Privacy Policy

• We collect what an inquiry needs: your name, email and event details, and a phone number if you choose to give one.
• We pass it to the restaurant you inquired with. That is the point of the inquiry.
• We do not sell personal data, and we run no advertising pixels on any page.
• Payments go through Stripe. We never see or store your card number.
• Email us and we will tell you what we hold, correct it, or delete it.

Official Food Group LLC, a Pennsylvania limited liability company, d/b/a Table for Forty, operates Table for Forty and is responsible for the personal information described here. Contact: noah@officialfoodgroup.com.

A restaurant that receives your inquiry is separately responsible for what it does with your details after that. If you want a restaurant to delete your information, ask them, and tell us: we will pass it on.

If you inquire about a space (guests). You do not need an account. The inquiry form collects your name and email address, a phone number if you choose to give one, and your event details: date, start and end time, headcount, occasion, an optional budget, and any notes you write. If you add them, it also takes your menu choices, dietary needs, day-of details and billing details for your company. Anything you put in the notes field is passed on as written, so please do not include information you would not want the restaurant to have.

If you pay a deposit. Card details are entered on Stripe's payment page, not ours. We never receive or store your full card number. What we keep is the amount, the currency, whether it succeeded, whether it was refunded or disputed, the timestamps, and Stripe's identifiers for the payment.

If you list a space (restaurants). We collect the email address you sign in with, your name, and your venue and listing details: venue name, address, neighborhood, phone number, description, photographs and videos.

If you opt in to texts. We keep your consent record: the wording you were shown and when you agreed. We keep the mobile number we text (for a restaurant, the number its staff entered in its venue settings), a record of each text (its wording and whether it was sent), any message sent to our number (up to 320 characters, with the number it came from), and any STOP or START request. A text can carry a private link: the deposit page for a guest, or the accept and decline links for a restaurant.

If you ask to stay in the loop. We keep your email address, whether you confirmed it, and when you confirmed or unsubscribed.

How you found us. If the link that brought you here carried campaign tags (such as utm_source or utm_campaign), the inquiry form sends those tags with your inquiry, along with the address of the page that referred you, and we store them with it. That is how we learn which links bring inquiries. We do not pass them to any advertising platform.

Automatically. Our host keeps standard server logs (IP address, browser user agent, the page requested, and the time) for security and troubleshooting. To stop inquiry spam we count recent submissions per network address, and stay in the loop signups per network address and per email address. Each is hashed before it is stored, so what our database holds is an irreversible fingerprint, not your IP or email address.

Our own cookies. We set cookies ourselves for two purposes only. A signed-in restaurant gets a session cookie that keeps it signed in. A guest who asks for a link to their bookings and opens it gets a session cookie that keeps the My Bookings page open for 30 minutes, plus a small cookie that records only that this browser opened such a link, so an inquiry form can offer to fill in the contact and billing details from that guest's last request. Guests can browse, inquire and pay without being given either cookie.

In your browser tab. The inquiry form keeps the campaign tags from the link you arrived on (section 2) in your browser tab's session storage, so they travel with an inquiry you send from another page during the same visit. Closing the tab clears them.

No advertising tags. We do not run advertising pixels or cookie-based analytics on any page: no Google Analytics, no Meta Pixel, no TikTok Pixel, and no other third-party tracking. We count visits to our public pages with Plausible Analytics, which is cookieless and collects no personal data. Video is the other exception. Some listings carry a video. On those listings the video's preview image loads from our video provider, Mux, along with the page, so Mux receives that image request: your IP address, your browser details and our site's address. The video player itself loads only when you press play. When you do, Mux's video player streams the video and reports playback data to Mux (such as loading times, errors, your browser and device type, and your IP address) so Mux can measure streaming quality, and it may set its own cookie in your browser.

• Passing your inquiry to the restaurant, and their reply back to you.
• Sending transactional email about your booking: a copy of your request, acceptance, the deposit link, receipts, refunds and cancellations.
• Sending the texts you opted in to about your booking (never marketing), keeping your consent record, and honoring STOP, START and HELP.
• Taking and refunding deposits, and keeping the payment records that go with them.
• Preventing spam, fraud and abuse, finding and fixing errors, and keeping the site running.
• Meeting tax, accounting and legal obligations, and handling payment disputes.
• Learning which links bring inquiries, from the campaign tags stored with each inquiry (section 2).
• Emailing you about new rooms and open dates, if you ask to stay in the loop.

We do not add you to a mailing list because you inquired. If you ask to stay in the loop, we email you to confirm your address, then email you about new rooms and open dates until you unsubscribe. After you confirm, every email about new rooms and open dates has an unsubscribe link.

The restaurant you inquired with receives your name, email, phone number (if you gave one), event details and notes. That is the purpose of the inquiry, and it happens as soon as you submit it.

Service providers that run parts of the platform for us. They process personal information on our instructions, for us, and not for their own purposes:

• Stripe: payment processing. Stripe handles your card details directly as its own controller; see Stripe's privacy policy.
• Supabase: the database that stores bookings, listings, seller accounts and the stay in the loop list, plus photo and video storage and seller sign-in.
• Resend: sending our email, and the sign-in emails for sellers.
• Vercel: hosting the website and its server logs.
• Sentry: error monitoring. When something fails on our servers, a report of the error goes to Sentry, with email addresses, private links and long runs of digits (such as a phone number typed without spaces) removed before it is sent. A report can still contain a name, or a phone number typed with spaces or dashes, when it was part of what failed. Sentry also receives timing data for a sample of our server requests, to help us find slow pages.
• Axiom: keeping a copy of our server logs for 30 days, for troubleshooting.
• Mux: hosting and streaming the videos restaurants add to their listings and their preview images, and the playback data described in section 3 when you play one.
• Plausible Analytics: counting visits to our public pages. It sets no cookies. With each visit your browser sends it the address of the page you are on, the page you came from, your IP address and browser details; we do not store them as personal data.

Our messaging provider (Twilio) processes the mobile numbers of guests and restaurant staff who opted in to texts, the texts we send them, and any reply they send to our number, so that we can send the booking texts they asked for and honor STOP and HELP. We will not share your phone number or your SMS opt-in consent with any third party or affiliate for marketing or promotional purposes.

We may also disclose information if the law requires it, to enforce our Terms, to protect someone from harm, or in connection with a merger or sale of the business, in which case this policy continues to apply to the information transferred.

We do not sell personal information, and we have never done so. We do not share it for cross-context behavioral advertising or for targeted advertising, as those terms are used in some US state privacy laws.

For the record: from 18 August 2026 until 6 October 2026 our public pages ran the Meta Pixel and the TikTok Pixel, alongside Google Analytics. Those tags received page-visit data from visitors' browsers (the page address and title, the referring page, IP address, browser and device details and their own cookie identifiers; TikTok also read each page's public metadata, the listing details already visible on it; never anything typed into a form), and that may have counted as sharing under those laws; we did not do so before they were added on 18 August 2026. All three were removed on 6 October 2026.

Questions about any of this, or a request about data from that period: email noah@officialfoodgroup.com with the subject line "Do Not Share" and we will tell you what, if anything, we hold about you.

• Bookings and payment records: at least seven years from the event, because tax, accounting and chargeback rules require the records to exist.
• Inquiries that never became a booking: up to 24 months, then deleted or stripped of identifying detail.
• Email delivery records (whether a message was sent and whether it failed): kept with the booking, so a failed notification can be retried and audited.
• Text message records: the record of each text (its wording and whether it was sent) is kept with the booking, and so is a guest's consent record (a restaurant's stays in its venue settings). Messages sent to our number and STOP and START requests are kept on their own, so we keep honoring them. No scheduled job deletes any of these today.
• Restaurant accounts and listings: for as long as the account is open, and financial records for the period above after it closes.
• Server logs: a short rolling window.
• Hashed spam-prevention counters: no scheduled job deletes them today.
• Stay in the loop email: kept until you unsubscribe. After that we keep the address so we don't email you again unless you sign up again. We limit an address that is never confirmed to three confirmation emails in 30 days, and send it nothing else.

Wherever you live, you can email us to ask what we hold about you, to correct it, to get a copy, or to have it deleted. We will respond within the time your local law requires, and within 45 days as a rule. We will not treat you differently for asking.

Two honest limits: we cannot delete records we are legally required to keep, such as the payment records behind a completed booking, and we cannot delete an inquiry from a restaurant's own inbox. You will need to ask them, though we will help.

Depending on your state, you may also have the right to opt out of the sale of personal information, of its sharing for cross-context behavioral advertising, or of targeted advertising, and to limit the use of sensitive information. We do none of those things, and we do not use sensitive information as those laws define it. If a request is made on your behalf by an authorized agent, we may need to verify it with you.

Traffic is encrypted in transit. Database access is restricted by row-level security so that a restaurant can only read its own bookings. Deposit links are unguessable single-purpose tokens rather than account logins, and card data never reaches our servers.

No system is perfectly secure. If something is compromised, we will notify affected people and the authorities where the law requires it. Please report anything that looks wrong to noah@officialfoodgroup.com.

Table for Forty is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, email us and we will delete it.

We operate in the United States, and our service providers store and process information in the United States. If you use the site from elsewhere, you are sending your information to the US.

If this policy changes, the updated version appears on this page with a new date at the top. For anything about your privacy, email noah@officialfoodgroup.com.