Privacy Policy

• We collect what an inquiry needs: your name, email, phone and event details.
• We pass it to the restaurant you inquired with — that is the point of the inquiry.
• We do not sell personal data. Our public pages do run Google Analytics, the Meta Pixel and the TikTok Pixel, which set cookies and see which pages you visit — sections 3 and 6 say what they get and how to opt out.
• Payments go through Stripe. We never see or store your card number.
• Email us and we will tell you what we hold, correct it, or delete it.

Official Food Group LLC, a Pennsylvania limited liability company, operates Table for Forty and is responsible for the personal information described here. Contact: noah@officialfoodgroup.com.

A restaurant that receives your inquiry is separately responsible for what it does with your details after that. If you want a restaurant to delete your information, ask them — and tell us, and we will pass it on.

If you inquire about a space (guests). You do not need an account. The inquiry form collects your name, email address and phone number, and your event details: date, start and end time, headcount, occasion, an optional estimated budget, and any notes you write. Anything you put in the notes field is passed on as written, so please do not include information you would not want the restaurant to have.

If you pay a deposit. Card details are entered on Stripe's payment page, not ours. We never receive or store your full card number. What we keep is the amount, the currency, whether it succeeded, whether it was refunded or disputed, the timestamps, and Stripe's identifiers for the payment.

If you list a space (restaurants). We collect the email address you sign in with, your name, and your venue and listing details: venue name, address, neighborhood, phone number, description and photographs.

Automatically. Our host keeps standard server logs (IP address, browser user agent, the page requested, and the time) for security and troubleshooting. To stop inquiry spam we count recent submissions per network address — the address is hashed before it is stored, so what our database holds is an irreversible fingerprint, not your IP.

Our own cookies. We set cookies ourselves for one purpose only, restaurant sign-in: a session cookie that keeps a signed-in seller signed in. Guests can browse, inquire and pay without ever being given an account cookie.

Analytics and advertising tags. Our public pages — the homepage, listing pages, the restaurant sign-in page and these legal pages — load three third-party tags: Google Analytics 4 (Google), the Meta Pixel (Meta Platforms) and the TikTok Pixel (TikTok). Each of them sets its own cookies in your browser and receives, for every page you view: the page address and title, the address of the page you came from, your IP address, your browser and device details, and its own cookie identifier. TikTok also reads the page's public metadata — the listing details already visible on it. They do not receive your name, email address or phone number, and nothing you type into the inquiry form — we hand them the page event only, with no "advanced matching" of any kind. Google Analytics is set to analytics only, with Google's advertising and remarketing signals switched off. Meta and TikTok use what they receive to measure our advertising on their platforms and to build audiences for it.

These tags do not run on the deposit-payment page or on the restaurant dashboard, and we place no other third-party analytics or tracking on the site. Section 6 explains how to opt out.

• Passing your inquiry to the restaurant, and their reply back to you.
• Sending transactional email about your booking — a copy of your request, acceptance, the deposit link, receipts, refunds and cancellations.
• Taking and refunding deposits, and keeping the payment records that go with them.
• Preventing spam, fraud and abuse, and keeping the site running.
• Meeting tax, accounting and legal obligations, and handling payment disputes.
• Understanding how the public site is used and measuring our advertising, through the analytics and advertising tags described in section 3.

We do not use your details for marketing, and we do not add you to a mailing list because you inquired.

The restaurant you inquired with receives your name, email, phone number, event details and notes. That is the purpose of the inquiry, and it happens as soon as you submit it.

Service providers that run parts of the platform for us. They process personal information on our instructions, for us, and not for their own purposes:

• Stripe — payment processing. Stripe handles your card details directly as its own controller; see Stripe's privacy policy.
• Supabase — the database that stores bookings, listings and seller accounts, plus photo storage and seller sign-in.
• Resend — sending our email, and the sign-in emails for sellers.
• Vercel — hosting the website and its server logs.

Analytics and advertising providers — Google (Google Analytics 4), Meta Platforms (the Meta Pixel) and TikTok (the TikTok Pixel) receive the page-visit data described in section 3 directly from your browser. Google Analytics processes it for us; Meta and TikTok also use it for their own advertising purposes under their own privacy policies (Google, Meta, TikTok). None of them receives your name, email address, phone number or anything you type into a form.

If SMS notifications launch, our messaging provider (Twilio) will process the phone number of guests who have opted in, for the messages they opted into. Until then, no SMS provider receives anything. We will not share your phone number or your SMS opt-in consent with any third party or affiliate for marketing or promotional purposes.

We may also disclose information if the law requires it, to enforce our Terms, to protect someone from harm, or in connection with a merger or sale of the business — in which case this policy continues to apply to the information transferred.

We do not sell personal information, and we have never done so. We do run the Meta Pixel and the TikTok Pixel on our public pages, and the page-visit data they collect (section 3) may count as "sharing" for cross-context behavioral advertising, or as "targeted advertising", as those terms are used in some US state privacy laws. Apart from those tags we do not share personal information for advertising, and we did not do so before they were added on the date at the top of this page.

To opt out of that sharing:

• Use your browser's controls: block third-party cookies, turn on tracking protection, or use a content blocker — the tags cannot set or read cookies you have blocked.
• Use the industry opt-outs: the Digital Advertising Alliance at optout.aboutads.info and the Network Advertising Initiative at optout.networkadvertising.org; Google's Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout; and the ad-preference settings in your Meta and TikTok accounts.
• Email us at noah@officialfoodgroup.com with the subject line "Do Not Share". We will confirm receipt, help you complete the steps above for your browser and devices, and tell you what, if anything, we hold about you.

• Bookings and payment records: at least seven years from the event, because tax, accounting and chargeback rules require the records to exist.
• Inquiries that never became a booking: up to 24 months, then deleted or stripped of identifying detail.
• Email delivery records (whether a message was sent and whether it failed): kept with the booking, so a failed notification can be retried and audited.
• Restaurant accounts and listings: for as long as the account is open, and financial records for the period above after it closes.
• Server logs and the hashed spam-prevention counters: a short rolling window.

Wherever you live, you can email us to ask what we hold about you, to correct it, to get a copy, or to have it deleted. We will respond within the time your local law requires, and within 45 days as a rule. We will not treat you differently for asking.

Two honest limits: we cannot delete records we are legally required to keep, such as the payment records behind a completed booking, and we cannot delete an inquiry from a restaurant's own inbox — you will need to ask them, though we will help.

Depending on your state, you may also have the right to opt out of the sale of personal information, of its sharing for cross-context behavioral advertising, or of targeted advertising, and to limit the use of sensitive information. We do not sell personal information and we do not use sensitive information as those laws define it; for the advertising tags on our public pages, section 6 explains how to opt out. If a request is made on your behalf by an authorized agent, we may need to verify it with you.

Traffic is encrypted in transit. Database access is restricted by row-level security so that a restaurant can only read its own bookings. Deposit links are unguessable single-purpose tokens rather than account logins, and card data never reaches our servers.

No system is perfectly secure. If something is compromised, we will notify affected people and the authorities where the law requires it. Please report anything that looks wrong to noah@officialfoodgroup.com.

Table for Forty is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, email us and we will delete it.

We operate in the United States, and our service providers store and process information in the United States. The analytics and advertising providers in section 3 receive page-visit data in the United States and may process it elsewhere under their own policies. If you use the site from elsewhere, you are sending your information to the US.

If this policy changes, the updated version appears on this page with a new date at the top. For anything about your privacy, email noah@officialfoodgroup.com.