Legal
AI and vendor disclosure
Shop & Table runs on an AI system that we built and operate, on models from Anthropic, OpenAI and Google, with our team reviewing every launch and you approving anything customer-facing. This page is the plain record of that: what the AI does, every company that processes your information on our behalf, what reaches each one, the commitments we hold, and the rights you keep. The story version, with the reasoning, is at how we use AI.
1. How we use AI
Our workflows send the facts you give us and the public information about your business to large language models to draft, analyze and check work: website copy and pages, menus and catalogs, point-of-sale item libraries, email and text campaigns, social posts, review replies, reports and recommendations. The system also monitors your reviews, rankings, listings, competitors and, where you connect it, your sales data, and proposes improvements. We choose the model for each job; no single vendor runs everything.
What it learns stays in your account. Each client has a private record of facts, preferences and measured outcomes that our workflows read before they work. It is separated from every other client’s at the database level, it is not used to train any model, and it exports and deletes with the rest of your data.
2. Human review and your approval
- Every launch (a website, a point-of-sale configuration, a migration, a campaign program) is reviewed by a member of our team before it goes live, against a written QA record you can read.
- After launch, nothing customer-facing is published until you approve it in the portal. If you switch a channel to auto-approve, work on that channel publishes without a further review, and the portal shows that setting.
- Our team handles anything the system flags for review and samples the ongoing work on a schedule. You can request a human review of any single piece at any time from the portal.
3. What we never do
- We manage your reputation: we monitor reviews, draft your replies for your approval, ask your real customers for reviews after a visit, and route complaints to you. We never write, pre-write, buy, incentivize by rating, suppress, or seed a review, on behalf of your business or your customers; the FTC’s rule on consumer reviews (16 CFR Part 465) and Google’s policies prohibit it, and we do not use tools that do it.
- The AI phone assistant identifies itself as an AI assistant at the start of every call, and any chat assistant identifies itself as AI. Calls are recorded or transcribed only where you have enabled it and the caller is told.
- Your information is never used to train an AI model, ours or a vendor’s, and is never sold, rented or shared for anyone else’s marketing.
- Card numbers never reach an AI model. Payments are processed by your point-of-sale platform under its own security standard.
4. Model providers
The companies whose models our system uses, what each does, what reaches it, and the commitment we rely on.
| Provider | What it does for you | What reaches it | Data commitment |
|---|---|---|---|
| Anthropic (Claude) | Our primary model: drafting, analysis, the agent workflows that run the platform and the portal’s intelligence. | Business facts you give us, the content we draft for you, public listing and review text, de-identified performance data. Never card numbers. | Commercial API terms: inputs and outputs are not used to train Anthropic’s models. |
| OpenAI | Additional models for specific jobs where they perform better, such as certain image, transcription or classification tasks. | The same categories as above, for the jobs routed to it. | API data is not used to train OpenAI’s models by default. |
| Google (Gemini) | Additional models for specific jobs, and the search and listing data described below. | The same categories as above, for the jobs routed to it. | Paid Gemini API tier: prompts and responses are not used to improve Google’s products. |
5. Services that process your information for us
Data, delivery and hosting providers. Each one processes information only to do the job described, under its own privacy terms, and none of them trains on your data.
| Provider | What it does for you | What reaches it | Data commitment |
|---|---|---|---|
| Google Business Profile, Places and Analytics | Your listing, its reviews and rankings, and your website’s traffic. | Your business name, address, phone, hours, categories, reviews; anonymized site analytics. | Processed under Google’s terms; we act on your Business Profile only with your authorization. |
| DataForSEO | Search rankings, keyword and competitor data for the reports. | Your business name, location and category; public search results. | Processes queries on our behalf; no customer data. |
| Synup | Keeps your listings accurate across directories on the plans that include it. | Business name, address, phone, hours, categories, photos. | Processes listing data on our behalf. |
| HighLevel | Our telephony, messaging, lead CRM and voice-AI platform: missed-call text-back, texts and emails to your customers, the AI phone assistant, the booking calendar and forms on the plans that include them. | Your customers’ names, phone numbers and email addresses, message and call content, call recordings and transcripts where enabled, and your booking and lead records. | Processes messaging and CRM data on our behalf; carrier registration (A2P 10DLC) and consent records are kept in the platform. |
| Twilio and Resend | Text-message and email delivery for the forms and reports on this site. | The recipient’s phone number or email address and the message. | Deliver on our behalf; no training, no marketing use. |
| Close | Our own CRM: the record of who asked us for what. | Your name, business, contact details, what you asked for and the notes from our conversations. | Processes our customer records on our behalf. |
| Cal.com | Scheduling for the discovery call. | Your name, email, phone and the notes you add to the booking. | Processes booking data on our behalf. |
| Intercom | The chat and support messenger on this site and in the portal. | What you write in the chat and the page you were on. | Processes support conversations on our behalf. |
| Vercel and Supabase | Hosting for this site, the portal and the platform’s database. | Everything the portal stores, encrypted, with each client’s data separated at the database level. | Infrastructure providers under their own security and privacy terms. |
| Termly, Google Tag Manager and Microsoft Clarity | Consent management and anonymized usage analytics on this site. | Consent choices; anonymized page interactions where you allow them. | Governed by your cookie choices on this site. |
6. The platforms we set you up on
These are your accounts, opened in your name, governed by the platform’s own terms. We configure them and act on them only with your authorization, and we stay on the account with you for as long as you want us there.
| Platform | What it does for you | Where your data lives | Our role |
|---|---|---|---|
| Square | Point of sale, online ordering, payments, loyalty and marketing for the businesses we set up on it. | Your catalog, sales, customers and payments live in your Square account, in your name. | We configure and act on your account only with your authorization; Square’s terms govern your data there. We are a Square partner. |
| Toast | Point of sale and online ordering for the restaurants we set up on it. | Your menu, sales, guests and payments live in your Toast account, in your name. | We configure and act on your account only with your authorization; Toast’s terms govern your data there. |
| Shopify | The online store and point of sale for the retailers we set up on it. | Your products, orders, customers and payments live in your Shopify account, in your name. | We configure and act on your store only with your authorization; Shopify’s terms govern your data there. We are a Shopify partner. |
7. Your rights and controls
- Export. Your content, your customer list, your reports and the record of what the system learned about your business can be exported from the portal at any time.
- Delete. When you leave, your data is deleted from our systems on the schedule in the privacy policy. Your domain, your Google profile and your platform accounts were in your name from the start, so there is nothing to hand back.
- Correct. Anything the system holds about your business can be corrected from the portal or by asking us.
- Contribute, if you choose. As the platform evolves, you will be able to contribute anonymized, aggregated patterns to benchmarks for businesses like yours and receive those benchmarks in return. That setting is off until you turn it on and never includes customer names or contact details.
- Your customers’ rights. Every text carries an opt-out that is honored immediately, every email an unsubscribe, and consent records are kept. Requests from your customers about their data are handled through you or, where the law provides, directly.
8. Keeping this page true
This page is the operational record behind our privacy policy; the two are updated together when a vendor is added, replaced or removed, and the date below changes when they are. If something on this page stops being true, it is corrected here first.
This disclosure covers Shop & Table’s services and the client portal and was last updated in September 2026.
Questions about this disclosure: hello@shopandtable.com.
