Privacy Policy

We collect the following categories of information, and only what each step needs:

• What you give us.When you join the beta: your restaurant's name (or its Google Maps link) and your email. When you try a free sample week: your restaurant's name, website, menu text or menu link, and an email if you choose to add one. Later, if you give them to us: your name, phone number, brand voice, signature dishes, colors, logo, photos and videos, and the answers you send us.
• Public information about your restaurant.To draft posts about your real place, we read your public website and menu, and your restaurant's public Google listing (name, address, hours, website, rating and public reviews) through Google's Places service. Public reviews can include reviewers' first names; we never put a reviewer's name in a post we draft for you.
• Your activity in the service. The drafts we make for you, which ones you approve, skip or mark as posted, review replies you approve, and replies to our emails.
• Support requests. The topic and description you submit, your account reference, diagnostic guidance, request status and check timestamps. We store these with your account to investigate problems and follow up. Our team can review them. Do not include passwords or payment-card details. Support text and private portal URLs are excluded from marketing analytics.
• Connected accounts (only if you connect them). If you connect Instagram, Facebook or Google, we receive access tokens that let us read basic account details and publish the posts you approve. Tokens are stored encrypted.
• Payment information (only on a paid plan). Billing is processed by Stripe. We receive limited billing details (such as card brand, last four digits and status). We never receive or store your full card number. There is no card on file during the free beta.
• Usage and device data.Pages viewed, clicks, approximate location from IP address, browser and device type, and timestamps, collected by our analytics provider (PostHog) using a cookie and local storage, plus security signals from Cloudflare's bot check on our forms.

We do not collect Social Security numbers, card numbers, or other sensitive personal information. The service is for businesses, not consumers or children.

We use information to:

• Provide, operate, and improve the Service.
• Draft content, run approved campaigns, and publish items you approve to your connected accounts.
• Measure how your marketing is performing and produce your reporting.
• Process payments and manage your subscription or engagement.
• Communicate with you about your account, drafts awaiting approval, results, and service updates.
• Secure the Service, prevent abuse, and comply with law.

These companies process data on our behalf, only as needed to run the service:

• Vercel: hosts the website and app.
• Supabase: database and file storage (including encrypted tokens).
• Resend: sends our emails to you.
• Cloudflare: the bot check (Turnstile) on our public forms.
• PostHog: website analytics (pages viewed and clicks).
• Google (Places): looks up your restaurant's public listing.
• Yelp: looks up public reviews of your restaurant, where available.
• ntfy: sends our team a phone notification when a restaurant signs up.
• Stripe: billing, only on a paid plan.
• Meta (Instagram, Facebook), Google Business Profile and Upload-Post: only if you connect an account, to publish the posts you approve.

Each provider handles data under its own privacy terms. We share only what each one needs.

We disclose information only: to the processors above; with your direction (for example, to publish to your connected accounts); to professional advisors under confidentiality; in connection with a merger, acquisition, or sale of assets (with continued protection); or when required by law or to protect rights, safety, and the integrity of the Service.

We keep your account information, brand details, drafts and approvals while you use the service and for up to 12 months after you stop, unless you ask us to delete them sooner. Beta sign-ups and sample-week entries that never become an account are kept for up to 12 months after our last contact. Billing records are kept as long as tax law requires. Connected-account tokens are deleted or invalidated when you disconnect or leave. We may keep aggregated or de-identified data that does not identify you.

We use reasonable administrative, technical, and physical safeguards to protect your information, including encryption of stored OAuth tokens, access controls, and reliance on reputable infrastructure providers. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security; you connect accounts and provide data at your own risk, and you should keep your own credentials safe.

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you rights regarding your personal information. Subject to legal limits, you may:

• Know / access the categories and specific pieces of personal information we have collected about you, and how we use and disclose it.
• Delete personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of any sale or sharing of personal information — note that we do not sell or share it.
• Limit use of sensitive personal information to what is necessary to provide the Service.
• Non-discrimination — we will not treat you differently for exercising your rights.

To exercise these rights, reply to any email you have received from Full Table, or call us at (530) 523-0211. We will verify your request and respond within 45 days. You may use an authorized agent.

Where data-protection laws such as the GDPR or UK GDPR apply, we process personal data on these legal bases: performance of a contract (to provide the Service you signed up for), legitimate interests (to secure and improve the Service), consent (for example, when you connect an account or opt into communications), and legal obligation. Subject to those laws, you have the right to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority. Where we transfer data internationally, we rely on appropriate safeguards. For these requests, call (530) 523-0211 or use our contact page.

We use a few cookies and similar technologies: ones the site needs to work and to block bots (Cloudflare), and analytics (PostHog) that tell us which pages are used. We do not use advertising cookies or let ad networks track you on our site, and we do not sell or share data for cross-context behavioral advertising. You can block or delete cookies in your browser.

Do Not Track: our site does not respond differently to browser Do Not Track signals. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of any sale or sharing of your information (we do neither).

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

For privacy questions or requests, reply to any email you have received from Full Table, or call us at (530) 523-0211. Full Table Co., Sacramento, California.