Privacy policy

This policy explains what [company legal name] (“Seflab”, “we”) collects, why, and who helps us run the service. It covers restaurant teams who use Seflab and the guests of those restaurants.

Restaurant teams

• Account: your email address, your role (owner, manager or staff) and which restaurants you belong to.
• Restaurant details: name, address, phone, hours, menu, events, photos, posts and settings you enter.
• Billing: your plan and its status. Card details go straight to Stripe; we never see full card numbers.
• Activity: a log of changes, such as a party request’s status, so your team can see who did what.

Restaurant guests

Restaurants use Seflab to look after their guests. For that information the restaurant decides how it’s used, and we process it on its behalf.

• Party and catering requests: name, email, phone, date, number of guests, the message and the conversation that follows, plus quotes and deposit status.
• Email list: name, email and, if given, phone and birthday, with the exact wording the guest agreed to and when. Guests can unsubscribe from any email with one click.
• Campaign results: whether each email was delivered, opened or clicked. Opens are counted when an email app loads images.
• QR codes: which code was scanned and when. Nothing that identifies the person.

Text-message consent can be recorded, but Seflab doesn’t send text messages today.

How we use it

Only to run Seflab: showing your data to your team, sending the emails you ask for, taking payments and keeping the service secure. We don’t sell personal information and don’t use it for advertising.

Services that help run Seflab

• Supabase: database, sign-in and photo storage.
• Vercel: hosting for the website and app.
• Resend: sending and receiving email.
• Stripe: plans and party deposits.
• OpenAI: AI drafts, when turned on. A party request’s details are sent to draft a reply.
• Meta: posts your team approves for Facebook and Instagram.
• Google: your Business Profile reviews and the replies you post, when you connect Google.

Google account data

If an owner or manager connects a Google Business Profile, Seflab receives permission to manage that profile’s reviews. We use it only to bring in the reviews of the location you choose, show them to your team, and post the replies you approve, or 4–5 star replies automatically if you turn that on. We keep the sign-in key Google gives us on our servers, never in the browser. We don’t change your business information, don’t use Google data for advertising, and don’t sell or share it. You can disconnect at any time from Reviews, which revokes Seflab’s access; you can also remove it from your Google account settings.

Seflab’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and browser storage

We keep your sign-in in your browser so you stay logged in. We don’t use advertising or tracking cookies.

How long we keep it

As long as the restaurant’s account is open, or until the restaurant deletes it. [retention after an account closes]

Your choices

• Guests: unsubscribe from any email, or ask the restaurant to see, correct or delete your details.
• Teams: ask us to see, export or delete your data at [contact email].
• Depending on where you live (for example California), you may have more rights. [state privacy rights — for your lawyer]

Security

Each restaurant can only see its own data, enforced in the database. Connections are encrypted. Keys for outside services are kept on the server, never in the browser.

Children

Seflab is for businesses and isn’t meant for children under 13.

Changes and contact

We’ll update the date above when this policy changes. Questions: [contact email], [mailing address].