Privacy Policy

Last updated: October 21, 2026

Smart Table (“Smart Table”, “we”, “us”) operates the website at smarttablepay.com and the Smart Table pay-at-the-table platform for restaurants in British Columbia, Canada. This policy describes the personal information we collect through our website and platform, why we collect it, who processes it for us, and the rights you have under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

Smart Table serves two groups: restaurants that use our platform, and guests who pay a restaurant’s bill through Smart Table. Guests never need an account to pay.

1. Information we collect

From restaurants

• Account details for the restaurant’s portal users: email address, a securely hashed password, role, and the restaurant and location details the account is set up with (business name, locations, tables).
• Point-of-sale (POS) connection details, including access credentials for the POS connection, which are stored encrypted.
• Billing details: the plan the restaurant chooses, fee and subscription records, and — for a card on file — only the card’s brand, last four digits and a reference ID. The card itself is held by Square, not by us.
• Messages and applications sent to us, including through the forms on this website (see below).

From guests

• Check and order data from the restaurant’s POS: the table, the items on the check, totals, taxes and the payment status. This data originates with the restaurant’s POS system.
• Payment records: the amount paid, the tip, how the bill was split (equal, by items or custom), an optional name or label a guest enters when splitting a bill, and the payment reference Square returns to us.
• Card details are entered into Square’s secure payment form in the guest’s browser and go directly to Square. Full card numbers never reach, and are never stored on, Smart Table’s servers.
• Optional items a guest may choose to provide: an email address to receive an emailed receipt; a star rating and optional written feedback for the restaurant; a phone number for a restaurant’s optional loyalty program — for loyalty we store only a one-way hash of the phone number together with a visit count, not the number itself.
• Service events connected to a table or check, such as a “call waiter” request and its timestamp, which staff use to run the floor.

From website visitors

• Information submitted through the forms on this website (founding-restaurant application and contact form): name, restaurant name, email address, optional phone number, city, number of tables, POS system and message.
• Aggregate website analytics: pages visited, approximate region and device type, measured with Cloudflare Web Analytics. It does not use cookies and does not track individuals across websites.

2. How we use this information

• To provide and operate the service: show guests their bill, process payments through Square, record payments back to the restaurant’s POS, run the restaurant’s live floor dashboard and metrics, process refunds that a restaurant initiates, email receipts, and operate loyalty where a restaurant enables it.
• To administer restaurant accounts and billing: apply plan fees, charge subscriptions, and keep billing records.
• To respond to applications, messages and support requests.
• To keep the platform secure, prevent duplicate or fraudulent transactions, troubleshoot and improve the service.
• To meet legal, tax and accounting obligations.

We do not sell personal information.

3. Who processes information for us

We share personal information only as needed to run the service:

• Square — processes all card payments, holds cards on file, and runs subscription billing. Where a restaurant’s POS is Square, check and order data also comes from and returns to Square. Square handles this information under its own privacy policy and terms.
• The restaurant’s POS provider — checks, menu items and orders are read from and recorded back to the restaurant’s own point-of-sale system.
• Resend — delivers emailed receipts to guests who request one.
• Formspree — receives the submissions from the forms on this website and delivers them to us.
• Cloudflare — provides our website analytics, domain services and email routing.
• Hosting and database providers — run the platform’s application and database on our behalf.
• The restaurant a guest visited — a restaurant can see its own checks, payment records, guest feedback and loyalty visit counts in its portal. That information relates to its own guests’ visits.
• Google — if a guest chooses to leave a public review, they are taken to Google and Google’s privacy policy applies there.

Some of these providers may store or process information in the United States or other countries. While information is in another jurisdiction, it may be subject to that jurisdiction’s laws, including lawful access by its authorities. We may also disclose information if required by law, or to protect our rights, our users or the public.

4. Cookies and browser storage

Smart Table does not use advertising or cross-site tracking cookies, and our website analytics does not set cookies. Our guest pages and restaurant portal use your browser’s session storage — temporary storage that clears when the tab closes — for essential functions only: keeping a portal user signed in during a session and preventing a payment or order from being submitted twice.

5. Retention

We keep personal information only as long as reasonably necessary for the purposes described in this policy and to meet legal, tax and accounting requirements — payment and fee records, for example, are kept as business records. When a restaurant stops using Smart Table, it may ask us to delete its account data, subject to those requirements. Guests may contact us, or the restaurant they visited, about information connected to a visit.

6. Security

We protect information with safeguards appropriate to its sensitivity: encryption in transit (HTTPS), encrypted storage of POS access credentials, hashed passwords, and access limited to what is needed to operate the service. Guest and restaurant card data is handled by Square, a PCI DSS compliant payment processor, and never touches our servers in full. No system is perfectly secure, but we work to protect the information entrusted to us.

7. Your rights

Under PIPEDA, you may:

• Request access to the personal information we hold about you;
• Ask us to correct information that is inaccurate or incomplete;
• Withdraw consent to our use of your information, subject to legal or contractual restrictions and reasonable notice;
• Ask questions or complain about how we handle personal information.

Contact us at [email protected] and we will respond within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

8. Email and Canada’s anti-spam law (CASL)

If you submit a form on this website, we use your details to respond to your inquiry. We send marketing or product-update emails only to people who have consented to receive them, and every such email includes an unsubscribe option. Transactional messages — such as a receipt a guest requested, or billing notices to a restaurant — are part of providing the service and are not marketing.

9. Children

Smart Table is a business service for restaurants and their guests and is not directed at children. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this policy from time to time. Changes take effect when posted on this page, and we will update the “last updated” date above. For material changes, we will also note the change on our website or notify restaurant account holders by email where appropriate.

11. Contact us

Questions about this policy or your personal information: [email protected] — Smart Table, Metro Vancouver, British Columbia, Canada.