Privacy Policy

1. Who we are

This service is operated by MABUREDE AI LTD, a company registered in England and Wales under company number 17157267, with its registered office at Flat 47 Ludham Lismore Circus, London, England, NW5 4SE. We trade as Tablemark.

For questions about this policy, about the data we hold, or to exercise any right described here, write to support@maburedeai.shop or call +44 7762122687. We answer within one working day and complete rights requests within one month.

We are the data controller for your account data. For the guest lists you upload, we are a data processor and you are the controller — see section 4.

2. The law we work under

We apply the UK General Data Protection Regulation and the Data Protection Act 2018. Our supervisory authority is the Information Commissioner's Office (ICO).

• If you are in the European Economic Area, the EU GDPR applies to you and you may complain to the supervisory authority in your country of residence.
• If you are a California resident, the CCPA as amended applies to you. We do not sell or share personal information as those terms are defined there, and we have never done so.

3. Your account data

This is the data you give us about yourself. We are the controller for all of it.

Consent for marketing is a separate tick from the one that creates your account, and a separate tick again from service notices such as a receipt, a security alert or a deletion reminder. Those service notices are part of the contract and cannot be switched off while you hold an account.

4. Guest lists: other people's names

Everyone on the list you paste is a real person who has not signed up here, not read this policy and not agreed to anything. That is the most important fact in this document.

What we process on your instruction

• Guest names as entered, and the card name derived from them
• Titles, where you provide them
• Table numbers, seating constraints and table capacities
• Dietary marks, only if you switch that field on — see section 5
• The original pasted row, kept so you can check the split

What we never do with them

• We do not use guest names, lists or any part of them to train, fine-tune, evaluate or improve any model. This is written into the Data Processing Agreement as a binding term, not offered here as a statement of intent.
• We do not profile guests. There is no field in our database for a relationship, a social note, a seating strategy or any inference about a person, and there never has been.
• We do not sell, share, rent or release guest lists to anyone, including in aggregated or anonymised form.
• We do not contact your guests. We have no way to, and we will not build one.

How long we keep them

• You choose a retention period of 30, 60 or 90 days. If you choose nothing, it is 90 days.
• If you set an event date, everything for that event is deleted 14 days after it, or when your retention period ends, whichever comes first.
• You can delete an entire event and every guest in it at any moment, from the event itself. That deletion is immediate and cannot be undone.
• Deletion means the records are removed from our live systems. Encrypted backups roll off within 35 days, and deleted records are not restored from them.

Access and logging

Reads and exports of a guest list are logged, and you can see that log. Our staff do not open guest lists except where you ask us to look at a specific problem, and that access appears in the same log.

5. Dietary notes and special category data

A dietary mark can reveal a religious belief or a health condition. Under Article 9 of the UK GDPR that is special category data and it needs more care than a table number.

• The dietary field is off by default. Nothing is collected until you deliberately switch it on.
• When you switch it on we tell you, in the interface, that you need a lawful basis for holding it — usually the guest telling you directly.
• We suggest neutral symbols on the printed card rather than words, so the caterer knows and the table does not.
• Dietary notes are deleted with the rest of the list and cannot be given a longer retention period of their own.
• Dietary data is excluded from exports unless you tick to include it, each time.

6. Sub-processors and where data goes

Parts of this service run on infrastructure we do not own. Where that is true for guest names, we say so plainly rather than referring to industry standard providers.

We give 30 days notice before adding or replacing a sub-processor. Notice goes to your account email and appears on this page. If you object, you may cancel before the change takes effect and we will refund the unused part of a yearly plan.

International transfers

Where personal data leaves the United Kingdom or the EEA, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the Standard Contractual Clauses themselves, together with a transfer risk assessment. You can ask us for a copy of the mechanism that applies to a particular transfer.

7. Payments

Billing data is handled by our payment provider. We do not store full card numbers. Card details are entered on a page hosted by that provider and never pass through our servers; what comes back to us is the outcome of the payment, the last four digits, the card brand and the billing country.

We keep invoices and billing records for six years after the end of the relevant tax year because UK tax law requires it. Deleting your account does not delete those records, and cannot.

8. How the data is protected

We take the measures below. We do not describe them as unbreakable, because no honest operator can.

• Data in transit is encrypted with TLS
• Data at rest is encrypted, and guest name fields are encrypted at field level
• Access to production systems requires multi-factor authentication
• Staff access to guest data is limited to a support request you raised, and is logged
• Backups are encrypted and roll off within 35 days
• Passwords are stored as salted hashes and never in readable form

If a breach affects guest data, we notify you within 72 hours of becoming aware of it, with what we know at the time, and we keep updating you. Where the law requires it, we also notify the ICO. As the controller, deciding whether to tell your guests is yours to make; we will give you everything you need to make it.

Read the practical detail on our data and payment security page.

9. Your rights

Over your own data you have the right to:

• Be told what we hold and why, which is this document
• Get a copy of it, in a portable format
• Correct it if it is wrong
• Have it deleted, subject to records we must keep by law
• Restrict or object to how we use it
• Withdraw consent for marketing at any time
• Not be subject to a decision made solely by automated means that has a legal or similarly significant effect — we do not make such decisions

Use the data request form, or email support@maburedeai.shop. There is no charge and we do not ask why.

If you are a guest on someone else's list

You can contact us and we will act, but we have to act through the person who created the list. Tell us the event or the person, and we will pass your request to them and act on their instruction. They decide, not us. That is what being a processor means, and it is also the only way to be sure we do not delete a record on the say-so of the wrong person.

Complaints

If you think we have handled your data badly, tell us first at support@maburedeai.shop. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or, if you are in the EEA, to the supervisory authority where you live.

10. Age

• You may not use this service if you are under 13.
• If you are 13 to 17, you need the consent of a parent or guardian, and we may ask for evidence of it.
• Children's names appear on guest lists all the time. They are third-party personal data like any other name, and they get the protections in section 4. We do not profile them, mark them or treat them differently in any way.

11. Cookies

Set out separately in the Cookie Policy. In short: strictly necessary cookies only, unless you accept the optional ones, and refusing is exactly as easy as accepting.

12. Changes to this policy

When this policy changes we update the version and date at the top. If a change materially affects how guest data is handled, we email account holders at least 30 days before it takes effect, and you may cancel before then. Version 1.0, last updated 15 August 2026.