woflow.com
Feb 1, 2026
Full database dump from Woflow, an AI-driven merchant data and menu digitization platform serving US restaurants. The breach contains approximately 12 million records across 30 tables including restaurant data, menu items/categories/modifiers/prices, user accounts, user roles, gamification points, Google Places data, bookmarks, events, and internal workflow data. Data spans from the platform's early days in 2017 through early 2026, indicating a near-complete database exfiltration.
Data found in this dataset
Source files
Expand any file to inspect its column headers and the LLM's field-mapping reasoning, recorded during ingestion.
bookmarks.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: This file contains only internal IDs, status flags, timestamps, and system-generated identifiers. No PII fields are present. Columns like id, bookmarkable_type, restaurant_id, menu_id, user IDs, created_at, updated_at, and deleted_at are all internal tracking fields or timestamps, which must be skipped per exclusion rules.
company_restaurants.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: All columns contain internal system identifiers, timestamps, and foreign keys; no PII detected in first 50 rows. Columns map to internal IDs (id, company_id, restaurant_id), ISO timestamps (created_at, updated_at, deleted_at), and foreign key references to other tables.
events.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: The file appears to be a log of menu item captures and related events from the Woflow platform. The columns present are 'id', 'name', 'user_id', 'props' (a JSON string containing metadata like 'captured word count' and sometimes 'image md5'), and timestamps for creation, update, and deletion. None of these columns contain direct PII such as names, addresses, emails, phone numbers, or other identifiable personal data. The 'name' column contains generic event descriptions like 'menu item captured' or 'MENU_ITEM_PASTED', and 'user_id' is an internal numeric identifier. The 'props' field contains only non-PII metadata (word counts, image hashes). Timestamps are purely transactional and not tied to personal events. Therefore, no PII columns are present in this dataset.
gamify_point_changes.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: This is a gamification/points event log table (user_computed_profile_events or similar). All columns are internal system data: record IDs, point counters, internal user profile IDs, action type codes, event IDs, timestamps, and menu event IDs. No PII fields are present in this table.
google_places.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: The file appears to be a raw JSON dump of Google Maps place data, not a delimited text file with columns. Each row contains a single JSON object describing a restaurant/business with fields like id, url, icon, name, scope, types, photos, etc. There are no PII fields exposed in this dataset — it contains only business identifiers, locations, and photos. No columns map to PII because this is not a columnar dataset. The structure is nested JSON, not a flat delimited format.
job_exports.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII fields detected. All columns are internal system identifiers, timestamps, status flags, and error logs — none contain personal or sensitive data. The error_log field contains stack traces and system paths, not user PII.
library_words.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: All columns are internal IDs, timestamps, or flags. No PII fields are present. The 'value' column contains short text fragments (likely menu item fragments) and does not contain any personal information.
menu_categories.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: All columns appear to be internal identifiers, menu/category data, timestamps, and JSON blobs. No PII fields detected. Columns like 'id', 'menu_id', 'created_at', 'updated_at', 'wuid', and 'category_words' contain internal IDs, timestamps, or structured data formats, none of which qualify as PII under the defined rules.
menu_category_group_categories.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII columns identified in the first 50 rows. The data appears to contain only internal IDs, timestamps, and numeric codes related to menu categories and groups. No personal information such as names, emails, phone numbers, or addresses is present in the visible columns.
menu_category_groups.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII columns identified. The file contains only operational data about restaurant opening hours and menu timings, with no personal information exposed.
menu_category_modifiers.csv7 columns0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 0 | skip | high | [0] column 'id' is an internal numeric identifier |
| 1 | skip | high | [1] column 'menu_category_id' contains internal numeric IDs |
| 2 | skip | high | [2] column 'menu_modifier_id' contains internal numeric IDs |
| 3 | skip | high | [3] column 'position' is a numeric counter |
| 4 | skip | high | [4] column 'created_at' is a timestamp |
| 5 | skip | high | [5] column 'updated_at' is a timestamp |
| 6 | skip | high | [6] column 'deleted_at' is a nullable timestamp |
Notes: This is a pure menu/modifier relationship table with no PII present. All columns are internal IDs, counters, or timestamps. The breach context confirms this is part of the restaurant data schema without user personal information.
menu_downloads.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: This file contains only menu delivery metadata (URLs, timestamps). No PII is present in the first 50 rows. Columns map to internal IDs, company references, and delivery timestamps — all skip per rules. No emails, names, addresses, or other PII fields detected.
menu_events.csv3 columns0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 0 | skip | high | [0] header 'id', values are numeric IDs |
| 1 | skip | high | [1] header 'menu_id', values are numeric IDs |
| 2 | skip | high | [2] header 'user_id', values are numeric IDs |
Notes: Only three columns shown; all appear to be internal IDs or foreign keys. No PII detected in this sample. Full file likely contains additional columns with PII not shown in this preview.
menu_fragments.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII columns detected. All columns are internal IDs, timestamps, status flags, or structured data coordinates. This appears to be a metadata table for menu item positioning and OCR processing status, not containing any personal information.
menu_item_tags.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: This is a structured dataset containing only internal IDs, timestamps, and numeric identifiers. No personal identifiable information (PII) fields such as names, emails, addresses, phone numbers, or dates of birth are present in any of the columns. All columns are internal system identifiers or timestamps, which are excluded per the rules.
menu_items.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII columns present. All columns are internal identifiers, timestamps, file metadata, menu item data, and product attributes. None contain personal information such as names, emails, addresses, or dates of birth.
menu_modifier_options.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII columns present. This is a menu modifier options junction/ordering table (menu_modifier_options or similar) containing only internal IDs (id, menu_modifier_id, menu_option_id), a position/sort integer, and system timestamps (created_at, updated_at, deleted_at). All columns are skip.
menu_modifiers.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: All columns are internal IDs, timestamps, flags, or product metadata. No PII fields present. Columns like 'name' contain menu item names (e.g., 'Drink', 'sauce'), not personal names.
menu_options.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: This is a structured CSV file containing menu item data from Woflow. All columns are internal IDs, product names, prices, timestamps, flags, or UUIDs. No PII fields (email, phone, name, address, etc.) are present. Columns like 'name' contain menu item descriptions, not personal names. Timestamps and UUIDs are internal tracking data. Therefore, there are no PII columns to map.
menu_pages.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII columns detected. All columns are internal IDs, timestamps, status flags, or technical identifiers (e.g., md5 hashes, cloudinary IDs, UUIDs). This aligns with the breach context as a restaurant menu digitization platform, containing only internal workflow data.
menu_patterns.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII columns detected. All columns are internal IDs, timestamps, flags, or unstructured JSON fields. 'fields' column contains JSON structures with titles/descriptions but no personal data. This aligns with the breach context — internal platform metadata, not user PII.
menu_price_modifiers.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: The provided data is purely transactional and temporal, containing only numeric IDs, timestamps, and positional indices. No personal or identifiable information is present in any column. All values are internal references (IDs), positions, or ISO timestamps — none map to PII fields per the defined categories. Therefore, no columns contain PII.
menu_prices.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII columns detected. This table contains restaurant menu item pricing/variance data (prices, positions, variance types, menu IDs, internal timestamps, UUIDs). No personal information present.
menus.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII columns detected. All columns are internal IDs, timestamps, flags, or system metadata. The 'name' column (index 1) appears to be restaurant names, not personal names, and is therefore skipped per exclusion rules for business-related data. No email, phone, address, DOB, SSN, or other personal identifiers are present in the first 50 rows.
messages.csv10 columns0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 0 | skip | high | internal sequential id column |
| 1 | skip | high | free-text description field containing menu feedback, no PII patterns |
| 2 | skip | high | messageable_type - internal system categorization (e.g., Bookmark) |
| 3 | skip | high | messageable_id - internal reference ID |
| 4 | skip | high | restaurant_id - internal business identifier |
| 5 | skip | high | menu_id - internal menu identifier |
| 6 | skip | high | created_by_user_id - internal user reference |
| 7 | skip | high | created_at - timestamp |
| 8 | skip | high | updated_at - timestamp |
| 9 | skip | high | deleted_at - timestamp or null placeholder |
Notes: 10 columns total; all are internal system metadata or free-text feedback. No PII present in sample. Columns 0-9 mapped; all non-PII per policy.
restaurants.csv1 column1,688,533 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 1 | fullName | high | [1] values are full names like 'Bravo Pizza' (business names excluded via exclusion rules), 'Aira Joyce - Tasty Nibbles Restaurant' (person + restaurant), and 'JP - Tasty Nibbles' (person + restaurant) |
Notes: Only column 1 contains PII (fullName). All other columns are timestamps, internal IDs, environment flags, or settings — all excluded by rules. Business names and restaurant names attached to person names are still mapped as fullName because they represent personal identifiers in context.
user_computed_profiles.csv6 columns0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 0 | skip | high | Internal identifier column 'id' |
| 1 | skip | high | Internal identifier column 'user_id' |
| 2 | skip | high | Timestamp column 'created_at' |
| 3 | skip | high | Timestamp column 'updated_at' |
| 4 | skip | high | JSON blob column 'calculations' contains menu performance data, not PII |
| 5 | skip | high | Timestamp column 'deleted_at' - null values indicate active records |
Notes: This dataset contains user activity metrics and performance statistics for the Woflow platform. All columns are either internal identifiers, timestamps, or JSON blobs containing non-PII business data. No personally identifiable information is present in the first 50 rows.
user_role_changes.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: No PII columns detected in this dataset. All fields are internal system identifiers (id, user_id, role_id), action types, timestamps, and status flags. No personal information such as names, emails, addresses, or phone numbers is present in the visible data.
user_roles.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: This file appears to be a structured table containing only internal IDs, timestamps, and role IDs. There are no personal identifiers, email addresses, phone numbers, names, or other PII fields present in the first 50 rows. All columns appear to be internal system identifiers and timestamps, which are explicitly excluded by the rules.
users.csv4 columns18,354 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 1 | firstName | high | header "first_name" resolves to PII field "firstName" |
| 2 | lastName | high | header "last_name" resolves to PII field "lastName" |
| 3 | high | header "email" resolves to PII field "email" | |
| 16 | high | unlabeled column — sampled values parse as email addresses |
Notes: Heuristic auto-detection: header-named PII columns confirmed by data conformance