Privacy policy

Last updated: 29 September 2026.

This policy describes the personal data Atablo processes, why, who it is shared with, how long it is kept and how to exercise your rights. It covers the website, the dashboard, the public menus and the MCP server that lets you connect Atablo to an AI assistant such as ChatGPT or Claude.

1. Data controller

Oxolyn Lab, SIRET 93778233200012, reachable at [email protected].

2. Data we collect

Restaurant owners (account holders)

Account: email address, first and last name sent by the sign-in provider you chose (Google, Apple, GitHub, LinkedIn or Facebook) and the identifier of that account, preferred language and time zone, date and IP address of your latest sign-ins.
Restaurants and menus: name, address, phone number, opening hours, services, social network links, logo and photos, categories, dishes, prices and allergens. This content is meant to be published.
Billing: the state of your subscription and your payment history. Card details are entered at Stripe and never pass through our servers.
Menu import from a photo: the photos you send and a log of each scan (model used, token count, cost, the answer returned).
Referrals: the link between the referring and the referred account, and the amount credited.
AI assistants: the name of the connected application and the access tokens issued to it (see section 5).
Support and newsletter: the messages you exchange with us, and your email address if you subscribed to the newsletter.

Diners (visitors of a menu)

No account, no cookie, no stored identifier. The IP address and browser are turned into a one-way fingerprint, specific to the day and to the restaurant, which can neither be traced back to the visitor nor used to follow them from one menu to another. Only view counts aggregated per day are kept.

Website visitors

Audience measurement is provided by Plausible, without cookies and without any data that identifies a visitor.

3. Purposes and legal bases

Providing the service (account, menus, publishing, imports, statistics, connecting an AI assistant): performance of the contract.
Billing the subscription and keeping accounts: performance of the contract and legal obligation.
Securing the service, fixing errors and answering support requests: legitimate interest.
Sending the newsletter: consent, which you can withdraw at any time from any issue.

No data is sold, used for advertising, or used to train an artificial intelligence model.

4. Recipients and processors

Data is accessible to the Atablo team and to the following providers, each for the sole task entrusted to it:

OVH — hosting of the application and its databases, in France.
Scaleway — image storage and backups, in France.
Stripe — payments and invoicing.
Mailjet — sending emails and the newsletter.
OpenAI — reading the menu photos you import. Only the photos are sent.
Google — importing a Google listing: the link or search you enter is sent to the Places API.
AppSignal — error and performance monitoring.
Chatwoot — support chat.
Plausible — cookieless audience measurement.
Slack — internal notification when an account is opened.

The sign-in provider you choose (Google, Apple, GitHub, LinkedIn or Facebook) sends us your email address and name; we send nothing back to it.

5. Connecting an AI assistant (ChatGPT, Claude…)

You can connect your Atablo account to an MCP-compatible AI assistant, such as ChatGPT or Claude, to read and edit your restaurants and menus in conversation.

The connection only happens after your explicit approval, on a Atablo consent screen. The assistant can only reach your own restaurants, with the same rights you have in the dashboard.
The data the assistant asks for — your email address and subscription status, your restaurants, your menus and their statistics — is sent to it and is then processed by the assistant’s provider (for example OpenAI for ChatGPT or Anthropic for Claude), under that provider’s own privacy policy.
Atablo does not receive your conversations: only the requests the assistant makes to our tools.
An access token expires after two hours and is renewed while the connection is active. To end it, disconnect Atablo in the assistant’s settings, or write to us to revoke every access you granted.

6. Retention

Account, restaurants and menus: for as long as the account exists. Deleting the account from the dashboard erases this data immediately and cancels the subscription.
Invoices: ten years at Stripe, as our accounting obligations require.
Menu view statistics: thirteen months.
Menu import log: kept to track costs, no longer linked to the account once it is deleted.
Log of our team’s interventions on an account: the email address of the account concerned is kept in it, so that we can account for those interventions.
Newsletter: until you unsubscribe.

7. Transfers outside the European Union

The application and its data are hosted in France. Some providers listed in section 4 (notably Stripe, OpenAI, Google, Chatwoot and Slack) may process data in the United States; these transfers rely on the European Commission’s standard contractual clauses or on the EU–US Data Privacy Framework.

8. Cookies

Only strictly necessary cookies are set: the session of a signed-in user, the time zone of their browser and, if you open the support chat, Chatwoot’s cookie that remembers the conversation. No advertising or audience-measurement cookies.

9. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to withdraw your consent at any time. Write to us at [email protected]; we answer within one month. You can also lodge a complaint with the French data protection authority, the CNIL.

10. Changes

This policy may change. The date of the latest update appears at the top of this page, and any significant change is brought to the attention of account holders.