Privacy

A venue is a café, restaurant or group that subscribes to Maître. Its staff have named accounts. A guest is someone who scans a code on a table. A guest has no account, is never asked for a name, and is not asked to sign up for anything.

For data-protection purposes the venue is the controller of its own guests' data and Maître is its processor. We act on the venue's instructions for that data. For venue staff accounts and for our own billing, Maître is the controller.

• What they type in the chat. The messages themselves, so the agent can answer and so the venue can see what was ordered and why.
• Their order. Items, quantities, table, price, and anything attached to it such as "no coriander".
• Their passport, if they agree to one. Allergens, diet, spice tolerance and language. This is the only thing that follows a guest between visits, it is stored against a random token in their own browser and nothing else, and it holds no name, no contact details and no payment information. Someone who stole the token would learn that an anonymous person avoids peanuts.
• Their email address, only if they ask for a receipt. It is used for that receipt and is not added to any marketing list.
• Ordinary technical data. IP address and browser, kept briefly to stop abuse and to keep the service up.

• Answer the guest, in their language, and get the order to the kitchen correctly.
• Flag an allergy on the ticket so the kitchen sees it.
• Show the venue its own sales, stock and service history.
• Keep the service running, and stop people abusing it.
• Bill the venue for its subscription.

We do not sell data. We do not share one venue's data with another. We do not use guest conversations to train any AI model, and nor does our model provider — see below.

Maître is built on a small number of named services. Each is listed here with what it actually receives, because "trusted partners" tells you nothing.

• Anthropic — the AI that reads and replies. It receives the conversation and the menu. Under our commercial terms it does not use that content to train its models.
• Supabase — the database and staff sign-in. It holds everything above, at rest, encrypted.
• Vercel — hosting. It handles the requests and keeps short-lived technical logs.
• Resend — email. It receives an address and a message only when an email is actually being sent, such as a receipt a guest asked for or a sign-in code.

We will also disclose data where a law we are subject to requires it. If that ever happens and we are permitted to say so, we will tell the venue.

• Orders and sales history: kept while the venue is a customer, because that is the venue's own trading record, and deleted within 90 days of the account closing unless the venue asks us to export it first.
• Chat messages: kept for 12 months, then deleted.
• Guest passports: kept until the guest deletes one, or until 24 months pass with no visit.
• Technical and abuse logs: kept for 30 days.

Data is processed on servers in the regions our providers operate in, which may be outside the country a guest is sitting in. Where that transfer needs a legal mechanism, we rely on the standard contractual clauses our providers offer.

A guest can empty their passport from inside the chat at any time, without asking anyone and without giving a reason.

Depending on where someone lives, they may have the right to ask for a copy of their data, to have it corrected, to have it deleted, to object to how it is used, or to complain to a regulator. We honour these regardless of whether a particular law applies, because arguing about jurisdiction is not a good use of anybody's week.

This covers, among others, the UK and EU GDPR, Thailand's PDPA, and India's Digital Personal Data Protection Act. A guest's request about their own visit is usually best made to the venue, which is the controller; write to us and we will route it.

Write to hello@maitreai.space. We answer within 30 days.

Maître is for ordering food in a venue and is not directed at children. We do not knowingly collect data from a child. A parent ordering for a child — "my son is six and allergic to nuts" — is telling us about an allergy at a table, not creating a profile of a child, and nothing about that message is kept against that child.

If we change this page in a way that matters, we will tell every venue by email before it takes effect rather than quietly moving the date at the top. This version is dated 13 October 2026.