Version 1.0
2026-10-28
Taste Match AG, Sickingerstrasse 10, 3014 Bern, Switzerland, is the
controller for the processing described here. Data protection enquiries,
and requests under section Your rights, go to the Data
Protection Officer at info@tastematch.io, or in writing to Taste Match
AG, David Kilchenmann, Sickingerstrasse 10, 3014 Bern.
| connector | publishes Taste Match’s restaurant discovery and reservation capabilities as tools an AI agent can call on a person’s behalf. |
| Terms | the Taste Match terms and conditions at https://www.tastematch.io/agb. |
| person type Anonymous | searching, filtering, counting, regions and places, restaurant details, availability, the published vocabulary — are public processes and may be consumed anonymously. |
| person type Authenticated | reservations, group matches, etc. - are processes which are required to be linked to an identity in the Taste Match identity system. The identity is fundamentally not linked to PII (it is an uuid7 analog). |
| reservation | a table reservation at a specific restaurant, for a specific person, which requires PII entry and acceptance of the Terms. |
| agent client | the application the person reaches the connector through, for example a ChatGPT plugin. |
| agent provider | the company operating the agent client (in our example, OpenAI), under its own privacy policy. The agent provider sees the actual conversation with the person being served by the system. Taste Match only gets what the agent provider passes on. |
Our servers record that a call was made: the time, the endpoint, the tool name, the outcome or error code, and the language the answer was rendered in. Request bodies and tool arguments are not written to our application logs. Our infrastructure keeps connection logs that include IP addresses, for operation and security.
The access token the agent presents identifies the person by the account identifier held at our identity provider. We read nothing else from the token.
Somebody who already has a Taste Match account and signs in with it keeps that account exactly as it is. The connector then acts on the existing record.
Where a person asks for it through a tool, we store what the corresponding feature of Taste Match stores: taste profiles and preferences for restaurants cannot be considered PII, since they are shared alike by many users.
Reserving requires a first and last name, at least one contact channel — email address or telephone number — and acceptance of the Terms, recorded as the version accepted and the time of acceptance. We ask for these when a reservation needs them and not before.
For a reservation we store the restaurant, the date and time, the
number of guests, the status of the reservation, any free-text note
(section Reservation note, allergen & diet filters),
and the reference the restaurant’s reservation system returns. Changes
and cancellations are stored as the new state of that reservation.
A reservation cannot be created without acceptance of our Terms.
Taste Match arranges reservations and is not a party to them: the reservation is between the guest and the restaurant (Terms, clause 2). To arrange it we pass to the chosen restaurant the guest’s name, the contact channel the restaurant’s system requires, the date and time, the number of guests and any note. The restaurant decides on the reservation and is an independent controller of what it receives. Our Terms explicitly allow us to contact the guest with transactional messages as defined below.
Many restaurants operate an automated reservation system, which receives the same data and processes it for the restaurant. In this case, the restaurant’s reservation system is the data processor, and we act in a controlling capacity.
We send the guest the transactional messages a reservation requires: confirmation, change, cancellation and reminders. We use the contact channels as defined above for this. These are not marketing messages.
Reservations are listed in two sets: those the authenticated person owns, which they can change, and those made elsewhere under the same email address, which are read-only. The second set exists so that a guest sees a booking that was made for them without an account; it means a reservation made with an email address becomes visible to whoever later signs in with it. A person who does not want this should use an address only they control.
A reservation may carry a note in the guest’s own words. It is passed to the restaurant verbatim and is not used in any way by us. The guest must check their own special needs in person at the restaurant to ensure their personal safety, providing them in the note constitutes no guarantee.
A note is a voluntary disclosure to the restaurant, which we store in order to provide an audit possibility. It must not be used to deliver any special private information.
Dietary and allergen filters in the discovery tools are applied to find suitable restaurants and are evaluated automatically. Filter settings are not stored, unless the authenticated user stored them on their profile in the app - it is not possible to do this via MCP tools.
Taste Match operates no third party or off-site language model within
the MCP toolbox. Should we in future include off-site (LLM) processing
by third parties, strictly anonymized data only shall be involved in
such processing. No PII shall leave the Taste Match infrastructure,
except to a restaurant with the express purpose of reserving a table
(section Reservation actions).
| What | Kept |
|---|---|
| Account record and its taste, likes, lists and group matches | until the account is deleted (section
Termination & Deletion) |
| Reservations | as the Terms and statutory retention require, 5 years |
| Rate counters | 2 years |
| Application logs | 6 months |
We otherwise keep personal data while there is a legitimate reason to, or until deletion is requested in writing. Statutory retention requirements remain reserved.
| Recipient | Role | Purpose |
|---|---|---|
| Agent provider | independent controller | the agent the person connected (section
Definitions) |
| Restaurant | independent controller | deciding on the reservation |
| Restaurant system | processor for the restaurant | transmitting and holding the reservation |
| Our identity provider (Zitadel) | processor | sign-in and token verification |
| Our hosting provider (AWS, Europe) | processor | running the service and its database |
| Our mail provider (Amazon SES, Europe) | processor | transactional reservation messages |
| CloudFlare | processor | delivery and protection of the endpoint |
| Authorities | Jurisdiction | Bern, Switzerland |
Processors are contractually bound to process personal data only as far as Taste Match itself may, and to guarantee equivalent safeguards. We do not make personal data available to recipients in countries without adequate data protection unless appropriate contractual arrangements, such as the EU Standard Contractual Clauses, are in place.
Disconnecting is done in the agent client. We cannot assist with this.
Deleting the account can simply be done via the
Taste Match App for authenticated users. Anonymous users cannot be
identified in this context, since all anonymous users arrive at the MCP
endpoint via their agent’s IP. There is one exception, if the anonymous
user ID is known, deletion of an anonymous account can be requested. In
either case - anonymous or authenticated - deletion requests may be sent
to any of the addresses in section
Controller and contact.
Note: * Deletion is immediate and cannot be undone. * Deletion does not withdraw a reservation already transmitted to a restaurant * Disconnecting the connector does not delete the account, and deleting the account does not remove the connector from the agent client.
The endpoint is served over TLS only. Logs are stripped of PII. The database is encrypted at rest as are backups. The system is regularly upgraded, to secure our users’ data. Secure processes are employed to minimise risk concerning our users’ PII.
The published set of tools is fixed. Partner credentials and delegation tools, which let an integration act for its own guests, are not reachable on this path.
Calls are rate limited, and access may be restricted on abuse under the Terms.
You may request information about the data we hold about you, and its
deletion, correction, restricted processing or portability, and you may
object to processing based on legitimate interests. Taste Match answers
promptly, accurately and free of charge. Contact us as determined in
section Controller and contact.
Rights in data a restaurant holds about a reservation are exercised against that restaurant; rights in the conversation held by your agent provider are exercised against that provider.
The connector is offered as a preview; its tools, its behaviour and this document may change. The version current when the connector is called applies; it is named in the heading.