Privacy notice

Table Buddy is operated by Workflow Corporation. This notice describes what the service stores while it is in preview, where it keeps it, who else takes part in running it, and the controls you have.

Your login

Your name and email address, and a hashed password — never the password itself. If you sign in through another service, a link to that account and the profile picture it provides. The restaurants you belong to, and your role in each.

Restaurant records

What a restaurant enters to run: its menu, orders and payments, stock, suppliers and purchases, cash drawers and accounts. Staff records hold names, contact details, positions, pay, shifts, attendance and tips. Customer names, phone numbers, email and delivery addresses are kept when the restaurant records them — with an order, a booking or in its customer list — or when they come in from a system the restaurant connects.

Records from Toast

If a restaurant connects its Toast point of sale, Table Buddy keeps that connection’s credentials encrypted and imports, for that one location: the menu; staff names, email addresses, jobs and clock-in times, with each clock-in’s job, breaks and hours, and the cash tips staff declare at clock-out — never anyone’s wage; if the restaurant chooses, its staff schedule; checks — their items, amounts, discounts and tips, and the card brand and last four digits of each card payment; and cash drawer entries and deposits. It also imports each check’s guest — their name, email address and phone number, and for a delivery the delivery address — into the restaurant’s customer list, linking the check to them. A restaurant can turn off importing guests; the customers already imported stay until the restaurant removes them. Nothing is ever written back to Toast.

Schedules and time records

A restaurant keeps its staff’s schedules, time off and availability, their clock-ins and breaks, and the pay rates it enters. Pay rates are seen only by the people the restaurant lets see pay. Staff with a login see their own schedule, time off and availability, and nobody else’s. When a restaurant publishes a week’s schedule, each person’s own shifts are emailed to the address the restaurant holds for them, unless the restaurant has turned that off for them. A reason for time off is a few words, and no medical detail is asked for.

Staff messages and notices

A restaurant’s managers can post announcements to its staff, send a private message to one person, and add a formal notice — a warning or a commendation — to a person’s staff record. Each reaches the people it is for five minutes after it is posted, unless the manager sends an announcement or a message at once: in Table Buddy, and by email to the address the restaurant holds for them. An announcement’s email carries its text. A private message’s or a notice’s email carries only a link, never its text, but anyone who can read that email can open the link. A link works for 30 days, until a newer email replaces it, or until the person can sign in to Table Buddy. Table Buddy keeps who each one reached, when they saw and acknowledged it, and how — signed in, from an email link, or on paper — and, for a notice, the name the person typed to acknowledge it and anything they wrote with it. In Table Buddy, a notice is seen only by the person and by the managers the restaurant allows to see it, and a private message by the person, whoever sent it and the restaurant’s owners and admins.

Email to guests

If a restaurant emails its guests through Table Buddy: whether each address asked to hear from the restaurant, and how — ticked by its staff, or confirmed by the guest from a link sent to that address, in which case the time and the IP address the confirmation came from are kept as the record of that consent. For each email sent: who it went to, whether it was delivered, bounced or reported as spam, and, where the restaurant counts them, when it was opened, which links were clicked and the kind of mail app used (Apple Mail, Gmail, Outlook, Yahoo or another). These records keep no IP address or browser description, but each open and click reaches Table Buddy as a request, and its request logs keep those (see Request logs, below).

Supplier invoices

If Table Buddy has switched supplier invoices on for a restaurant: the invoices, credit notes and statements it photographs, uploads or has emailed to its invoice address, and what was read from each. Photos taken in Table Buddy carry no location, and the details a camera stores inside an image are removed when it arrives. For an emailed invoice, only its attachments are kept, with the sender’s address, the subject and when it arrived. The mail service hands over the message’s text along with those details; Table Buddy reads none of it, keeps none of it and follows no link in it, and nothing is ever sent back to the sender. Within the restaurant, the people who record its purchases see every document, someone who can only send invoices in sees the ones they sent, and those who view its accounts also see its suppliers’ statements.

Demo requests

What someone sends from the contact page: their name, email address, restaurant and the other details the form asks for. They are kept to answer the request; those marked as spam are deleted after 30 days, and handled ones after a year.

Activity log

Consequential actions — voids, refunds, drawer counts, settlements, access changes and the like — with who took them and when, and sometimes the IP address they came from. A restaurant’s own activity screen leaves out IP addresses and personal account events.

API requests

For each request: its method, path, status, how long it took, which key made it, and whether it came through the API, the playground or an assistant connected over MCP — never its body, secrets or query string. For 24 hours after a write, a digest of its Idempotency-Key and of the request, and the response it gave, so a retry is answered without acting twice. Those responses, including a refusal, carry record numbers and the names of menu items, tables, materials, suppliers and accounts — never a guest’s or staff member’s name, phone or email.

Request logs

Separately from everything above, the servers in front of Table Buddy log every request they receive: the IP address it came from, the browser’s description of itself (its user agent) and the web address it asked for. The logs are kept for a limited time, to protect the service and to find problems. They include the requests an email makes: the image that counts an open, each tracked link, the unsubscribe and email preferences pages, and the links in staff emails, whose web addresses identify the email they came from.

A restaurant can email its guests through Table Buddy once Table Buddy has switched this on for it. The restaurant is the sender: the email comes from its own domain, and it decides who is emailed — guests who asked to hear from it, and, only if it chooses to, guests who ordered from it on or after a date it picks. Every email says why the guest is getting it and carries the restaurant’s postal address.

• Every email has an unsubscribe link, and mail apps that offer a one-click unsubscribe beside the sender use it. Unsubscribing takes effect at once and asks for nothing.
• An address that unsubscribes, bounces or reports an email as spam goes on that restaurant’s never-email list. The list keeps the address so it is never emailed again — even after the guest’s record is deleted, or arrives again from another system. Only the guest can take it off, by confirming from a link sent to that address.
• Where a restaurant counts opens and clicks, each email carries a small image and its links pass through Table Buddy on the way to where they point. Opens are only an indicator: some mail apps load the image for everyone, and some for no one. Loading the image and following a link are requests to Table Buddy, so like every request they appear in its request logs, with the IP address and browser they came from, for a limited time.
• The email preferences page, linked from every email, shows what that restaurant has on file for the address, and nothing about any other restaurant.

Where a restaurant turns on supplier invoices, the invoices, credit notes and statements it photographs, uploads or has emailed to its invoice address are stored in Google Cloud Storage and read by Anthropic’s Claude, an AI service, to fill in a draft. Nothing is booked until a person at the restaurant approves it.

• Anthropic receives the document and Table Buddy’s fixed instructions for reading it, and nothing else: not the restaurant’s name, who sent the document, or any other record. Under its commercial terms, Anthropic does not use what it is sent to train its models, and keeps it only for the period its data policy for its API sets.
• Only mail from senders the restaurant has accepted, or from its own trusted addresses, is read. Mail from anyone else waits, unread, for someone at the restaurant to accept or discard it.
• A document stays as long as the purchase, credit or statement it was booked as. A rejected document’s files are deleted 90 days after it was rejected. Mail from a sender nobody accepted is discarded, with its files, after 30 days, and mail with nothing to read after 7 days, unless someone at the restaurant discards it sooner; once discarded, its sender’s address and subject are removed at once. Any other mail that was not taken, such as bulk mail, mail over a limit or sent to an address that no longer takes mail, mail that could not be fetched, or mail whose files had all arrived already, keeps its sender’s address and subject for 7 days, then loses them. What is left of any of these is a count, deleted 35 days after the mail arrived. Everything is deleted with the restaurant. Deleted files are removed from storage within 7 days.

Table Buddy sets cookies to keep you signed in and to remember the restaurant you have open, your language and your color theme. An invitation link waits in your browser tab until you accept it.

There is no advertising in Table Buddy, and no analytics or third-party tracking scripts.

On Google Cloud, in the us-east4 region in the United States. The database is backed up every day. Supplier invoices’ files are kept in a private storage bucket in the same region.

• Google Cloud hosts the service and its database, and keeps its request logs.
• If you choose to sign in through another service, that service confirms who you are and shares your name and email address.
• Where email is switched on, Resend, an email delivery service, sends Table Buddy’s email to the address it is for: password resets and invitations, the daily closing for those who turn it on, and a restaurant’s email to its guests. It handles the address and the message, and tells Table Buddy whether it bounced or was reported as spam. It also receives the invoices suppliers email to a restaurant’s invoice address.
• Where a restaurant turns on supplier invoices, Anthropic’s Claude, an AI service, reads the documents it sends in to fill in a draft (see Supplier invoices, above).
• The chat on Table Buddy’s public pages is Meet Buddy, a support chat from the same operator, served from meetbuddy.radioworkflow.com. Your browser loads it from there, and what you type into it goes to Meet Buddy. It is not on the sign-in screens or in the signed-in console.
• If a restaurant connects Toast, Table Buddy reads that restaurant’s records from Toast with the credential the restaurant created there. Toast is the restaurant’s own provider; Table Buddy sends it nothing but those requests.

• Your account, in the console, changes your name and password and signs out every device you are signed in on.
• A restaurant’s owner can download its reports as CSV and delete the restaurant, which removes its records from the database and its supplier invoices’ files from storage. Copies made before then remain in the daily backups until those backups are replaced.
• Whoever holds “Manage staff” in a restaurant can remove a person’s access to it; the restaurant keeps its history, and the person keeps their login.

Deleting a login. A login is deleted by Workflow Corporation, which operates the platform. To have yours deleted, write to support@workflowcorp.com from the address you sign in with.

This notice may change as the preview develops. The date at the top of this page shows when it last changed; the preview terms cover the rest of how the preview works.