Last updated: 22 October 2026.
Consultors LB ("Consultors", "we", "us" or "our") is an operations platform for restaurants, cafés and bars, available at consultorslb.com. It also covers our mystery-shopping and training services.
This Privacy Policy explains what personal data we collect when you use the platform, why we collect it, who else handles it, how long we keep it, and your rights. By creating an account or using the platform, you acknowledge this policy.
Restaurant operators: the person or business that registers a restaurant on Consultors (the "client").
Staff: owners, managers and team members with accounts at a restaurant, including mystery shoppers and trainers appointed by Consultors.
Guests: people who leave feedback by scanning a table QR code.
Visitors: anyone browsing our public website, asking for a plan, or contacting us.
The restaurant's name, type and location, and the owner's name, phone number, email address and username.
Passwords are stored only as salted PBKDF2-SHA-256 hashes (150,000 rounds). We cannot read them.
A restaurant decides what to enter. Depending on how it uses Consultors, that can include:
Staff: name, username, role, phone, email, hourly wage, schedule, shift reports, checklists, training results, evaluations, scorecards and photos.
Guests: ratings and comments left through a table QR code, plus a name and phone number only if the guest asks to be called back. A complaint a manager records may include a guest's name and phone number.
Operations: sales, costs, expenses and receipt photos, stock, suppliers, recipes, temperature logs, incidents, waste logs and photos, and mystery-shopping evaluations.
Consultors handles this data on the restaurant's behalf. See section 8.
Sign-ins: the time of each person's last sign-in, and failed password attempts, which temporarily lock an account after five wrong tries.
An audit log of significant actions: who did what, and when.
Error reports so we can fix faults: the page address, the error message and technical details, the app version, and the restaurant name and the name and role of the person using it.
Notifications shown in the app, and push notification addresses for devices where you allowed notifications.
Emails the platform sends, such as password resets, welcome messages and licence renewal notices.
Questions to the AI helper (signed-in app only): what you type, your last few messages in that chat, your role and the page you are on. The helper never sees your restaurant's records. See sections 4 and 6.
Plan requests made on our website: your name, phone number, optional email, business name, notes and the plan you chose.
Its plan, licence dates, billing status, invoices and payments received. The platform does not take card details, and we do not collect or store card numbers in it. Payments are arranged with our team.
Our hosting provider records standard server information for every request, including your IP address. See section 4.
To run the service for your restaurant: sign-in, showing each person what their role allows, schedules, reports, checklists and alerts.
To send messages the service needs to send: password resets, account, licence and billing notices, and alerts you switched on. Some of these, such as password resets, cannot be switched off.
To send push notifications on devices where you enabled them. You can turn them off at any time in your browser or device settings.
To bill your restaurant and keep the financial records we need.
To support your restaurant. When you ask for help, authorised Consultors staff may view your restaurant's information to solve the problem.
To deliver our consulting services, such as mystery-shopping visits and training, and report the results to the restaurant.
To answer your questions in the in-app AI helper, if you choose to use it.
To keep the platform secure and to investigate faults and misuse.
To comply with the law where a law or a lawful authority requires it.
We do not sell your data, and we do not use it for advertising.
We use the following providers, and share only what each needs to do its job:
| Provider | What for | What they receive |
|---|---|---|
| Google Firebase and Google Cloud (Google LLC) | Sign-in, database, file storage, server functions, push notifications, bot protection (App Check with reCAPTCHA) and error alerts | All platform data; browser and device signals used for bot protection |
| Netlify | Hosts the website and the app files | Every request to consultorslb.com, including your IP address; standard server logs |
| Gmail (Google LLC) | Sends the platform's emails | The recipient address and the content of each email |
| Google Fonts (Google LLC) | Loads the typefaces used on the site | Your IP address and browser details when a page loads |
| Apple, Google, Microsoft, Mozilla | Deliver push notifications to browsers and devices | The notification text and your device's push address |
| Anthropic (United States) | The in-app AI helper ("Ask AI"), only when you use it | The question you type, your last few messages in that chat, your role and the page you are on. Never your restaurant's records. Handled under Anthropic's own terms |
| WhatsApp (Meta) | Chat with our team, only if you choose to message us | Whatever you send in that chat |
We do not share your data with advertisers, data brokers, or any other third party not listed above, except where the law requires it.
The platform's database is hosted by Google Cloud in Frankfurt, Germany (European Union). Some processing happens in the United States: our server functions run there, and the website is delivered through Netlify's network. Photos and files are stored in Google Cloud Storage.
All connections to Consultors use encrypted HTTPS.
Passwords are stored only as salted hashes, and are never stored or sent in plain text.
Each restaurant's data is separated from every other restaurant's by access rules, and inside a restaurant each person sees only what their role allows.
Accounts that are deactivated are signed out and can no longer sign in.
Sign-in is protected by bot checks, and an account locks for 15 minutes after five wrong passwords.
No system is completely secure. We take reasonable measures to protect your data but cannot guarantee absolute security. If we become aware of a breach affecting your data, we will tell the affected client without undue delay.
While an account is open, we keep the restaurant's data.
Photos attached to incidents, temperature logs, standards, cleaning checks, evaluations and waste logs are deleted automatically after 365 days.
When an account is closed, we aim to delete the restaurant's data within a reasonable time, unless we need to keep part of it, for example billing records where accounting rules require it.
Backups: we keep regular backups to protect against data loss. Deleted information may remain in backups for a limited time before it is removed.
AI helper: we do not store your questions or its answers. We keep only a daily count of questions per person and per restaurant, to apply fair-use limits.
Error reports and audit logs are kept for as long as we need them to fix faults and keep the platform secure.
Access: ask for a copy of the personal data we hold about you.
Correction: ask us to correct inaccurate data. You can change your own details in Settings.
Deletion: ask for your personal data to be deleted. Closing a restaurant account removes its workspace.
Objection: object to certain uses of your data.
If you are a staff member or a guest, your restaurant controls your records. Please contact the restaurant first; we will help it respond.
To exercise any of these rights, email info.consultorslb@gmail.com. We aim to respond within 30 days.
When a restaurant enters personal data about its staff or guests, the restaurant is the controller of that data and Consultors acts as its processor. We process it only to provide the service, on the restaurant's instructions.
Restaurants are responsible for:
having a lawful basis for collecting and processing their people's data;
telling staff and guests that their data is managed on Consultors, including guests who scan a table QR code;
handling sensitive information, such as wages and incident reports, with care and only when needed;
complying with the data-protection laws that apply to them.
Our own records. For a restaurant's account, plan and billing details, and for plan requests, Consultors is the controller.
Sign-in information is kept in your browser so you stay signed in. It is strictly necessary.
Preferences such as your language, and whether you hid the setup guide, are kept in your browser storage. They never leave your device.
Google reCAPTCHA, which protects the platform from bots, may set its own cookies and read browser signals.
We do not use advertising cookies, analytics cookies, Meta Pixel or any other tracking pixel on our website or in the platform.
Consultors is operated from Lebanon. By using it, you understand that your data is stored and processed in the European Union and the United States, as described in section 5. Where the law of your country gives you additional rights, we will honour them.
We may update this policy. If a change matters, we will tell clients through the platform or by email before it takes effect. Corrections and additions that do not reduce your rights take effect when published. The date at the top of this page always shows the latest version.
For questions about this policy or your data: