Where the restaurant has text messages switched on, you may also get those by text on the mobile number you gave. Used to create and manage the reservation, assign your table, and send your confirmation and a reminder. Legal basis: taking steps you've asked for (contract), and the restaurant's legitimate interest in reducing no-shows.
When you chat with the booking assistant — your messages and the restaurant information needed to answer them are processed by our AI provider, Anthropic, so the assistant can help you book or manage a booking. Please avoid putting allergy, dietary, medical or other sensitive details in the chat: anything you type there may be processed by the provider. Use the Special requests field on the booking form or confirmation card for a note to the restaurant, or contact the restaurant directly. That field is saved with your booking and is not sent to the AI assistant. Conversations are not used to train AI models, and we don't keep chat transcripts on our servers after the conversation.
When the restaurant uses its AI assistant — the owner assistant uses Anthropic to answer questions about the restaurant's bookings. Its automatic booking reads send selected operational details, such as party size, date, time, status and a predefined occasion category. Answers about individual bookings may include the guest's name; automatic briefings omit it. These automatic reads exclude booking notes, standing guest requirements and custom occasion text. Feedback reads use ratings and dates, not guests' written comments. Questions, conversation history and any restaurant memory supplied to the assistant may also be processed by Anthropic, so restaurant users should avoid including sensitive guest details. This data is not used to train AI models.
When a restaurant signs up — the owner's email address and login, used to run their dashboard. Legal basis: contract.
Restaurant account security — we use the account email address and verification phone number to protect restaurant accounts. Verification records contain a hashed code, its purpose, expiry and delivery status; we do not store the readable code. Verification challenges, including the phone number they relate to, are removed 30 days after expiry. Short-term sending records and their IP address are removed after 24 hours. Records of forgotten devices and security checks are removed after 30 days. Scheduled cleanup normally runs every 15 minutes. Your active verification phone number remains with your account while it is needed for two-step verification. We also send account-security notifications, such as changes to two-step verification or repeated unsuccessful code attempts. These go to the confirmed account email address held when the event happened, even if the login email changes afterwards. The security-notification queue contains that address, the event time and delivery status, and is removed after 30 days. We use these records to protect accounts and investigate delivery or abuse problems, not for marketing. Legal basis: legitimate interests (keeping restaurant accounts secure).
Text messages (where the restaurant has text messages switched on) — the number, message text and delivery status of each text we send (for example a confirmation, reminder, waitlist offer, cancellation, card request or after-visit feedback request) are logged so the restaurant can see what was sent.
When a restaurant secures your booking with a card (the No-show Shield, where that restaurant has switched it on) — the card itself is collected by Stripe into the restaurant's own Stripe account: your full card number and security code never reach TableTango's servers and we never store them. To set the hold up we send your name, phone number and email address to that restaurant's Stripe account, so Stripe can hold the card against a customer record for your booking. What we keep is the record needed to run and account for the hold — Stripe's own references for the checkout session, the customer, the saved card and any payment; the card's brand and last four digits; when you agreed and the fee policy in force at that moment; the status of the hold or fee; any amount charged or refunded; and whether a payment was disputed. Legal basis: contract, and the restaurant's legitimate interest in charging a no-show fee you agreed to.
Restaurant referrals — if a restaurant signs up using another restaurant's referral link or code, we record the referral and check it against our own records — for example whether the accounts share an owner or phone number, or whether the signup email is already on our prospect list, even if we have not contacted that restaurant — to decide whether a reward is due and to prevent misuse.
When you email us, or reply to a message we sent — we use your details to reply. An AI service (Anthropic) reads the email to sort it and, where a reply is needed, to draft one for us to check. Our record of that sorting keeps the sender and subject for 90 days. If you are a restaurant replying to an email we sent you about TableTango, we also keep how the AI sorted your reply, a short AI summary of it and its first 240 characters with our record of your restaurant, until you ask us to delete them. Legal basis: legitimate interests.
Security & abuse prevention — when you use a booking page we briefly process your device's IP address to rate-limit requests and prevent abuse and fraud. Legal basis: legitimate interests (keeping the service secure and available).

Optional advertising measurement

With your separate consent, we use Google Ads to understand whether our advertising leads to a new restaurant signing up. We only ask visitors who arrive by clicking one of our Google ads; if you did not, we do not ask and nothing is measured, although anyone can still make a choice with the Cookie settings control. The Google tag may load on our home, comparison, support and switching-from-Quandoo pages, and on a separate signup confirmation page. It does not load on guest booking pages, the demo, sign-in forms or inside the restaurant workspace. We count a signup only after the server confirms that a new restaurant was created and its terms acceptance was saved. A visit, login or trial page view is not a signup.

Google receives advertising click and cookie identifiers, basic browser/network information (including your IP address), and an opaque signup-event reference used to avoid duplicate counting. We do not supply names, email addresses, phone numbers, booking details or authentication details in the measurement event, and we do not enable enhanced conversions or personalised advertising. The legal basis for this optional measurement and its storage is consent. No Google advertising tag loads, and no advertising receipt is stored, before you accept.

We remember your accept or reject choice in first-party browser storage for up to six months. When you arrive from one of our ads, we also note just that fact (not the ad click identifier) in this browser tab’s session storage, so we can ask you again if you go on to sign up; it is cleared when the tab is closed. Consented Google advertising cookies (with names beginning _gcl_) link an ad click to a signup; we limit their configured duration to 90 days. A first-party signup receipt is valid for up to ten minutes and is removed when it is consumed or next checked after expiry. It contains an opaque random event reference and the restaurant reference needed to match the successful creation; the restaurant reference is not sent to Google. Browser storage restrictions and refusal mean some signups cannot be attributed to an ad.

You can at any time, or use the Cookie settings control on those information pages. Rejecting or withdrawing consent stops future measurement and clears the advertising cookies and receipts we can access on this site. Withdrawal does not undo processing that already took place; for questions or a data-rights request, contact hello@tabletango.co.uk. Google's handling of advertising data, including international processing, is explained in its privacy policy and information about sites that use its services.

Who helps us run TableTango

Like nearly every online service, we use a small number of specialist providers, each handling only what their job requires: Supabase (our booking database, hosted in London, UK), Netlify (website hosting), Anthropic (AI processing for the booking chat, the restaurant's owner assistant, and sorting and drafting replies to emails sent to us), The SMS Works (UK-based, sending text messages), Zoho Mail / ZeptoMail (EU-hosted — our mailbox, and the Zoho service that sends your booking confirmations and account emails), Stripe (payment processing — our subscription billing; holding a guest's card for the No-show Shield at restaurants that have it switched on; and, where a restaurant has deposits, prepayments or booking add-ons switched on, collecting and settling those — with the restaurant as merchant of record on its own Stripe account), and Bouncer (email-deliverability checks for our own outreach to restaurants). Where one of these providers processes data outside the UK (for example in the United States), the transfer is covered by UK-approved safeguards such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

Our email provider, ZeptoMail (part of Zoho), keeps a delivery record of each email it sends for us and, for up to 60 days, a copy of the email itself. Postmark receives reports from email providers about mail sent in our name, which we use to spot forgeries; the reports contain sending details, not message contents. Operational alerts reach our phone through a push service, ntfy. They can include details of a restaurant or its team, such as a name or email address, or a short summary of a restaurant's reply to us. They do not include a guest's name or contact details, or the sender or subject line of an email sent to us. We are still confirming the data-protection terms, and the basis for any transfer outside the UK, for Postmark and ntfy.

Restaurant booking pages show the restaurant's address as text only — they do not embed a Google Maps view or any other third-party content that loads with the page, so your browser makes no connection to Google (or any other third party) just from viewing a booking page. We provide a “Get directions” link, which is an ordinary link that contacts Google only after you click it — at which point Google's own privacy policy applies.

How long we keep things

We don't keep personal booking data forever. A booking is kept while the restaurant uses TableTango so it has an accurate history, but 24 months after the booking date we automatically anonymise the personal details (name, phone, email, notes and occasion) — the restaurant keeps the anonymous record for its statistics, but the personal information is removed. Text and email logs, and unused waitlist and feedback records, are automatically deleted after 24 months. On request, or when the restaurant leaves, your identifying details go, and so does the card information we display (its brand and last four digits). Two things deliberately do not go at that moment: a limited set of payment references, so a payment can still be settled, refunded, reconciled or defended if it is disputed; and, only while a fee you agreed to could still be charged, the reference to your saved card — the service needs that reference to make the agreed no-show charge if the restaurant marks the booking as a no-show. Asking Stripe to delete the customer record it holds for you is a separate step that stays open until Stripe confirms it, so it is not always immediate. The 24-month anonymisation above clears most of those payment references too, though the reference to a fee checkout and to any refund currently remain. Account details are kept until the account closes. Our demo restaurant's data is reset periodically.

If one of our booking, feedback or restaurant-notification emails bounces because the address does not work, or you mark one as spam or ask us to stop, we add the address to a do-not-email list so that we do not send booking or feedback emails, or restaurant notifications, to it again. We keep that list for as long as we run the service.

Booked through a restaurant?

When you book at a restaurant that uses TableTango, your booking belongs to that restaurant — we process it on their behalf and on their instructions. The messages a restaurant sends through us are about your booking (confirmation, reminder, waitlist and cancellation) unless you have separately chosen to receive that restaurant's news and offers — a choice you make yourself when booking, and can withdraw at any time from the ‘News & offers preferences’ link in your booking confirmation and reminder emails or on the booking page straight after you book, or by asking the restaurant; plus the single post-visit message described above, which you are told about when you book and can decline then, or stop later from the link it carries. A review is never invited by a marketing text, and the Google review link is never gated — the same link for every guest, whatever they said. For anything about how a restaurant itself uses your details, contact the restaurant directly; we'll always help them honour your requests.

Your rights

UK law gives you rights over your personal data: to ask for a copy, have it corrected or deleted, object to or restrict how it's used, and ask for it in a portable format. For the data TableTango controls — your account details and any enquiries you send us — email hello@tabletango.co.uk and we'll respond within a month. For a booking you made at a restaurant, that restaurant is the controller of your data, so please contact them — though you're welcome to email us too and we'll pass your request on and help them honour it. If you're unhappy with how we've handled something, you can complain to the UK's regulator, the Information Commissioner's Office, at ico.org.uk.

Changes

If this notice changes meaningfully, we'll update the date at the top and, for significant changes, say so on the website.