Privacy Policy

This policy covers tableside.co and our pre-launch pages (like join.tableside.co), based in British Columbia, Canada. It applies to hosts, chefs, and anyone who joins our early-access list or contacts us.

Account basics — name, email, password (stored as a hash — we never see it), role, and optional profile photo, city, and about-you line.

Chef storefronts — the business information chefs choose to publish: display name, bio, menus, photos, certifications, service area, pricing. This is public by design.

Event details, including sensitive ones — occasions, dates, guest counts, budgets, dietary needs — and after a booking is mutually confirmed, the exact address, kitchen and access notes, and a day-of phone number. These are shared with exactly one person: the confirmed counterpart. They are never public, never shown to competing chefs, and chefs are contractually bound to treat them as confidential and single-use.

Messages — proposal notes and event coordination threads, visible only to the two parties of that event (and to us where the law requires or safety demands).

Early-access signups — name, email, and what you're hoping to host, from our pre-launch pages.

Support messages — what you send through the contact form, kept so we can actually help.

We record where a visit came from (the tags on the link you arrived by, and the page that sent you) and keep that with an order so a chef can see which channel sold a ticket. We also keep a minimal first-party record of which storefronts, menus and events were viewed during a visit, so a chef can see whether people saw an offer, not only whether they bought it. That part is ours alone, involves no third party, and carries no name or email.

With your Accept all on the cookie bar, we also load the Meta pixel and Google Analytics across the site. They see page views and, when you buy, the purchase amount and an order number, so our ads can be measured. If you allowed advertising cookies, we also report that purchase to Meta from our own server, with the same order number, so their count is not lost when a page fails to load; if you did not, we don't. “Manage cookies” lets you switch analytics and advertising on or off separately; with both off nothing loads and the site works the same.

A chef or organizer who sells through Tableside may add their own Meta pixel. It runs only on that seller's pages — their storefront, their events, and the checkout for those — and only with the same OK. It receives the same signals ours does for those pages, under that seller's Meta account. It never runs on another seller's pages or in your dashboard. You can change your choice at any time: Cookie choices brings the bar back.

We don't run our own data centres. These providers process data on our behalf:

• Supabase — our database, authentication, and photo storage
• Resend — sends our email (notifications, contact-form delivery)
• Vercel — hosts the website
• GoHighLevel — manages the early-access mailing list
• Meta — ad measurement on pre-launch pages only

These providers store data on servers in the United States, which means it can be subject to US law while it's there. We share only what each provider needs to do its job, and we never sell personal information to anyone.

Joining our early-access list is express consent (under Canada's anti-spam law) to receive Tableside updates by email — every one of them has a working unsubscribe. Transactional email — a proposal arrived, a booking confirmed — is part of using the product, and can be managed in your account settings.

Account and profile data lasts while your account does. Event records, commitments, and reviews are records of real commercial arrangements between two parties, so they persist as the trust history both sides rely on. Early-access list entries are deleted on unsubscribe or after launch outreach completes. Support messages are kept while the issue (and its lessons) stay relevant.

Email hello@tableside.co to see the personal information we hold about you, correct it, or ask for deletion. We'll act promptly, with one honest carve-out: records of completed commercial events (commitments, reviews, cancellation history) may be retained in de-identified or minimal form, because the other party relies on them. You can also complain to the Office of the Privacy Commissioner of Canada — but we'd rather you talk to us first.

Data is encrypted in transit, access is role-restricted (a competing chef cannot see your proposals; nobody sees an address before confirmation), and secrets are never stored in code. If a breach ever creates real risk of harm, we will notify affected people and the authorities as the law requires — promptly and plainly.

Tableside is for people 19 and older; we don't knowingly collect information from anyone younger. When this policy materially changes, we'll say so on the platform or by email. Questions, requests, worries: hello@tableside.co.