Privacy Policy
Last updated: 24 October 2026
This policy explains how Lost Group Ltd t/a Taybl ("Taybl", "we", "us") uses personal data on Taybl Discover (taybl.co.uk), the website where people find restaurants and pubs to book a table.
We are the controller of the personal data described here. Our address is 3 Caxton Road, Preston, PR2 9ZZ. You can contact us at support@taybl.food.
This policy covers three groups of people:
- Visitors: anyone who uses taybl.co.uk, with or without an account.
- Account holders: people who create a Taybl account to book.
- People at restaurants and pubs: owners, managers and staff of venues that appear on Taybl Discover, whether or not they use Taybl's booking system.
If you use Taybl's booking system as a venue, or you are a member of a venue's staff, our other privacy policy at taybl.food explains how we handle that data. When you book a table, the restaurant is responsible for your booking details (see section 5).
1. What we collect and why
1.1 When you visit the site
| What | Why |
|---|---|
| Your internet (IP) address, browser and device type, and the pages you request, in our hosting provider's server logs | To deliver the site, keep it secure and fix faults |
| What you type in the "Where" box (a town or postcode), which we send to a UK place lookup service (postcodes.io) to suggest places and work out distances | To show restaurants near where you want to eat. We send only the letters you typed, nothing about you |
| If you choose "Use my current location": your browser's position, sent to our server, which passes it to a UK postcode lookup service (postcodes.io) to find the postcode district (such as PR1), and then discards it | To search near you. We do not store the exact position, and it is never put in a web address. Only the district is used, and if you use the place picker in the header it is kept in your browser |
| The place you choose in the header (for example "Manchester"), kept only in your browser's storage on your device | To fill in the "Where" box next time. It is not sent to us until you search, and you can clear it from the same menu |
| Analytics about how the site is used (pages visited, device, approximate area), only if you accept analytics cookies | To understand and improve the site. Nothing is collected for analytics unless you accept |
1.2 If you create an account
| What | Why |
|---|---|
| Your email address | To create your account, sign you in with a code, and send you messages about your account |
| Your first name, and optionally your last name and mobile number | To fill in your details when you book, and to greet you |
| A record of what you agreed to (terms, this policy, sharing your details with restaurants, Taybl news and offers), with the date and the version you saw | To show we have your agreement and to respect your choices |
| Your sign-in sessions: when each started and was last used, and the type of browser and device (for example "Chrome on macOS") | To keep you signed in for up to 30 days, let you see and end your sessions, and keep the account secure |
| Temporary sign-in codes (stored only in scrambled form) and a short record of recent sign-in attempts from your internet address | To let you sign in and to stop people guessing codes |
| If you sign in with Google: your Google account's unique identifier and email address | To recognise you when you sign in with Google. We do not receive your Google password or access any of your Google data |
| The bookings you make while signed in (restaurant, date, time and party size) linked to your account | To show you your own bookings and let you change or cancel them |
| The restaurants you save (a private list, up to 200, that only you can see), with the date you saved each | To show you your saved restaurants on any device. You can remove any of them at any time, and the list is deleted with your account |
We do not ask for or store passwords, payment card details or health information (including allergies) in your account.
1.3 If you are a restaurant or pub listed on Taybl Discover
Many venues have a page on Taybl Discover that we created from public information, before the venue contacted us. We do this to help people find places to eat. For a venue this can include information about individuals, for example where a sole trader or owner's name, business email address or phone number is published as the venue's contact.
| What | Where it comes from |
|---|---|
| The venue's name, address, phone number, website, type of venue, cuisine and opening information | The venue's own website, public business listings and public registers |
| A business contact email address | The venue's own website or public listing |
| The date we last checked the information, and where it came from | Our own records |
We use this to publish a short page that links to the venue's own booking page, and (with a limit on how many we send each day) to email the venue once to tell it the page exists, with a link to claim, change or remove it, followed by one reminder if it hasn't responded. Our lawful basis is our legitimate interests in running a directory of restaurants and in telling businesses about it; we have weighed this against your interests and rights, and it is easy to object (see section 7).
You can ask us to remove a page at any time, using the link on the page or in our email. When a page is removed we keep a scrambled (hashed) copy of the business email address and a reference for the venue, only so that we do not list or email it again. We do not keep the rest of its details.
If a venue claims its page, it proves it controls its email address (by clicking a single-use link), then it can add a description, photos, opening times and other details. Our team checks the first submission before guests see it. We count how many people click "Book direct" on a page (a daily total for the venue; we do not record who clicked) so we can tell the venue how many visitors we sent.
1.4 Emails and messages
We send sign-in codes, notices about your account, and (only if you ticked the box) Taybl news and offers. We never send marketing on behalf of a restaurant. Our email provider (Resend) delivers these emails and records whether they were delivered or bounced.
2. Our lawful bases
- Running your account and bookings: to provide the service you asked for (contract).
- Security, preventing abuse, and keeping the site working: our legitimate interests in keeping the service safe.
- Telling you about your account (sign-in codes, a deletion request, a warning that an unused account will be deleted): to provide the service, and our legitimate interest in keeping you informed.
- Taybl news and offers, and analytics cookies: your consent. You can withdraw it at any time.
- Sharing your details with a restaurant when you book: your consent, and to carry out your booking.
- Venue directory pages and emails to venues: our legitimate interests, as explained in section 1.3.
- Legal obligations: where the law requires us to keep or share information.
3. Who we share data with
- The restaurant you book with, only for that booking. If you agree, we send the restaurant the name, email and mobile number you chose to share. A restaurant never learns that you have an account, and never sees other restaurants you have booked, your sign-in history or your choices about Taybl.
- Companies that process data for us (our "processors"), who may only use it to provide their service to us: Vercel (hosting), Neon (database), Resend (email), UploadThing (storage of photos venues upload).
- Google, if you choose to sign in with Google (for that sign-in only), and for analytics only if you accept analytics cookies. Analytics is not connected to your account.
- postcodes.io, a UK place and postcode lookup service, which receives the place name or postcode you type in the "Where" box, and, for "Use my current location", a position sent from our server so it can return the nearest postcode district. It is not told who you are.
- Authorities, where the law requires it.
We do not sell personal data.
4. Where data is processed
Our hosting and database are set up to keep data in the UK or EU. Some of our processors, including Google, are based in the United States. Where data is transferred outside the UK, we rely on safeguards such as the UK International Data Transfer Addendum or an adequacy decision.
5. Bookings
When you book a table through Taybl Discover you are booking with the restaurant, using Taybl's booking system, or via another booking system the restaurant has chosen to use. The restaurant is responsible for the details of your booking, including any notes you add, such as allergies, and decides how long to keep them. Taybl processes those details for the restaurant. Deleting your Taybl account does not delete a restaurant's own record of a booking; ask the restaurant if you want it removed.
6. How long we keep data
| Data | How long |
|---|---|
| Your account | Until you delete it, or until it has been unused for 24 months. We email you at 23 months and delete it at 24 months unless you sign in |
| If you delete your account | It is deleted 14 days after you ask, and you can change your mind in that time by signing in and choosing "Keep my account". Deletion removes your name, email address, mobile number, choices and sessions. We keep a blank record (an internal reference number and dates) to show the deletion happened |
| Sign-in sessions | End after 30 days or when you sign out; expired sessions are removed daily |
| Sign-in codes | Valid for 10 minutes and removed within a day of use or expiry. Records of recent sign-in attempts are removed within 24 hours |
| Bookings you made | Kept by the restaurant under its own policy. Taybl keeps only a link from your account to each booking, which is removed when you delete your account |
| Venue directory information | While the page is live and the information is accurate. Information a venue asks us to remove is deleted, except the scrambled email reference described in section 1.3 |
| Server logs | Up to 30 days |
7. Your rights
You can see and change your details, your choices and your sessions on your account page, download a copy of your data there, and ask for your account to be deleted.
Under UK data protection law you also have the right to ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, and to object to uses based on our legitimate interests (including directory pages and emails to venues). Where we rely on your consent, you can withdraw it at any time. Contact us at support@taybl.food and we will respond within one month.
You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
8. Cookies
| Cookie | What it does | Lasts |
|---|---|---|
| taybl_session | Keeps you signed in. Strictly necessary for accounts | Up to 30 days |
| taybl_consent | Remembers your choice about analytics cookies | 6 months |
| taybl_claim | Lets a venue edit its page after clicking its single-use link. Strictly necessary for that | 2 hours |
| taybl_google_oauth, taybl_google_pending | Make Google sign-in work, and protect it from forgery. Strictly necessary for that | A few minutes |
| Google Analytics cookies (for example _ga) | Count visits and how the site is used. Only set if you accept | Up to 2 years |
We do not use advertising cookies. You can change your analytics choice at any time with "Cookie settings" in the footer.
9. Children
Taybl accounts are for people aged 16 or over. We do not knowingly collect personal data from children.
10. Security
We use appropriate technical and organisational measures, for example encrypted connections, scrambled storage of sign-in codes, limits on repeated sign-in attempts, and access controls on our systems. No system is completely secure.
11. Changes to this policy
We may update this policy. If a change is significant we will tell account holders by email or on the site before it takes effect, and the date at the top will change.
12. Contact
Lost Group Ltd t/a Taybl, 3 Caxton Road, Preston, PR2 9ZZ. Email support@taybl.food.