Skip to content
MyTable

This is a plain-English draft. It has not yet been reviewed by a solicitor.

Privacy policy

Last updated 15 September 2026

This policy explains what personal data MyTable collects, why, and what you can do about it. It covers guests who order through MyTable and the people who run restaurants on it. We handle personal data under the UK GDPR and the Data Protection Act 2018.

About us

MyTable (mytable.page) is operated by the site owner. In this policy "MyTable", "we" and "us" mean the operator.

Operator details: [to be completed]

What we collect if you are a guest

  • What you order, which table and venue it is for, and the payment status.
  • Stripe references for your payment and for any card you save. We never hold full card numbers.
  • A name, email address or phone number, if you give one for a receipt.
  • Whether you have agreed to marketing emails.
  • A session identifier stored on your device, so your basket and orders stay with you.
  • Your IP address and browser details, kept in security and audit logs.
  • An allergen profile, only if you create an account and explicitly consent to it. See below.

What we collect if you run a restaurant

  • Your contact details.
  • The names and email addresses of staff you invite.
  • Your Stripe account identifiers.
  • Your menus, and the audit record of changes made in your account.

Why we use it

We rely on four lawful bases:

  • Contract: taking and fulfilling orders, and running a restaurant's account.
  • Legal obligation: keeping tax, audit and food safety records.
  • Legitimate interests: keeping the service secure, preventing fraud, and sending service emails such as receipts and sign-in links.
  • Consent: your allergen profile, marketing emails and advertising cookies. You can withdraw consent at any time.

Your allergen profile

Information about your allergies is health data, which the law treats as a special category. We store it only if you create an account and explicitly ask us to, so that menus can flag dishes for you. You can delete it at any time from your account, and it is deleted with your account if you close it.

Who we share it with

The restaurant you order from sees your order, your table and the payment status so it can serve you and handle any refund. We also use these providers to run the service:

  • Stripe, for payments and for identity checks on restaurants.
  • Appwrite, for our database and sign-in, hosted on infrastructure we operate.
  • Plunk and cMailer, for transactional email such as receipts and sign-in links.
  • Coolify and our hosting provider, for the servers the service runs on.

Where it is stored

We store data in the UK or EU where possible. Stripe may transfer data internationally under its own safeguards.

How long we keep it

  • Order and payment records: for as long as tax and dispute rules need them, which is at least six years for financial records.
  • Anonymous guest sessions that never placed an order: deleted routinely.
  • Allergen profiles: deleted when you delete them or close your account.

Cookies

On restaurants' ordering pages (their address ending in .mytable.page, or their own domain) we use only what is strictly necessary: a first-party session cookie, and local storage on your device for your basket. There are no advertising cookies on those pages.

On the mytable.page marketing pages, and only if you accept them, we set Google Ads conversion measurement cookies so we can tell whether our advertising works. If you do not accept, they are not set.

Your rights

You can ask us to:

  • give you a copy of your data (access),
  • correct it (rectification),
  • delete it (erasure),
  • limit how we use it (restriction),
  • give it to you in a portable form (portability),
  • stop using it for a particular purpose (objection).

You can also withdraw consent at any time, and you can complain to the Information Commissioner's Office at ico.org.uk. To exercise any of these rights, use the contact page.

Children

MyTable is not directed at under-18s ordering alcohol. Items containing alcohol are flagged as age-restricted, and the restaurant is responsible for checking age at the table.

Changes to this policy

We may update this policy. The date at the top shows when it last changed.

Contact

For anything about your data, use the contact page.