ChezList Privacy Policy

Last updated: July 3, 2026

This Privacy Policy explains how Chezlist Inc. ("ChezList", "we", "us", or "our") collects, uses, discloses, and protects personal information in connection with the ChezList waitlist and reservations service (the "Service"), available at chezlist.ca, app.chezlist.ca, and waitlist.chezlist.ca.

1. Who we are and how this policy works

ChezList provides restaurants, bars, cafés, and other hospitality businesses (each a "Business") with tools to manage waitlists and reservations. Guests scan a QR code to join a waitlist; Business staff manage the list; Business administrators manage their account.

We handle personal information in two different roles, and this policy is organized around that distinction:

• As a controller — for the personal information of the Businesses and their staff who hold ChezList accounts. We decide how this information is used, and this policy governs it directly.
• As a processor (service provider) — for the personal information of guests who join a waitlist or make a reservation. In that case the Business is the party that decides how the information is used; we process it on the Business's behalf and under the Business's own privacy practices. Guests with questions about their information should contact the Business directly (see Section 8).

2. Information we collect

The specific information we collect depends on how you use the Service and the features a Business has enabled. It generally falls into the categories described below. Because the Service evolves over time and Businesses can configure their own forms and fields, the examples given in this section are illustrative and not exhaustive.

2.1 Business account information (we act as controller)

Information provided when a Business signs up for and manages a ChezList account. This includes contact and organization details (such as names, email addresses, business name, address, and phone number), account login credentials managed through our identity provider (see Section 5), billing information processed by our payment provider (see Section 5), and any other information a Business chooses to provide.

2.2 Guest information (we act as processor on behalf of the Business)

Information collected on the Business's behalf when a guest interacts with a waitlist, reservation, or other guest-facing form. This includes contact and identification details (such as name and mobile phone number), booking details (such as party size, notes, or preferences), and any other information the guest or the Business chooses to provide through the Service.

2.3 Information collected automatically

When anyone uses the Service, our infrastructure providers may collect standard technical information such as IP address, device and browser type, and access logs, for security and reliability purposes.

2.4 Information you provide when you contact us

When you contact us or submit a form on our marketing site, we collect the information you choose to provide, such as your name, email address, and the contents of your message.

3. How we use personal information

We use personal information to:

• Operate the waitlist and reservation features, including displaying a guest's position and status to Business staff;
• Send SMS text notifications to guests — for example, to tell a guest their table is ready (see Section 4);
• Create and manage Business accounts and process subscription billing;
• Provide customer support and respond to inquiries;
• Maintain the security, integrity, and reliability of the Service; and
• Comply with legal obligations.

4. SMS text messages and consent (CASL)

ChezList sends transactional text messages to guests — such as a notification that their table is ready. These messages are triggered by the guest joining a waitlist and providing their phone number for this purpose.

• Text messages are used for waitlist and reservation notifications, not for marketing.
• Standard message and data rates may apply.
• A guest may opt out at any time by replying STOP to any message, or by leaving the waitlist. Opting out may prevent us from notifying the guest when their table is ready.

For details on how guests opt in, message frequency, and STOP/HELP handling, see our SMS Messaging Terms at chezlist.ca/sms-terms.

5. Who we share personal information with

We share personal information only as needed to operate the Service, with the following categories of service providers ("subprocessors"):

In addition:

• Businesses can view the guest information submitted to their own waitlists and reservations.
• We may disclose personal information if required by law, or to protect the rights, safety, or property of ChezList, our users, or the public.
• If ChezList is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction.

6. Data retention

• Business account information may be retained for as long as the account is active, and for 6 months after the account is closed, unless a longer period is required by law.
• Guest waitlist and reservation information may be retained for 1 month. Note that after a guest leaves a waitlist or a reservation is completed, a record may be retained in our history archive for 24 months to support the Business's operations and reporting.

Businesses may configure or request changes to retention where the Service allows.

7. Where your information is stored and processed

Personal information is primarily stored in AWS data centres in Canada. Some subprocessors and ancillary services (including SMS delivery and payment processing) operate in the United States, which means your information may be transferred to, stored in, or processed in the United States. When personal information is in another country, it is subject to the laws of that country and may be accessible to that country's courts, law enforcement, and regulatory authorities.

8. Your privacy rights

Subject to applicable law (including Canada's Personal Information Protection and Electronic Documents Act), you may:

• Request access to the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Withdraw consent, including for SMS notifications; and
• Request deletion of your personal information, subject to legal and contractual retention requirements.

To exercise these rights, contact us at support@chezlist.ca.

Guests: because we process your waitlist and reservation information on behalf of the Business you visited, we may direct your request to that Business, or ask you to contact them directly.

9. How we protect personal information

We use technical and organizational safeguards designed to protect personal information, including encryption of data in transit and at rest, access controls that limit each Business to its own data, and authenticated access for staff and administrators. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children's privacy

The Service is intended for use by hospitality businesses and their adult patrons. It is not directed at children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact us

If you have questions or concerns about this Privacy Policy or our handling of personal information, contact us at:

support@chezlist.ca