PRIVACY POLICY
Operator: the operator of the TableLink platform, currently CR2 Creative, located at 11642 Victory Blvd, Unit #2050, North Hollywood, CA 91606 ("TableLink," "we," "us," or "our")
Service: TableLink / TableLink.app
Version: v3.0
Last Updated: September 2026
Effective Date: September 2026
This Privacy Policy describes how TableLink collects, uses, shares, and protects information when you visit our website at tablelink.app, sign up for an account, use our reservation, waitlist, and guest-management software services (the "Services"), or otherwise interact with us. The Service is operated by the operator of the TableLink platform (currently CR2 Creative, or its successor entity); throughout this Privacy Policy, "TableLink," "we," "us," and "our" refer to this operator and its successors, assigns, and affiliates. If you have questions about this Privacy Policy, contact us at support@tablelink.app.
TableLink acts in three distinct roles depending on the activity:
- Controller of personal information — when you sign up as a restaurant operator, when you visit our website, when you create a TableLink guest account, when you opt in to SMS notifications, or when you communicate with us directly. This Privacy Policy governs that processing.
- Processor of personal information — when restaurants use TableLink to manage their reservations and process their guests' personal data on the restaurant's behalf. That processing is governed by the Data Processing Addendum executed between TableLink and each restaurant; this Privacy Policy does not govern that processing.
- Limited joint controller — only with respect to the de-identification and aggregation pipeline that produces Aggregated Analytics from cross-restaurant Diner Data, as set forth in DPA Section 2.1. Once data is de-identified, the resulting Aggregated Analytics is no longer Personal Data and is governed by Section 8.3 of the Restaurant Terms of Service.
1. Information we collect
1.1 Information you provide
We collect information you provide directly when you:
- Sign up for a TableLink account (name, email address, restaurant name, phone number, billing address)
- Subscribe to a paid plan (payment information, billing details — payment cards are processed by Stripe and we do not store full card numbers)
- Use the Services (configurations, settings, content you upload)
- Communicate with us (support requests, feedback, survey responses)
- Apply for early-access or join our waitlist
- Receive marketing communications you opt into
1.2 Information collected automatically
When you visit tablelink.app or use the Services, we and our service providers may automatically collect:
- Device and usage data: IP address, browser type, device identifiers, operating system, referring URL, pages viewed, timestamps
- Approximate location: city, region, and country derived from your IP address via our content delivery network (CDN). We do not request precise device location through your browser.
- Cookies and similar technologies: session identifiers, preferences, analytics tokens
- Performance and reliability data: error logs, crash reports
We do not collect Social Security numbers, government identification numbers, financial account numbers, or biometric data through tablelink.app.
1.3 Information from third parties
We may receive information from:
- Outreach lists: business contact information for restaurants we may approach about TableLink, sourced from publicly listed business directories
- Outreach email engagement: when we send a business outreach email, we log opens and link clicks to measure deliverability and to filter automated mail-security and proxy activity out of our engagement metrics. For each open or click we record only derived signals — whether the request came from an automated mail-privacy proxy (such as Apple Mail Privacy Protection) or a datacenter network, a coarse browser family, and a human-vs-automated classification. We do not retain the raw IP address of these engagement events. Basis: legitimate interest (Article 6(1)(f)).
- Sub-processors: information about deliveries, bounces, and engagement from email and SMS providers
- Payment processors: transaction status and basic billing information from Stripe
1.4 Allergies, dietary restrictions, and accessibility requests
We do not consider dietary restrictions, allergies, or accessibility requests to be "protected health information" under HIPAA, but we treat such information with elevated security per our Internal Data Handling Policy. We collect this information only to provide the Services you have requested.
1.5 Diner information (when you book through a TableLink restaurant)
When you book a reservation via a restaurant's TableLink booking page, we collect: name, email address, phone number, party size, occasion tags (e.g., Birthday, Anniversary), special requests, and SMS consent preferences. This data is used to manage the reservation, send transactional communications (email and SMS confirmations and reminders), and maintain guest records for the restaurant.
We also use the phone number you provide at booking to help prevent fraud and abuse: we check that it is a valid, reachable number and compare its region against the location the booking originates from, so a fake or suspicious booking can be flagged or declined before it ties up a table.
Cross-venue fraud prevention. To protect all restaurants on the platform from fake or abandoned bookings, when a restaurant removes a reservation that was never confirmed and that the restaurant was unable to reach by phone, we record a one-way, irreversible cryptographic hash (not the readable value) of the booking phone number, email, and name. We use these hashes only to raise a soft, advisory prompt suggesting a restaurant verify a future booking that reuses the same contact details — it never blocks, declines, or cancels a reservation, and a guest can always book and be seated. The signal reveals no other restaurant's identity and no other booking. It is self-clearing: as soon as the same contact details complete a real visit, the hash is deleted, and in all cases it expires automatically within approximately 18 months. We do not sell or share this information, and we use it solely for fraud and abuse prevention.
Returning-guest recognition (verification records). To recognize returning guests and deter misuse of restaurant booking pages, TableLink maintains a platform-wide internal record of whether a phone number or email address has previously confirmed a reservation on the TableLink platform. This record contains only a one-way hashed (pseudonymized) form of the phone number or email address, plus an indicator that a prior confirmed reservation occurred. It does not include your name, the restaurants you visited, or any reservation details. We use this record only to decide whether an online booking should be confirmed with a one-time code, and we never show it to restaurants. We delete hashed verification records after 6 months without a matching reservation. Because a hashed contact can still be linked back to you, we treat these records as personal data, not anonymous data.
If someone else enters your contact details. If a person making a booking provides your phone number or email address, you may receive a single verification code message by text or email. You will never receive more than one message per request, and we do not send follow-ups. If you did not request it, you can ignore it: no reservation will be made, and no lasting record of your contact details is kept from that attempt.
Deposits and cards on file. Most bookings need no payment card at all. Some restaurants, however, ask for a deposit or for a card to be kept on file as a condition of holding a reservation. Where a restaurant does, you enter your card details directly into a payment form served by Stripe, and the card is charged or saved on that restaurant's own Stripe account. We do not receive or store your card number, its expiry date, or its security code, and we do not store the card brand or the last four digits. What we hold on your reservation is the identifiers Stripe issues for the payment (the customer, payment method, setup intent, payment intent, charge, refund, and dispute identifiers), the amount, the currency, the status, and the times at which the status changed. To make the payment work we send Stripe the name, email address, and telephone number you gave at booking, so that the restaurant's account can identify the payment and send you a receipt. The restaurant, not TableLink, is the merchant of record: its deposit and cancellation policy is its own, and refunds are its to give. See Section 6D of the Restaurant Terms of Service.
Your agreement to a deposit. Before any card details are taken, we show you the exact sentence you are being asked to agree to, and we store that sentence word for word on your reservation, together with a version identifier for the wording, the time you agreed, and the network address and browser user agent from which you agreed. We keep it as the record of what you were told, and we use it only for that purpose and to answer a payment dispute.
Diner data is retained as part of the restaurant's account. Diners may request deletion of their personal data by contacting support@tablelink.app.
1.6 Guest accounts
When diners create a guest account (via Apple Sign-In, Google Sign-In, or email/password), we store: account identifier, name, email, and authentication credentials (managed by AWS Cognito). Guest accounts link reservation history across multiple restaurants on the TableLink platform, allowing guests to view, modify, and cancel reservations from a single portal. Guest account creation is optional. Guests may book reservations without creating an account.
When you create a guest account, you become a TableLink account holder. We process your account information — account identifier, name, email, authentication credentials, saved preferences, and the reservation history visible in your portal — as a Controller under the roles described in the preamble of this Policy. The reservation records themselves remain part of the originating restaurant's account, where the restaurant is the Controller and TableLink is a Processor under the Data Processing Addendum. Deleting your TableLink account does not delete the reservation records held by individual restaurants you booked with. To remove a reservation from a specific restaurant's records, contact that restaurant directly, or email support@tablelink.app and we will route the request.
1.7 Cross-restaurant trust signals (per-individual data, with consent)
If a guest has booked at multiple restaurants using the TableLink platform, restaurants where the guest books may see aggregate trust data tied to that individual guest: total reservation count, reliability score, and number of restaurants visited. This helps restaurants provide better service to returning guests. Restaurants do not see the names of other restaurants the guest has visited, individual reservation details from other restaurants, or any information the guest has not consented to share.
Trust signals are different from Aggregated Analytics (Section 3.3). Trust signals are per-individual data shared between restaurants where the guest has booked, controlled by guest account preference toggles. Aggregated Analytics are de-identified data combined across restaurants and used by TableLink, controlled by the "Do Not Sell or Share My Personal Information" link.
Diners have two independent opt-outs corresponding to these two mechanisms:
- To opt out of trust signals, disable the relevant toggles in your guest account preferences. Disabling controls future sharing only; restaurants where you have already booked retain reservation history per their own privacy practices.
- To opt out of Aggregated Analytics, click Do Not Sell or Share My Personal Information or email support@tablelink.app with the subject "Do Not Sell or Share My Personal Information." This excludes your data from future Aggregated Analytics derivation; analytics already derived remains valid because no individual diner is identifiable in it.
1.8 Portable guest preferences
Guests with accounts may optionally save preferences (dietary restrictions, seating preferences) that can be shared with restaurants they book at. Preference sharing is controlled by the guest through per-category consent toggles. Dietary restrictions are shared only if the guest enables "Share dietary restrictions." Seating preferences are shared only if the guest enables "Share seating preferences." Guests may update or delete their preferences at any time from the My Reservations portal. Deleting a preference immediately removes it from all future restaurant views.
2. How we use your information
We use the information described in Section 1 to:
- provide, operate, and improve the Services
- authenticate you and prevent fraud or abuse
- decide whether an online booking should be confirmed with a one-time code sent to the phone number or email address provided (see "Returning-guest recognition" in Section 1)
- send transactional communications (account confirmations, billing receipts, service notifications, system alerts) — these are not opt-out
- send marketing communications about TableLink products and updates — these you may opt out of at any time
- respond to your inquiries and provide customer support
- maintain account history, preferences, and settings to provide better service over time
- comply with applicable laws, respond to legal process, and enforce our agreements
- conduct internal analytics, including usage patterns and reliability metrics
- analyze a restaurant's own operational data — such as its covers, walk-ins, and waitlist counts — to surface suggestions and timing prompts for that restaurant. This analysis is single-tenant: it draws only on the restaurant's own activity and does not build cross-restaurant profiles of individual guests. Cross-restaurant aggregation is addressed separately in Section 3.3.
2.1 Legal basis for processing (for visitors and customers in the EU/UK)
For individuals subject to the EU/UK General Data Protection Regulation, our legal bases for processing are:
- Performance of a contract (Article 6(1)(b)) — processing necessary to provide the Services
- Legitimate interests (Article 6(1)(f)) — improving the Services, fraud prevention, security, business-to-business marketing
- Consent (Article 6(1)(a)) — for marketing communications you affirmatively opt into
You may withdraw consent at any time without affecting the lawfulness of prior processing.
3. How we share your information
3.1 Service providers
We share information with service providers that operate on our behalf, subject to written contracts that limit their use of the information to providing services to us:
- Amazon Web Services (AWS) — cloud hosting and storage (us-west-1 region, United States)
- Amazon Simple Email Service (Amazon SES) — transactional and marketing email delivery
- Twilio — SMS message delivery (only when you have opted into SMS communications)
- Stripe — payment processing for TableLink's own subscription and SMS billing
- Stripe (Connect) — when a restaurant enables deposits, TableLink acts as a Stripe Connect platform. The diner's card details pass directly from the diner's browser to Stripe, and the deposit is charged on the restaurant's own connected Stripe account under Stripe's terms and the restaurant's own policy. We send Stripe the diner's name, email address, and telephone number so the restaurant's account can identify the payment. We store only Stripe-issued identifiers, never card data.
- Cloudflare — DNS, edge caching, and DDoS protection
- Google Maps Platform (Google LLC) — address autocomplete during signup and admin settings. Google receives the partial text typed into address fields and returns matching place suggestions. Google's processing is governed by Google's Maps Platform Terms of Service and Data Processing and Security Terms.
- Google reCAPTCHA v3 (Google LLC) — bot and abuse prevention on guest booking and SMS-consent flows. Google receives the visitor's IP address, browser and device information, and on-page interaction signals so reCAPTCHA can score the request. The reCAPTCHA script is loaded only on pages that submit reservations or SMS-consent requests; it is not loaded on marketing, help, legal, or account pages. Use of reCAPTCHA is governed by Google's Privacy Policy and Terms of Service.
3.2 Legal disclosures
We may disclose information when we believe in good faith that disclosure is necessary to:
- comply with applicable law, legal process, or government request
- enforce our agreements or investigate potential violations
- protect the rights, property, or safety of TableLink, our customers, or the public
- address fraud, security, or technical issues
3.3 Cross-restaurant analytics (for restaurant customers only)
When restaurants use TableLink, the Restaurant Terms of Service grant TableLink a license to combine diner data across restaurants and derive de-identified, aggregated analytics ("Aggregated Analytics"). This processing applies only to data collected through restaurant accounts and is governed by the Restaurant Terms of Service §8.3 and the Data Processing Addendum. It does not apply to information you provide directly to TableLink as a website visitor or account holder.
Pipeline status as of v2.0 (May 2026): the Aggregated Analytics derivation pipeline is not yet operational. No Diner Data has been included in any Aggregated Analytics output. When the pipeline launches, opt-out requests received prior to that date will be honored against the initial dataset. To submit an opt-out, see Section 1.7.
3.4 Business transfers
If TableLink is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to customary confidentiality protections.
3.5 No sale for monetary consideration
We do not sell your personal information to third parties for monetary consideration. The Aggregated Analytics described in Section 3.3 may constitute "sharing" or "selling" under California law because Aggregated Analytics may be sold or licensed to other restaurants; restaurant customers and diners may opt out of that arrangement as described in the Data Processing Addendum.
4. How we protect your information
We implement reasonable administrative, technical, and physical safeguards designed to protect your information against unauthorized access, loss, misuse, or disclosure. Our security measures include:
- Encryption of data in transit (TLS 1.3) and at rest (AWS KMS-managed keys)
- Role-based access controls limiting employee access to personal information
- Regular security reviews and patching of infrastructure
- Vendor security review for new sub-processors
Additional details are documented in our Internal Data Handling Policy.
No system can be guaranteed completely secure. In the event of a data breach affecting your personal information, we will notify you in accordance with applicable law (within 72 hours of discovery for individuals subject to GDPR, and as required by California and other applicable state laws).
5. Your rights and choices
5.1 California residents (CCPA / CPRA rights)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, share, and sell or share
- Delete personal information we collect from you, subject to certain exceptions
- Correct inaccurate personal information we maintain about you
- Opt out of the sale or sharing of personal information for cross-context behavioral advertising or other "sharing" or "selling" as defined under California law
- Limit the use of sensitive personal information (we do not collect sensitive personal information through the Services)
- Portability — receive your personal information in a portable format
- Non-discrimination — we will not discriminate against you for exercising any of these rights
For purposes of the CCPA's notice requirements: the categories of personal information we collect include identifiers (such as name, phone number, and email address); commercial information, where a restaurant collects a deposit (the Stripe-issued payment identifiers, amount, currency, and status of that deposit, and the record of the agreement described in Section 1.5, but no card numbers or card details); and, for security and fraud prevention, pseudonymized (one-way hashed) contact verification records described in Section 1. We collect and use hashed verification records for the business purposes of security, fraud and abuse prevention, and service functionality. This use is not a sale or sharing of personal information, and hashed verification records are deletable on a verified request as described above.
We will respond to verifiable consumer requests within 45 days, with a one-time extension of up to 45 additional days where reasonably necessary.
5.2 EU/UK residents (GDPR / UK GDPR rights)
If you are subject to GDPR or UK GDPR, you have the right to:
- Access the personal information we process about you
- Rectify inaccurate or incomplete personal information
- Erase personal information ("right to be forgotten")
- Restrict processing in certain circumstances
- Portability — receive your data in a structured, commonly used format
- Object to processing based on legitimate interests or for direct marketing
- Lodge a complaint with your local supervisory authority
We will respond to GDPR requests within one month, with a possible two-month extension for complex or numerous requests; we will inform you of any extension within the initial month.
5.3 How to exercise your rights
To exercise any of these rights:
- Email us at support@tablelink.app with the subject line "Privacy Request" and a description of your request
- For California "Do Not Sell or Share" requests, email support@tablelink.app or use any opt-out link provided in our marketing communications
- We may need to verify your identity before responding
We respond to privacy requests received through any channel (email, phone, in-person) within statutory deadlines, regardless of subject-line format. The subject-line method is provided for your convenience to expedite routing, not as a precondition.
You may designate an authorized agent to exercise these rights on your behalf, subject to verification.
5A. SMS Communications
If a diner opts in to SMS notifications, we send transactional messages on the restaurant's behalf: reservation confirmations, reminders (24 hours and 2 hours before the reservation), and waitlist notifications. Messages are sent via third-party messaging providers (currently Twilio).
Message frequency varies. Standard message and data rates may apply. Because all participating restaurants share a single messaging number, a diner may reply 9 to stop messages from one restaurant while continuing to receive messages about reservations at other restaurants, or reply STOPALL (or STOP) to stop messages from every restaurant on the platform. Reply HELP for help. Consent to receive SMS is not required to make a reservation.
We do not send marketing SMS to diners. SMS opt-in data and consent are not shared with third parties for their marketing purposes.
5A.1 SMS data retention
- Message content retained for 90 days to support operational use, then permanently deleted
- SMS metadata (date, time, direction, message type — excluding message content) retained for up to 5 years for legal compliance and audit
- Consent records (date, method, and disclosure version) retained for 5 years as required by federal telecommunications law (TCPA)
- Opt-out records retained for 10 years as required by state telecommunications regulations, even after a deletion request
5A.2 CCPA and SMS data deletion
Upon a verified deletion request, we will delete SMS message content and de-identify metadata records. We retain consent records and opt-out records as permitted under the legal-obligation exception of the CCPA (Cal. Civ. Code §1798.105(d)(8)).
5B. Guest account rights
Guest account holders may:
- View all reservations across TableLink restaurants
- Modify or cancel upcoming reservations
- Update or delete portable preferences
- Delete their guest account and all associated data
To delete a guest account and all data, contact support@tablelink.app or use the account deletion option in the My Reservations portal. Deletion is processed within 30 days.
5C. AI agents and the MCP-based platform interface
TableLink operates a Model Context Protocol (MCP) server at mcp.tablelink.app/mcp that lets AI assistants and agentic applications — for example, ChatGPT, Claude, and other clients that implement MCP — look up restaurants on the TableLink platform, check real-time availability, book reservations, and cancel reservations on behalf of their users. Read operations (search_restaurants and get_availability) are anonymous. Write operations (book_reservation and cancel_reservation) require the user to authenticate through TableLink's OAuth flow first; an unauthenticated agent cannot create or cancel a reservation.
5C.1 Information exchanged through the MCP server
When an AI agent calls the MCP server on behalf of a user, we receive:
- the agent's request payload (such as a city or restaurant name, a date, and a party size);
- standard request metadata (IP address, user-agent string, and timestamps); and
- an opaque session or request identifier supplied by the agent provider, if present.
We do not receive the content of the user's conversation with the agent, the user's name, or any account credentials the user holds with the agent provider, except to the extent the user includes that information in the search query itself.
We return to the agent only information that is already publicly available on the corresponding restaurant's TableLink booking page: restaurant name, address, cuisine, hours, available time slots, and party-size capacity. The MCP server does not expose diner records, past-reservation history, guest-account information, or restaurant-internal data.
5C.2 Authorization for write operations
Booking and cancellation through the MCP server require the user to complete an OAuth handshake with TableLink's authorization server at auth.mcp.tablelink.app. The handshake uses OAuth 2.1 with PKCE (RFC 7636), Dynamic Client Registration (RFC 7591), and audience-bound resource indicators (RFC 8707). During the handshake the user signs in through TableLink's existing guest-account login (email, Sign in with Google, or Sign in with Apple) — the same accounts and sign-in flow used on tablelink.app. The agent receives a short-lived access token bound to the user's TableLink guest account; it does not see the user's password or sign-in credentials.
When an agent uses an access token to call book_reservation, the data we receive is the same data the user would enter on a TableLink booking page: name, phone number, optional email, party size, date, time, optional special requests, optional occasion, and an SMS-opt-in preference. The resulting reservation is linked to the user's TableLink guest account so it appears in the My Reservations portal alongside reservations the user makes on the website. cancel_reservation takes only the confirmation token returned by book_reservation.
5C.3 Relationship with the agent provider
The AI agent or assistant a user interacts with is operated by its own provider (for example, OpenAI for ChatGPT or Anthropic for Claude). That provider's processing of the user's conversation, account, and any information shared with the provider is governed by that provider's privacy policy, not this one. TableLink does not control, and is not responsible for, the agent provider's collection, retention, or use of those interactions.
5C.4 Logs, retention, and deletion
We retain MCP request and response logs for 30 days for security, abuse-prevention, and reliability purposes, after which the logs are deleted. Aggregate request counts (without payloads) may be retained longer for capacity planning.
The rights described in Section 5 apply to information we receive through the MCP server. MCP requests do not include account credentials or identifying information about the underlying user. To submit a deletion request, contact support@tablelink.app and describe the approximate timeframe and the agent provider used so we can locate the relevant records.
6. Data retention
We retain personal information for the period necessary to provide the Services and as required by law:
- Active account data: retained for the duration of your relationship with TableLink, plus 90 days following account closure
- Billing records: retained for 7 years to comply with tax and accounting requirements
- Marketing contact records: retained until you unsubscribe, plus 24 months for suppression-list integrity (so that we do not accidentally re-contact you)
- Support communications: 24 months
- Guest verification records (hashed contact indicators): deleted after 6 months without a matching confirmed reservation
- Pending verification challenge data (the booking details and contact information held while a verification code is outstanding): the code expires within 15 minutes and the held details are deleted within 30 minutes of the attempt
- Outreach lead records: 36 months from the most recent contact, then de-identified
- Aggregated Analytics: retained indefinitely in de-identified form. Aggregated Analytics is de-identified using methods designed to make re-identification not reasonably possible.
- Deposit consent record (the sentence you agreed to, its version identifier, the time, and the network address and user agent): held on the reservation record and retained for as long as that reservation record is retained under Section 6A, so that it remains available for the period in which a payment dispute may be raised
- Deposit activity log: the deposit activity list shown to a restaurant covers the preceding 30 days and is built from records that are deleted automatically 90 days after they are written. It is an operational view, not a permanent record, and it is not the consent record described above
- Backups: retained for 35 days, after which they are overwritten
6A. Data retention after restaurant cancellation
When a Restaurant's subscription ends, we retain all associated data for 90 days from the effective end date to allow for resubscription or data export requests. After 90 days, data is permanently deleted or anonymized. Backups containing deleted data may persist for up to an additional 30 days as part of standard disaster recovery procedures, after which they will also be purged. Restaurants may request early deletion or a data export by contacting support@tablelink.app.
We may retain information longer where required by law, to resolve disputes, to enforce our agreements, or to defend against legal claims.
7. Children's privacy
The Services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, contact us at support@tablelink.app and we will delete it without undue delay. If we discover that we have collected personal information from a child under 13 without verified parental consent, we will delete the information from our records.
8. International transfers
Your personal information is processed in the United States. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data transfer restrictions, we rely on the European Commission's 2021 Standard Contractual Clauses (Module 2: controller-to-processor) where applicable as the lawful mechanism for the cross-border transfer of personal information. A copy of the applicable Standard Contractual Clauses is available on request to support@tablelink.app.
9. Cookies and tracking technologies
We use cookies and similar technologies for:
- Strictly necessary purposes (session management, authentication) — these cannot be disabled
- Analytics purposes (aggregated traffic measurement) — you may opt out via your browser's "Do Not Track" signal, which we will honor as a request to limit non-essential tracking
- Bot and abuse prevention purposes — Google reCAPTCHA may set first-party cookies when you load the booking or SMS-consent flows. These cookies are used by reCAPTCHA to score requests and are not used for advertising or profiling. See §3.1 for details on reCAPTCHA's data handling.
We do not use third-party advertising cookies on tablelink.app.
10. Marketing communications
If you opt in to marketing communications, you may unsubscribe at any time:
Unsubscribing from marketing communications does not affect transactional communications related to your account or services you have requested.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. For material changes, we will notify you by email and by posting a prominent notice on tablelink.app at least 30 days before the changes take effect. The "Last Updated" date at the top of this Privacy Policy reflects the most recent revision. Continued use of the Services after the effective date of a change constitutes acceptance of the revised Privacy Policy.
12. Contact us
For privacy-related questions, requests, or complaints:
- Email: support@tablelink.app
- Mail: CR2 Creative, 11642 Victory Blvd, Unit #2050, North Hollywood, CA 91606
If you are an EU/UK resident, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu.
If you are a California resident, you may file a complaint with the California Attorney General at oag.ca.gov/contact/consumer-complaint-against-business-or-company.
Note for restaurants using TableLink
If you are a restaurant using TableLink to manage reservations, your relationship with your diners is governed by your own privacy policy with them. TableLink provides a template privacy policy for restaurants to adopt with their diners — separate from this Privacy Policy. Contact support@tablelink.app to request the template.