Turnli Privacy

1. Scope of this notice

This Privacy Notice applies to Turnli websites, business workspaces, customer-facing join and status experiences, public business pages, demos, browser notifications, communications features, and related support and billing surfaces operated by Turnli. It does not replace the privacy practices of a restaurant or service business that uses Turnli, and it does not govern third-party websites or services that a user chooses to open from Turnli.

Turnli is designed around data separation: public business information can be displayed publicly; guest/customer information is limited to the relevant customer journey and authorized business users; team and owner functions require authenticated access; and higher-risk actions are subject to role and backend authorization.

2. When Turnli acts for itself and when it acts for a business

For account administration, authentication, billing metadata, product security, fraud prevention, service reliability, support, and Turnli’s own website operations, Turnli determines the purposes of processing and acts as the responsible business or controller to the extent applicable law uses those terms.

For many customer records created inside a participating business’s workspace—such as a guest name, queue entry, reservation, service selection, visit history, preference note, or business-triggered communication—the participating business determines why the information is collected and how it is used. In that context, Turnli generally processes the information to provide the service to that business and may act as a processor or service provider where applicable law recognizes that role.

If you are a guest or customer seeking to exercise rights over information created for a particular restaurant or service business, contacting that business is usually the fastest route. Turnli may assist the business with a verified request when required or appropriate.

3. Information we collect

The categories below describe information Turnli may process depending on which features are used.

Turnli is not designed for businesses or guests to place Social Security numbers, full payment-card data, account passwords, private keys, government identification numbers, medical diagnoses, biometric identifiers, or similarly sensitive information into ordinary notes, support requests, or customer-flow fields. Please do not submit information the service does not request.

4. How we use information

Turnli may use information to:

• create and secure accounts, workspaces, sessions, and role-based access;
• operate queues, waitlists, reservations, services, floor/table workflows, guest status, public business pages, and related operational features;
• deliver transactional email and browser push updates when the relevant channel is enabled;
• honor communication preferences, opt-outs, do-not-contact flags, and suppression requirements;
• process subscriptions, plan changes, invoices, checkout events, and billing support;
• provide customer support, troubleshoot failures, maintain audit history, and investigate abuse or security events;
• measure product reliability, performance, feature usage, and anonymous or pseudonymous public-journey conversion data; acquisition measurement is limited to sanitized source/campaign context and product-funnel events rather than email addresses, guest data, raw referrer URLs, or message contents;
• protect Turnli, participating businesses, customers, and the public from fraud, misuse, unauthorized access, or unlawful activity;
• comply with legal obligations and enforce applicable agreements; and
• develop and improve features using information that is aggregated, deidentified, or otherwise handled consistently with this Notice.

Where a law requires a legal basis for processing, the basis may include performance of a contract, a legitimate operational or security interest, consent, or compliance with law, depending on the information and context.

5. How we disclose information

Turnli does not sell personal information. Turnli also does not currently disclose personal information to third parties for cross-context behavioral advertising or use third-party advertising networks to build advertising profiles from Turnli activity.

Turnli may disclose information in the following circumstances:

• Participating business and authorized team. Customer-flow information is available to the business and authorized workspace users according to their roles and the product’s access controls.
• Infrastructure and service providers. Turnli uses providers for hosting, database/authentication/storage, content delivery and edge security, payment processing, email or messaging delivery, telecommunications/carrier connectivity, browser notifications, and similar operational functions. These providers receive information only as reasonably necessary to provide their services to Turnli.
• User-directed integrations. If a business enables an integration or deliberately opens an external service, information may be sent to or received from that service according to the business’s configuration and the third party’s own terms.
• Legal, safety, and security. Turnli may preserve or disclose information when reasonably necessary to comply with law, respond to lawful process, protect rights or safety, investigate fraud/abuse, or secure the service.
• Corporate transactions. Information may be transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law and appropriate confidentiality protections.

Turnli does not permit service providers to use SMS opt-in information for their own promotional or marketing purposes.

6. Historical SMS records and business-owned messaging

Turnli no longer offers Turnli-managed SMS sending, SMS phone-number provisioning, or a native carrier-registration program. Historical SMS consent selections, suppression preferences, delivery events and contact details may remain in existing records for auditing, privacy, and compliance purposes; those records do not authorize new messaging.

Some businesses may separately use their own messaging services. Such services have their own policies, opt-in requirements, opt-out procedures, rates and data practices. A future Turnli integration will require the business to connect and authorize its own provider before Turnli can exchange supported information. An integration labeled planned or unavailable does not send any messages.

7. Browser storage, sessions, service workers, and push notifications

Turnli uses browser technologies such as local storage, session storage, service workers, cached assets, and authentication/session storage to keep users signed in, remember workspace or interface preferences, maintain demo state, support offline/degraded experiences, and keep the product responsive. These technologies are used for product operation rather than third-party advertising.

Public customer journeys may use a pseudonymous browser/session identifier so Turnli can measure anonymous journey events such as page views, customer-flow actions, and return activity without placing guest contact information into those analytics events.

If a guest enables browser push notifications, the browser creates a push subscription containing technical endpoint/key material needed to deliver notifications. Turnli uses that subscription only for the relevant notification experience and permits the user to disable it. Browser/device vendors may process push traffic under their own terms.

Public-site acquisition attribution uses first-party session storage for sanitized source, campaign, channel, selected plan, business mode, funnel-stage context, and—only when Turnli explicitly enables a test—an anonymous session-scoped experiment assignment. It does not store email addresses, phone numbers, guest records, message contents, authentication tokens, raw URLs, or raw referring URLs for that purpose. Turnli’s default browser telemetry configuration keeps this diagnostic data local to the browser session unless a deployment explicitly configures an approved remote collector.

8. Public business pages and external links

A business may intentionally publish customer-facing information through Turnli. Information marked for public display can be visible to anyone with the business page or public link and may be indexed by search engines where indexing is enabled. Businesses should publish only information they are authorized to make public.

Turnli may provide links to external maps, social profiles, websites, calendars, payment pages, or integrations. Opening a third-party service can disclose ordinary web-request information to that provider. Third-party privacy practices are governed by their own policies.

9. Data retention and deletion

Turnli keeps personal information for as long as reasonably necessary to provide the service, maintain the business/customer relationship, enforce plan and account rules, satisfy legal or accounting requirements, maintain security and suppression records, resolve disputes, and protect against fraud or abuse.

Retention periods differ by category and feature. Operational history available in the interface may depend on the business’s plan, but plan-level visibility is not necessarily the same as backend retention. When information is deleted, it may remain for a limited period in backups, security logs, fraud-prevention records, billing records, or legal-preservation systems before being securely removed or deidentified.

Turnli may preserve opt-out or suppression information after other customer records are removed when necessary to avoid sending communications to someone who has asked not to receive them.

10. Security

Turnli uses administrative, technical, and product-level safeguards intended to protect information, including authenticated sessions, role-aware permissions, backend authorization, transport security, scoped public endpoints, audit/security controls, and provider security features. Access is designed around least-necessary exposure between public, customer, staff, manager, and owner surfaces.

No internet service can guarantee absolute security. Businesses are responsible for protecting their credentials, limiting team access appropriately, securing the devices they use to access Turnli, and notifying Turnli through support if they suspect unauthorized access.

For a product-focused summary of Turnli’s current access, payment, communications, public/private-surface, and telemetry boundaries, see Trust & Security. Turnli does not claim a security certification unless it is explicitly published there.

11. Privacy rights and requests

Depending on where you live and whether a particular privacy law applies to Turnli or the participating business, you may have rights to request access to personal information, correction, deletion, portability, information about processing, or an appeal of certain decisions. Some laws also provide rights to opt out of sale, targeted advertising, or certain profiling.

Turnli does not currently sell personal information or use personal information for third-party targeted advertising. If those practices change, Turnli will update this Notice and provide any legally required choice mechanisms before using information in that way.

For guest/customer information held within a participating business’s workspace, submit the request to that business first because the business usually controls that customer relationship. Turnli account holders can submit account or workspace privacy requests through Turnli Support. Turnli may ask for information reasonably necessary to verify identity, authority, and the workspace or customer record involved.

For example, when applicable, Texas residents may have rights to confirm processing, access, correct, delete, obtain portable data, opt out of certain sale/targeted-advertising/profiling uses, and appeal a denied request. California residents may have rights to know/access, correct, delete, obtain information about categories of collection/disclosure, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service for exercising protected rights. The exact rights and exceptions depend on the law that applies to the person, the information, and Turnli’s role in the processing.

Turnli will not discriminate against a person for exercising a privacy right protected by applicable law. Where applicable law requires an appeal process, Turnli or the responsible business will provide instructions with the decision.

12. Children’s information

Turnli business accounts are not intended for children under 13, and Turnli does not knowingly offer business-account services directly to children. Customer-facing experiences are designed for ordinary restaurant and service-business interactions, not for collecting children’s sensitive information.

Businesses serving minors are responsible for obtaining any parental or guardian permission required by law and should avoid entering sensitive information about children into Turnli. If Turnli learns that information was collected in a manner that requires deletion or additional consent, Turnli may take reasonable steps to restrict or remove it.

13. International use and data transfers

Turnli is operated using infrastructure that may process information in the United States and other locations where Turnli’s service providers operate. If information is transferred across borders, Turnli and its providers will use measures required by applicable law for the relevant transfer.

Businesses are responsible for determining whether their use of Turnli is appropriate for customers in jurisdictions with additional localization, consent, contractual, or regulatory requirements.

14. Responsibilities of businesses using Turnli

Each business using Turnli is responsible for the legality and accuracy of the customer information it collects, the notices it gives customers, the permissions granted to team members, the content it publishes, and the communications it sends or causes Turnli to send.

Businesses must not use Turnli to collect information they are not authorized to process; must honor customer privacy and communication requests; must keep account access current when staff roles change; and must not use Turnli for regulated personal data requiring a special agreement, certification, or compliance program unless Turnli has expressly agreed in writing.

15. Changes to this Privacy Notice

Turnli may update this Notice as the product, providers, or legal requirements change. The updated version will identify its effective date. If a change materially alters how Turnli uses personal information, Turnli will provide additional notice or obtain consent where required by law.

16. Contact and privacy requests

Business account holders should use workspace support for account-specific privacy, access, security, billing, or data questions. General product guidance is available through Turnli Support.

If you are a guest or customer of a participating business, contact that business for requests concerning the business’s customer records. The business may work with Turnli to complete a verified request where required. Do not send passwords, private keys, full payment-card numbers, or other secrets in a privacy or support request.