Privacy Policy | Tavoloo

This privacy policy describes how FM Solutions & Consulting USA LLC ("we", "our" or "Tavoloo") collects, uses and protects personal data of Tavoloo platform users, in compliance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679).

1. Data Controller

Company: FM Solutions & Consulting USA LLC

EIN: 61-2276626

Email: info@fmsolutions.ai

Address: USA

Data Protection Officer (DPO): Michelle G. Andrade — dpo@fmsolutions.ai

2. Data Collected

Registration data

First name, last name, email, password (encrypted), language preferences.

Reservation data

Customer name, phone number, email, reservation date and time, party size, special notes, dietary preferences.

Customer CRM data

Visit history, dietary preferences, first and last visit dates, no-show count.

Newsletter data

Email, name (optional), communication preferences.

Navigation data

IP address, browser type, operating system, pages visited, time spent, technical cookies.

3. Processing Purposes

Provision of reservation management and digital menu services
Management and confirmation of reservations
Service improvement through AI assistants (AI Waiter, Reservation AI)
Sending promotional communications (only with explicit consent)
Aggregate statistical analysis to improve the platform
Compliance with legal and tax obligations

4. Legal Basis

Contract performance: To provide requested services (reservations, menu management).
Consent: For sending marketing communications and newsletters.
Legitimate interest: To improve our services and prevent fraud.
Legal obligation: To comply with tax and legal obligations.

5. Third Parties and AI Services

Your data may be shared with the following service providers:

Supabase Inc. - Database hosting and authentication (AWS servers in EU)
Google LLC (Gemini AI) - AI processing for virtual assistants (Gemini AI)
Stripe Inc. - Payment processing (if applicable)
OpenStreetMap - Map display for venue locations
OpenAI, L.L.C. - AI models powering the Concierge and WhatsApp agent (via Vercel AI Gateway).
Vercel Inc. - Website/app hosting and AI Gateway.
Resend (Plus Five Five, Inc.) - Transactional and marketing email delivery.
Evolution API - WhatsApp connectivity for the restaurant assistant (only if enabled).
Metricool - Website visit analytics, loaded only after consent to analytics cookies.

6. International Transfers

Some of our service providers are located outside the European Union, particularly in the United States. To ensure an adequate level of data protection, we use:

Standard Contractual Clauses approved by the European Commission
Data Privacy Framework (DPF) for transfers to the USA

7. Retention Period

Account data: Duration of subscription + 30 days
Reservation data: 2 years from reservation date
Customer CRM data: 3 years from last interaction
Tax/invoice data: 10 years (legal obligation)
Navigation logs: 90 days

8. Your GDPR Rights

Under GDPR, you have the following rights:

Right of access: Obtain a copy of your personal data.
Right to rectification: Correct inaccurate or incomplete data.
Right to erasure: Request deletion of your data ("right to be forgotten").
Right to restriction: Restrict processing of your data.
Right to portability: Receive your data in structured format and transfer it.
Right to object: Object to processing for direct marketing.
Withdrawal of consent: Withdraw consent at any time.

You also have the right to lodge a complaint with your local Data Protection Authority.

9. Cookies

For detailed information on cookie use, please see our Cookie Policy

10. Changes to Privacy Policy

We reserve the right to modify this policy. Changes will be posted on this page with the update date. We recommend checking this page periodically.

11. Contact

To exercise your rights or for any privacy questions, contact us:

Email: info@fmsolutions.ai

For privacy matters, you can contact our DPO: Michelle G. Andrade — dpo@fmsolutions.ai