Privacy policy

Last updated 19 August 2026

1. Who we are

ChairHog is a table booking system for restaurants, bars and venues. It is a product of Noximo, and it is Noximo that decides how the personal data described here is handled. In this policy "we", "us" and "ChairHog" all mean Noximo; "you" means whoever is reading it.

If you have a question about anything below, write to privacy@chairhog.com.

2. The two kinds of data, and who is responsible for each

This distinction runs through the whole policy, so it is worth setting out first.

If you booked a table at a restaurant and want to know what it holds about you, the restaurant is the organisation to ask — see section 11.

3. What we hold about you, if you run a venue

When you or a colleague uses ChairHog, we hold:

• Your account. Name, work email address, the role you have been given (owner, manager or host), the sites you can see, and your two-factor authentication setup.
• Your company. Trading name, registered address, VAT details, the sites you operate and the settings attached to each.
• Billing. The number of sites on your account, invoices and payment records. Card details are handled by our payment provider and never reach our servers.
• Sign-in and activity records. The date, time and IP address of each sign-in, and a record of significant changes made in the app — who cancelled a booking, who removed a user.
• Anything you send us. Support emails and the messages attached to them.

Why we hold it, and on what basis

4. What we hold about your guests, on your behalf

When a guest books a table — through the widget on your website, or because a member of your team entered the booking — ChairHog stores what the booking needs: name, email address, telephone number, party size, date and time, the site and table, any notes or dietary requirements the guest gave, and whether they arrived.

We hold that data for the venue and on its instructions only. We do not use it for our own purposes. Specifically, we do not sell it, we do not share it with other venues, we do not build a guest directory across our customers, and we never market to your guests.

We also do not keep it any longer than the booking needs. Once the booking date has passed, the guest's personal details are deleted automatically — the venue does not have to remember, and a guest does not have to ask. A venue can choose to keep a particular guest on its records, and that is a deliberate act, not the default.

Dietary and allergy notes can amount to health data. Only the venue's own team can see them, and we ask venues not to record more than the kitchen actually needs.

5. Cookies

ChairHog uses as few cookies as it can:

• Sign-in and session cookies. Strictly necessary — they are what keeps you signed in and protects the forms you submit against cross-site request forgery.
• Preference storage. Small values held in your browser, such as whether you chose light or dark mode. They never leave your device.
• The booking widget. Uses only what it needs to carry a guest through the steps of a booking.

We do not run advertising cookies and we do not allow third parties to track visitors across other websites through ChairHog.

6. Who we share data with

We use a small number of suppliers to run the service. Each is bound by a written contract, may only act on our instructions, and is used for one job:

• Cloud hosting. Amazon Web Services, for the servers and databases the application runs on.
• Email and SMS delivery. To send booking confirmations, reminders and the codes used for two-factor authentication.
• Payment processing. To take subscription payments and issue invoices.
• Error and performance monitoring. To find faults in the application.

Beyond that, we disclose personal data only where the law requires it, or to establish or defend legal claims. If ChairHog is ever sold or merged, data may transfer with the business, and we will tell you before that happens.

7. Where your data is held

ChairHog's databases and backups are hosted in the European Union. If a supplier ever needs to handle data outside the EEA, we put the European Commission's standard contractual clauses in place first, along with any additional safeguards that transfer needs.

8. How long we keep it

• Account data — for as long as the account is open, then twelve months, so that an account reopened after a quiet winter is not lost.
• Guest and booking data — deleted automatically once the booking date has passed. The personal details attached to a booking (name, email address, telephone number, notes) are removed on a scheduled sweep after the date of the reservation, without anyone having to ask. Two exceptions, both the venue's choice: a guest the venue has deliberately saved to its guest records is kept until the venue deletes them, and a venue may set a longer window if it needs one. Nothing is retained by default.
• Invoices and accounting records — for the period tax law requires, currently six years.
• Sign-in and activity records — twelve months.

When an account closes, we delete or irreversibly anonymise the data within 90 days, except anything we are required to keep.

9. How we protect it

• Hosting. ChairHog runs on Amazon Web Services, in the EU. The application sits behind a web application firewall (WAF) and AWS DDoS protection.
• Encryption. All data is encrypted at rest, and all traffic runs over TLS in transit.
• Payment details. We never store card numbers. Subscription payments are handled by a dedicated payment provider and card data never reaches our servers, so there is none of it here to lose.
• Every ChairHog account is protected by two-factor authentication.
• Access inside ChairHog is limited to the staff who need it to support you, and is logged.
• The role a user is given decides what they can see: a host does not get the owner's view.
• Backups are taken regularly and restores are tested.

No system is perfect. If a breach affects your data, we will tell you and, where the law requires it, the supervisory authority — without undue delay.

10. Your rights

Under the UK GDPR and the EU GDPR you have the right to:

• ask what we hold about you and get a copy;
• have inaccurate details corrected;
• ask us to delete data we no longer need;
• ask us to restrict what we do with it, or object to it;
• receive your data in a portable format;
• withdraw consent where our processing rests on consent; and
• complain to a data protection supervisory authority — normally the one for the country you live or work in.

Write to privacy@chairhog.com and we will answer within one month. We do not charge for this.

11. If you are a guest who booked a table

The venue you booked with decides what happens to your booking details; we only hold them for the venue. Ask the venue first — it can see, correct, export and delete your record itself, and it will get to it faster than we can.

If you cannot reach the venue, write to privacy@chairhog.com and we will pass the request on and help the venue answer it. In most cases your details will already have gone: unless the venue has saved you to its guest records, they are deleted automatically once the date of your booking has passed.

12. Children

ChairHog is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone under 16 other than a child's name appearing in a party size or a booking note entered by an adult making the reservation.

13. Changes to this policy

When this policy changes we update the date at the top. If a change materially affects how we handle your data, we will email account holders before it takes effect.

14. Contacting us

Privacy questions, requests and complaints go to privacy@chairhog.com, and reach Noximo, the company behind ChairHog. We answer within one month.

See also our terms and conditions.