Cours Privacy Policy

01 · SCOPE

Who this policy covers

This Privacy Policy applies when you visit a Cours website, create or use a Cours account, browse restaurant offers, connect to a reservation provider, submit a form, use Cours support, or manage a restaurant through Cours Partner. “Cours,” “we,” and “us” refer to the Cours business operating these services.

A restaurant or an external reservation provider may separately control information it receives. Its own privacy policy also applies to its use of that information.

02 · CUSTOMERS

Information we collect about diners

• Account and contact information: name, email address, required mobile number, account identifiers, authentication status, and communication choices. If you choose Google sign-in, Google supplies the basic account details you authorize, such as your name and email address.
• Dining activity: restaurants and articles viewed or saved, reservation details, party size, time, booking status, invitations, reviews, and support requests.
• Dining needs: optional dietary preferences, allergy notes, accessibility needs, or special requests that you choose to provide.
• Location: device location only after permission, to show a map or sort nearby restaurants. You may decline and browse without precise location.
• Payments: payment status, amount, currency, and provider references when a guarantee, deposit, or prepaid offer is enabled. Cours does not store full card numbers or card security codes.
• Device and usage information: consented product interactions, session identifiers, browser or device information, and diagnostics needed to secure and improve the service.

Supabase provides Cours account authentication. Cours cannot read your password.

03 · RESTAURANT PARTNERS

Information we collect about restaurants and their teams

• Restaurant name, address, cuisine, description, public phone, public email, website, menus, prices, photographs, schedules, capacity, policies, and connected reservation-provider information.
• Authorized team-member names, work emails, roles, account identifiers, access history, support requests, and changes made in the partner workspace.
• Booking, attendance, menu-performance, settlement, and operational records needed to provide the partner service.
• Application and onboarding information submitted through the website or directly to the Cours team.

Public listing information is displayed to customers. Guest information available to a restaurant is limited to what it reasonably needs to recognize, communicate with, and serve that guest or manage the relevant reservation.

04 · WEBSITE, APPS & ANALYTICS

Information collected automatically

Cours uses local storage, cookies, or similar technology for sign-in, security, preferences, consent, and basic service operation. Optional analytics is used only when consent is enabled. Cours does not use advertising SDKs or sell personal information for cross-context behavioral advertising.

Error-monitoring services may receive technical diagnostics such as app version, device type, route, timing, and crash details. Cours configures diagnostics to avoid passwords, full card details, and unnecessary personal content.

05 · WHY WE USE INFORMATION

How Cours uses information

• Create, secure, authenticate, and support customer and partner accounts.
• Show curated restaurant offers and, where enabled, connect or facilitate reservations.
• Send essential verification, reservation, security, and service messages.
• Share the necessary guest and reservation details with the relevant restaurant or connected reservation provider.
• Process guarantees, deposits, refunds, and related payment records through Stripe when enabled.
• Maintain accurate menus, availability, partner access, audit history, and operational reporting.
• Prevent abuse, investigate errors, enforce terms, and comply with law.
• Measure and improve Cours when analytics consent is enabled.

06 · SHARING

Who receives information

• Restaurants: the guest and reservation information needed to manage and serve a reservation.
• Reservation and restaurant systems: OpenTable, Resy, Toast, Google, or another provider only when a restaurant or customer uses that connection.
• Service providers: Supabase for authentication and data infrastructure; Google if you choose Google sign-in; Stripe for payments; Resend for transactional email; Sentry for diagnostics; OpenAI for the optional AI support assistant; and hosting, security, and communications providers needed to operate Cours.
• Legal and safety recipients: when reasonably necessary to comply with law, protect people, prevent fraud, or defend legal rights.
• Business transfers: as part of a financing, merger, acquisition, or sale, subject to appropriate confidentiality and legal requirements.

Cours does not sell personal information. Cours does not share personal information for cross-context behavioral advertising.

07 · DIETARY & ALLERGY INFORMATION

Treat dining needs as sensitive

Dietary preferences, allergy notes, accessibility needs, and special requests are optional unless a restaurant needs specific information to safely serve a request. Cours uses them only to support dining and the relevant reservation. They may be shared with the selected restaurant and connected reservation provider. Do not use Cours for medical advice or emergencies.

08 · PAYMENTS

Card information stays with Stripe

When payment is enabled, Stripe collects and processes card information under its own privacy terms. Cours receives limited payment status and reference information needed to connect a payment to a reservation, manage a refund, prevent fraud, and keep required transaction records.

09 · AI SUPPORT

How the Cours assistant handles a conversation

The Cours support assistant is automated and may be inaccurate. It is limited to general Cours guidance and cannot independently cancel or modify a reservation, issue a refund, change an account, make a restaurant decision, or provide legal, medical, or financial advice. Important actions require confirmation or review by the Cours team.

Your support message is sent to OpenAI to generate an answer. Cours requests that responses not be stored as application state and does not use support conversations to make decisions about eligibility or access. Under the provider’s default API controls, message content may be retained for abuse monitoring for up to 30 days and is not used to train its models unless Cours expressly opts in. Do not enter passwords, authentication codes, full card numbers, bank information, government identifiers, or medical records.

10 · RETENTION

How long information is kept

Cours keeps information only as long as reasonably needed for the service, account security, legal and tax requirements, disputes, fraud prevention, and documented business operations. Account data is reviewed for deletion after a valid request. Certain reservation, payment, audit, or legal records may be retained after account deletion where required or reasonably necessary. Backup copies age out under the applicable backup schedule.

The current AI assistant does not attach chat history to a Cours account or store it in the Cours database. Messages may still be retained temporarily by the AI provider as described above.

11 · SECURITY

How Cours protects information

Cours uses encrypted network connections, authenticated access, row-level database controls, role-based permissions, restricted administrative credentials, monitored systems, and service-provider security controls. No system can guarantee absolute security. If you believe your account or information is at risk, contact Cours immediately.

12 · YOUR CHOICES & RIGHTS

Control your information

• Update available account, contact, restaurant, and preference information in the relevant app.
• Decline location permission or optional analytics without losing basic browsing access.
• Unsubscribe from marketing; essential account, security, and reservation messages will continue.
• Request access, correction, export, restriction, objection, or deletion where applicable.
• Use Delete account in the customer app or submit a deletion request online.

Cours will verify a request before acting and may retain information where law permits or requires it. Cours will not discriminate against you for exercising an applicable privacy right. Authorized agents may submit requests where local law allows.

13 · CHILDREN

Cours is not directed to children

Cours is not intended for children under 13, and we do not knowingly collect personal information from them. Contact us if you believe a child has submitted information.

14 · INTERNATIONAL USE

Information may be processed in the United States

Cours is launching in the United States and uses service providers that may process information in the United States and other countries. Privacy protections may differ from those in your home country. Where required, Cours will use appropriate transfer safeguards.

15 · CHANGES

Policy updates

Cours may update this policy as the service, providers, or law changes. The effective date will be updated, and material changes will be presented through the website, app, or account communication when required.

16 · CONTACT

Privacy questions and requests

Email admin@dinewithcours.com. Include the email connected to your Cours account and the request you want us to review. Never send a password, authentication code, or full card number.