In short
TableClaim is an app by Flora Ventures VOF. We only ask for what we need to get you to a table that just opened up.
We never use your GPS location: you type in where you are. No ads, no trackers, and we never sell data.
When you claim a table, the restaurant sees your first name, party size, the time and, until 24 hours after the booking time, your phone number.
You can always delete your account and your data yourself in the app.
1. Who we are
Flora Ventures VOF (Chamber of Commerce 42193529, Amsterdam) is responsible for your data. Questions or a request: [email protected].
This policy covers the app and tableclaim.com. The app is for people aged 18 and over.
2. What we keep, why and for how long
Unless stated otherwise below, we use your data to make the app work for you (performance of the contract).
Account: a user ID, your first name, your email or Apple or Google account, and when you accepted the terms. As long as your account exists; after 24 months without use we delete it.
Phone number: needed to go live, so the restaurant can call you. As long as your account exists.
Your spot: what you type at "where are you", rounded to about 100 metres, and your saved spot if you save one. We delete the spot of a live session as soon as it ends.
Going live: when and for how many people. 24 months.
Claims and no-shows: which table, where, when and whether you came, also for the no-show rule (section 3). Tokens and payments: what you got, bought and used. Both 7 years, because the law requires it for our accounts; after you delete your account, without your name and number.
Favourites: to let you know when a table opens up there. A restaurant only sees how many guests, not who. Until you turn it off.
Push notifications: a code for your device, with your consent. You can withdraw it at any time in your phone or the app.
News and offers: only if you turn it on (off by default), with your consent. You can unsubscribe in the app or via the link in every email. We keep when you said yes and no as proof, until 2 years after you unsubscribe.
Feedback after a visit, such as whether the €10 came off the bill: voluntary, to check that restaurants keep the agreement (legitimate interest). 12 months.
Crash reports: technical data when the app crashes, without content or location (legitimate interest). 90 days.
Signing up on the website, tipping a restaurant or emailing us: what you fill in, to reply or to email you when the app is out (legitimate interest, or your consent for emails). 12 months; questions and complaints up to 24 months after they are resolved.
Signing up a restaurant: your name, role, email address and phone number, and the restaurant's email address, phone number, address and its point on the map, kitchen, a description, optionally a Google Maps link, your answers about how busy you are, no-shows and seating, and any photos. To review your sign-up and, once approved, to put your restaurant in the app with its kitchen, description and photo (legitimate interest). Photos stay private until we approve them and are deleted if we turn the sign-up down. We only name your restaurant in posts if you agreed to that, and you can withdraw it at any time. If nothing comes of it, we delete your sign-up after 12 months. You look up the address through PDOK, the Dutch government's address service: what you type in the address field goes to PDOK, the rest of the form does not.
Golden Table: that you won, the amount and where, to settle it with the restaurant. If you delete your account, we keep only an encrypted derivative of your email for 12 months, so nobody wins twice.
3. The pause after no-shows
If a restaurant reports three times within 12 months that you did not come, the app automatically pauses your account for two weeks: you cannot go live or claim. You get a message with every report.
Think a report or pause is wrong? Email [email protected]. One of us looks at it within a month at the latest and hears your side too. If the report is wrong, we remove it and the pause.
The rule is necessary for the contract: without it, released tables would stay empty too often.
4. Who sees your data
The restaurant where you claim: your first name, party size, the time and your phone number (until 24 hours after the booking time). The restaurant is responsible for that itself and may not use it for anything else, such as advertising. It never sees your email or your profile.
Other guests who got the same table: only your first name ("Claimed by …").
If you work at a restaurant, your colleagues see your first name, and we keep your role and which tables you released.
5. Payment
You pay for tokens through Stripe (Ireland), for example with iDEAL. Your bank or card details go straight to Stripe; we only get the amount, the time and whether it worked. Stripe is itself responsible for fraud checks.
6. Who we share data with
We only share data with suppliers who process it on our behalf: Supabase (database and sign-in, in Frankfurt), Cloudflare (website and protecting forms with Turnstile), Expo, Apple and Google (push notifications), Google Workspace (sign-in emails and our mailbox), Resend (email, once we use it) and Stripe (payment).
What you type at "where are you" is looked up by your phone directly at PDOK (Dutch government) and Photon (Komoot, Germany). They see your search term and your phone's IP address, no account data.
If you sign in with Apple or Google, they are responsible for their part. We only give data to authorities when the law requires it. In a takeover, data passes to the successor, under this policy.
A few suppliers are American. We only work with parties under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses; you can request a copy at [email protected].
7. Cookies and security
No advertising or tracking cookies and no analytics software. In the app we only keep what is needed on your device to stay signed in and your settings. On the website only Cloudflare Turnstile sets a functional cookie, when you fill in a form. We do not store raw IP addresses ourselves.
Connections are encrypted and everyone can only read their own data. Only the two partners can access the admin tools. In a data breach we report it to the Dutch Data Protection Authority within 72 hours when required, and to you if it poses a high risk to you.
8. Your rights
You can access your data, have it corrected or deleted, restrict processing, have it transferred and object to processing based on legitimate interest. You can always withdraw consent.
Much of this you do yourself in the app under Profile: your name and number, your notifications and deleting your account. For anything else email [email protected]; we reply within a month. You can also complain to the Dutch Data Protection Authority.
If you delete your account, we immediately delete your name, number, spots, favourites, notifications, tokens and sign-in. What must stay for our accounts (claims and no-shows, and any Golden Table win) we keep without your name and just as well protected.
9. Changes
For a material change we let you know in the app in advance. The date at the top shows when this policy last changed. If the Dutch and English texts differ, the Dutch text prevails.