Privacy

Last changed 26 October 2026.

Bartools helps pubs, bars and restaurants teach their staff the menu with short quizzes. It's run by Tommy. This page says what it keeps about you, why, for how long, and what you can ask for.

If you're taking a quiz

Your venue gave you a personal link. You don't have an account, and we don't ask for your email, phone number or anything else.

  • What's kept: the name your venue gave you (a first name), your link, and each go at the quiz: your answers, your score, and when.
  • Who sees it: the managers who run your venue's Bartools. It's used to see how training is going. Whoever runs Bartools can reach it too, to keep the service working, but doesn't look at it otherwise.
  • Why that's allowed: training its team on the menu is a legitimate interest of your venue, and only what that needs is kept.
  • How long: while you're on your venue's team. When they remove you, your link stops working at once, and your name and results are deleted 12 months after that (sooner if your venue deletes them).
  • Your rights: you can ask your venue to show you, correct or delete what's kept about you, or to stop using it. They can do it straight away in Bartools.

Your venue is responsible for your data (in data protection terms, the “controller”); Bartools stores it for them and does nothing else with it (the “processor”).

If you run a venue's Bartools

For your own login, Bartools is the controller. It uses your details to provide the service you signed up for (the contract between us).

  • Your login: your name, email and password (stored only as a secure hash), and when you agreed to the terms. Used to sign you in and to send you account emails, like a password reset. Never for marketing.
  • When you sign in: your IP address and browser, kept with your sign-in until it ends (about a week), to keep your account secure.
  • Your venue: its name, look and logo, the menu, your quizzes and your team's results, kept until you delete them. Menu photos you scan are read, then not kept by Bartools.
  • Your rights: download your venue's data (Settings), delete a past staff member's results (Staff), your venue (Settings) or your account (Your account) at any time. To see or correct anything else, ask us (below). A login left with no venue (its venue deleted, or removed by another admin) is deleted a month later.
  • Feedback you send: your note, any screenshot, your first name, your venue, the page you were on and your browser. It becomes a confidential issue on GitLab, where it's worked on; Bartools deletes its own copy after 90 days (the screenshot as soon as GitLab has it). Ask us (below) to delete the GitLab issue too.
  • Limits: each staff link can start 20 goes a day, so nobody's results can be flooded.

If you asked to hear when Bartools opens

  • What's kept: your email, your venue's name if you gave it, and when. Your connection's address is kept only as a scrambled code, to stop anyone signing up hundreds of addresses.
  • Why: you asked us to (your consent), and only to tell you when Bartools opens. Never for anything else, and never shared.
  • How long: until we've told you, then it's deleted. Ask us (below) to delete it sooner.

Who else handles it

Bartools uses these companies to run, each only for its part:

  • Hetzner (in the EU): the server and database.
  • Cloudflare: delivers the site securely, checks you're a person on the sign-up, password-reset and “hear when it opens” forms (Turnstile), and keeps encrypted backups (deleted after 30 days).
  • Anthropic (US): reads the menu photos you scan. It may keep them for a short time under its own policy. Menus aren't personal data, so don't photograph anything that is.
  • GitLab (US): keeps the feedback you send, as a confidential issue.
  • Resend (US): sends account emails such as password resets, so it sees your email address.

Where data goes to the US, it's covered by the UK's data bridge with the US or by the standard contract clauses in these companies' terms.

Cookies

Bartools sets only the cookies it needs to work, and none for tracking or advertising, so there's nothing to accept. Staff taking a quiz get none.

  • better-auth.session_token: Keeps a venue manager signed in. Lasts 7 days from when you last signed in or made a change; removed when you sign out.
  • bartools-venue: Remembers which of your venues you're working on. Lasts 1 year; removed when you sign out.

Questions or complaints

About your quiz results: ask your venue first. About Bartools itself, or your login: contact@tapps.vip. You can also complain to the Information Commissioner's Office (ico.org.uk).