Customer Privacy Policy
ArcZen LLC · Effective 23 April 2026
This policy explains how ArcTable collects, uses, and shares personal data belonging to restaurant customers who make bookings through our platform. It applies to bookings made via an ArcTable-powered widget or direct booking link. If you are a restaurant operator, a separate policy applies to you.
Contents
1. Who We Are
ArcTable is a restaurant booking and management platform operated by ArcZen LLC (“ArcZen”, “we”, “us”, “our”). We provide the technology that enables restaurants to accept and manage reservations from their customers.
For the purposes of this policy, “you” or “Customer” means any individual who submits a booking through an ArcTable-powered experience.
ArcZen LLC operates as a data controller in respect of the personal data described in this policy, and as a data processor on behalf of the individual restaurant that receives your booking.
Contact: tech.admin@arczen.com
2. Data We Collect
Booking & identity data
When you make a booking, we collect the following:
| Field | Why we collect it |
|---|---|
| Name | To identify you and personalise your confirmation |
| Email address | To send confirmations and reminders |
| Phone number | So the restaurant can contact you |
| Party size | To assign an appropriate table |
| Booking date, time & type | To record your reservation |
| Booking status | To track your reservation lifecycle |
| Special requests | To pass your preferences to the restaurant |
Payment data
Where a restaurant requires a deposit, payment is handled by Stripe via Stripe Connect. ArcZen sees limited transaction metadata only (payment status and amount). We never store your card number, CVV, or bank account details. Stripe's processing of your payment data is governed by Stripe's Privacy Policy.
Voluntarily submitted sensitive data
We do not ask for health, dietary, or allergen information. If you choose to include such information in the Special Requests free-text field, we process it only to pass your request to the restaurant — for no other purpose. We recommend you only include what is strictly necessary for your visit.
3. How We Use Your Data
We use your personal data to:
- Create and confirm your restaurant reservation
- Send booking confirmations, updates, and reminders
- Allow the restaurant to manage your visit (seating, table assignment, pre-orders)
- Process deposits through Stripe where required by the restaurant
- Detect and prevent fraud on the platform
- Respond to your privacy and data requests
- Comply with applicable legal obligations
Lawful basis: Most processing is necessary to fulfil your booking under UK GDPR Article 6(1)(b) (contract performance). Where we rely on legitimate interests — such as fraud prevention and pre-visit reminders — we have assessed these against your rights under Article 6(1)(f).
4. Who We Share Your Data With
We share personal data only as necessary to provide the service:
| Recipient | Purpose | Location |
|---|---|---|
| The restaurant | To manage your reservation and visit | Varies |
| Cloud hosting providers | Platform infrastructure and data storage | United Kingdom |
| Content delivery providers | Web application and booking widget | United States |
| Email delivery providers | Booking confirmations and reminders | United States |
| Stripe | Deposit payment processing | UK / Ireland |
† US-based providers operate under Standard Contractual Clauses (SCCs). A full sub-processor list is available on request at tech.admin@arczen.com.
ArcZen will never sell, rent, or trade your personal data to any third party for commercial purposes.
5. International Data Transfers
ArcZen LLC is incorporated in the United States. Our primary database and API infrastructure are hosted in the United Kingdom. Some of our service providers — specifically our content delivery and email delivery providers — are based in the United States.
Where your data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place in accordance with UK GDPR Article 46, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office. These safeguards ensure your data receives the same level of protection regardless of where it is processed.
6. Your Rights
Under UK GDPR, you have the following rights in respect of your personal data:
| Right | What it means |
|---|---|
| Access | Request a copy of your personal data. |
| Rectification | Ask us to correct inaccurate or incomplete data. |
| Erasure | Ask us to delete your personal data. |
| Restriction | Ask us to limit how we process your data. |
| Portability | Receive your data in a structured, machine-readable format. |
| Object | Object to processing carried out under legitimate interests. |
To exercise any right, email tech.admin@arczen.com with your full name, the email address used for your booking, and the restaurant name. We will respond within 30 days. We may ask you to verify your identity before processing a request. We will not charge a fee for reasonable requests.
7. Data Retention
We retain booking records for as long as necessary to fulfil the purposes described in this policy, including dispute resolution and legal compliance. We are in the process of establishing defined retention periods and will update this policy once formalised. In the meantime, you may request deletion of your data at any time.
Payment metadata is retained for the period required by applicable financial and tax regulations, typically 6–7 years.
8. Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption of data in transit (TLS) and at rest
- Role-based access controls
- Industry-standard JWT authentication via Supabase Auth (asymmetric ES256 signatures for current tokens)
- Tenant isolation — your data is only accessible to the restaurant you booked with
- Regular security reviews of our platform infrastructure
In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and will inform you directly where required by law.
9. Marketing
ArcZen does not send marketing or promotional emails to restaurant customers.
In the future, restaurants may be given the ability to send marketing communications to their customers through ArcTable. If this feature is introduced, your explicit opt-in consent will always be required before any marketing message is sent, and you will retain the right to withdraw that consent at any time.
10. Contact & Complaints
For all privacy-related enquiries and data subject requests, contact us at:
ArcZen LLC
tech.admin@arczen.com
We aim to acknowledge all enquiries within 5 business days and resolve data subject requests within 30 days.
If you remain unsatisfied with how we have handled your concern, you have the right to lodge a complaint with the relevant supervisory authority:
United Kingdom — Information Commissioner's Office (ICO)
ico.org.uk
· 0303 123 1113
If you are based in the EU, you may also contact the supervisory authority in your member state of residence or place of work.
ArcZen LLC · Privacy Policy v1.0 · Effective 23 April 2026