Tables.Menu ← Back to site

Privacy Policy

Last updated: June 14, 2026

This Privacy Policy explains how SHOPFILES LTD ("Tables.Menu", "we", "us") collects and uses personal data when you use our website, dashboard and the digital menus we host. We are the data controller for account and platform data. For diners using a restaurant's menu, the restaurant is the controller and Tables.Menu acts as its processor — see the Diner Privacy Notice.

Who we are

SHOPFILES LTD, ATANAS VLAEV 3, SEVLIEVO, BULGARIA, Bulgaria. Tax/registration ID: BG204350007. Contact: support@tables.menu. Data protection: privacy@tables.menu.

Data we collect

  • Account data: name, email, password hash, and login method (email or social login).
  • Restaurant data: menus, products, images, prices and settings you create.
  • Billing data: plan, subscription status and a Stripe customer reference. Card details are handled directly by Stripe — we never store them.
  • Usage data: logins, menu scans, orders, and AI feature usage.
  • Voice data: if voice ordering is enabled, short audio is processed to take orders (see AI providers below).
  • Cookies: see our Cookie Policy.

Why we use it and our legal basis

  • To provide and secure the service — performance of a contract.
  • To process payments and prevent fraud — contract / legitimate interests.
  • To improve features and support you — legitimate interests.
  • For optional analytics or marketing — consent.

AI and sub-processors

We share data with service providers strictly to run the platform, including: Stripe (payments), OpenAI (menu descriptions, translations and voice ordering), social login providers you choose (Google, Apple, Facebook), and our hosting provider. See the Sub-processor list.

International transfers

Some providers may process data outside the EEA. Where they do, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Retention

We keep account data while your account is active and for a reasonable period afterwards to meet legal and accounting obligations. Voice audio is processed transiently and not retained for training.

Your rights

You may access, correct, delete, restrict or port your data, and object to certain processing. Contact privacy@tables.menu. You may also lodge a complaint with your national data protection supervisory authority in Bulgaria.

Changes

We will post any changes here and update the date above.