Privacy.

Plain-language summary

• Guests need no account, name or email. A cookie links your visits to the same restaurant. We store a keyed pseudonym of your connection, not your IP address.
• Restaurants hold the guest relationship. When you use a restaurant's menu, that restaurant is the controller of your data and we process it on its behalf.
• Phone numbers and emails are removed from chats before they are stored or sent to an AI model, unless the restaurant turns this off.
• Analytics and ad pixels only run if you accept them in the cookie banner. You can change your choice at any time from "Cookie settings" in the footer.
• We never sell data. AI requests go only to providers that do not retain or train on prompts.
• You can delete your data. Guests tap "Forget me" in the chat. Restaurant users delete their account in settings. Anyone can email [email protected].

Who we are

tamr is operated by Hephon L.L.C-FZ, a limited liability company licensed in the Meydan Free Zone, Dubai, United Arab Emirates, under commercial licence 2653412.01. When this policy says "we", "us" or "tamr", it means Hephon L.L.C-FZ operating the tamr service.

Controller and processor

Who is responsible for your data depends on how you use tamr.

If you're a guest

If you scanned a QR code at a restaurant and opened its tamr menu, this section is for you. You never need to give a name, email or phone number.

What we collect

Recognition across restaurants

Your taste profile belongs to one restaurant. It is linked to another restaurant only if both restaurants have turned on cross-restaurant sharing, which is off by default. When linked, only hints such as preferred language and allergens carry over.

What the restaurant sees

• Conversation transcripts, with the table or branch and language, identified only by an anonymous guest profile.
• Taste profiles of its own guests.
• Insights such as popular questions, dishes viewed and asked about, and allergen demand.

If a restaurant identifies you another way, for example because you booked a table by name, that is covered by the restaurant's own privacy practices.

Restaurant ad pixels

A restaurant can add its own Meta Pixel, Google Analytics 4, Google Tag Manager, TikTok Pixel or Snap Pixel to its menu. These load only on the restaurant's own address (restaurant.tamr.link) and only after you accept marketing cookies. The restaurant and the ad platform are responsible for what those tools collect. The restaurant decides to add them and configures them, so it is the controller for what they collect on its menu, and each ad platform is a controller in its own right for what it does with the data afterwards. tamr places the tag the restaurant asks for, only after you consent; we do not receive or use the data those pixels send. We are not joint controllers with the restaurant for this, and our agreement with each restaurant requires it to have its own lawful basis and its own notice for any pixel it enables.

Forget me

Tap Forget me in the chat to delete your taste profile, your conversations and your sessions at that restaurant. This cannot be undone.

If you run a restaurant

If you own or work at a restaurant with a tamr account, this section is for you.

What we collect about you

How we use it

• To run your account and serve your menus to your guests.
• To produce the insights and reports in your dashboard.
• To send service email: sign-in codes, invitations, new device alerts and billing notices.
• To keep accounts secure and investigate problems.
• To enforce our Terms and meet legal obligations.

Where the GDPR or an equivalent law applies, the legal basis for each of those purposes is:

Where we rely on a legitimate interest, we have weighed it against your rights and you can object at [email protected]. Where we rely on consent, withdrawing it is as easy as giving it and does not affect what we did before you withdrew it.

Export and deletion

• Export: download your data as JSON from Account settings, Profile, "Your data".
• Account deletion: scheduled for 30 days later, and you can cancel during that time. If you are the only owner of a restaurant that has other members, you must hand over ownership first. Restaurants you own alone are deleted with your account, their subscriptions are cancelled and their uploaded files are removed.
• What stays: sign-in attempt and audit records are kept for their normal period, but your email, IP address and user agent are removed from them.

AI and your data

The AI waiter, the tamr AI assistant and menu import use large language models. Requests are routed through OpenRouter with a setting that excludes providers that retain prompts or train on them. The models we use today come from Google (Gemini) and Anthropic (Claude, reached through Anthropic, Amazon Bedrock, Google Vertex or Microsoft Azure).

• We send the menu content and conversation needed to answer, with phone numbers and emails removed from guest messages.
• We trace AI requests in Langfuse to check quality and fix problems. Emails and phone numbers are masked in those traces.
• The tamr AI assistant can only propose changes to your restaurant. Nothing is applied until an owner approves it in the app.
• AI answers can be wrong. Guests should confirm allergens with staff.

Who else touches the data

tamr runs on a small set of vendors. Each one sees only the data it needs for its job. The full list, with purposes and locations, is on our subprocessors page. In short:

We never sell personal data to anyone.

Cookies and consent

We show our own consent banner and save your choice in the tamr_consent cookie for 6 months. Necessary cookies always run. Analytics and marketing run only if you accept them. Open "Cookie settings" in the footer to change your choice. The full list is on our cookies page.

• Necessary: the tamr sign-in session, the guest cookies tamr.diner and tamr.forget, the consent cookie, and Cloudflare Turnstile's bot check on the guest chat.
• Analytics: PostHog (EU) and Sentry session replay with all text and inputs masked. Without consent, PostHog counts page views in memory only, with no cookies and without your IP address, and forgets them on reload. Our servers send PostHog nothing about you without consent except anonymous counts of what tamr did, such as a waiter reply sent or failed, with the restaurant it happened at and our own response times. These counts carry no identifier for you, your device or your visit, nothing you typed, and cannot be linked to each other or to you.
• Marketing: tamr's Meta Pixel and LinkedIn Insight Tag on our marketing pages, and a restaurant's own pixels on its menu.

How long we keep it

How we protect it

• All traffic is encrypted in transit and served over HTTPS.
• Each restaurant's data is isolated, with membership and role checks on every request.
• Passwords and API keys are stored only as hashes. Sign-in is rate limited, and password sign-in locks temporarily after repeated failures.
• Passkeys and two-factor authentication are available, and owners can require two-factor authentication for their team.
• Database backups are encrypted.

More detail is on our security page. If a breach affects your data, we will tell you, or the restaurant responsible for your data, without undue delay.

Your rights

Depending on where you live, laws such as the GDPR give you the right to:

• Access a copy of the data we hold about you.
• Correct data that is wrong.
• Delete your data, subject to legal retention duties.
• Export your data in a machine-readable format.
• Object to or restrict certain processing.
• Withdraw consent at any time, for example from Cookie settings.

Restaurant users can export and delete their data themselves in account settings. Guests can use Forget me in the chat. For anything else, email [email protected]. Guests have no account, so tell us the restaurant, the date and roughly what you asked, so we can find the conversation. Where the restaurant is the controller, we will pass your request to it and help it respond. We acknowledge a request within 5 working days and answer it within one month of receiving it. If a request is unusually complex we may extend that by a further two months, and we will tell you why within the first month. There is no charge unless a request is manifestly unfounded or excessive. If we cannot act on your request, we will tell you why and how to complain to a supervisory authority.

International transfers

tamr is operated from Lebanon. Our servers and database are in Amsterdam, Netherlands. Some vendors process data in the United States or elsewhere, as listed on the subprocessors page. The subprocessors page names the safeguard we rely on for each vendor individually: in every case a signed data processing addendum incorporating the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914), or the vendor's equivalent processor terms where it is established in a country with an adequacy decision. tamr itself is operated from the United Arab Emirates, and our personnel in the UAE and Lebanon access data remotely under the same Clauses. Neither country has an EU adequacy decision, so we rely on the Clauses together with encryption in transit and at rest, tenant isolation, least-privilege access and audit logging. We can send you the addendum for any vendor on request.

Children

tamr is not directed at children, and restaurant accounts are for adults. We do not knowingly collect data from children under 16. If you believe a child has used tamr and want the data removed, email [email protected] and we will delete it. We use 16 as our threshold because it is the highest age set under Article 8 of the GDPR; where local law sets a higher age for a child's own consent, that higher age applies instead. A guest never needs an account to read a menu or ask a question, and we do not ask a guest's age, so this relies on you telling us.

Changes to this policy

We update this page when the way data flows through tamr changes. We will email restaurant owners about material changes before they take effect. The "Last updated" date at the top always shows the current version.

Contact

Privacy questions, requests or complaints: [email protected].

Security reports: [email protected].

General questions: [email protected].