Privacy Policy

1. Purpose and scope

This Privacy Policy explains how Tablevert collects, uses, stores, shares, and protects personal data when restaurants, hospitality businesses, creators, agencies, authorized representatives, and other users access or use the Tablevert website, platform, campaign marketplace, dashboards, communications, integrations, and related services.

This Policy applies to account creation, restaurant onboarding, creator onboarding, campaign discovery, campaign applications, campaign management, creator matching, reporting, subscriptions, support, operational communications, connected platform APIs, cookies, analytics, and data deletion requests.

Tablevert's current launch markets are France, Germany, and Sweden. The platform is not intended for live restaurant, creator, campaign, POS, delivery, or customer operations in other countries unless Tablevert expressly enables another market or agrees separate written terms.

Where a country-specific privacy notice, in-product disclosure, consent prompt, contract, or data processing agreement applies to a particular feature or market, that additional notice applies together with this Policy.

2. Controller and processing roles

For personal data processed to operate Tablevert accounts, subscriptions, onboarding, marketplace access, platform security, billing management, product analytics, and support, Tablevert acts as the data controller unless a separate written agreement states otherwise.

Where a restaurant, agency, or business customer uses Tablevert to manage creator campaigns, campaign briefs, creator applications, booking information, creator deliverables, campaign reporting, or connected business account data, that business may act as an independent controller or, where applicable, as the controller that instructs Tablevert. The allocation of roles depends on the applicable contract, feature, and data involved.

Where a restaurant uses Tablevert POS, delivery, order-management, or delivery-platform integrations, Tablevert may process order, customer, menu, delivery, and provider-connection data on the restaurant's behalf. Depending on the workflow, Tablevert may act as a processor for the restaurant, while delivery marketplaces and courier providers may act as independent controllers for their own marketplace, courier, customer, fraud, safety, and regulatory activities.

Tablevert may also act as a processor or service provider for business customers where it processes personal data strictly on documented instructions and under an applicable data processing agreement.

Where a restaurant's owners, managers, and staff use the Tablevert mobile app or web POS for orders, kitchen work, payments, fiscal records, or Hygiene records, the restaurant is generally the controller of its team members' and guests' personal data as their employer or business, and Tablevert generally acts as the restaurant's processor. Tablevert acts as controller for its own platform security, abuse prevention, and service reliability purposes, unless a separate written agreement states otherwise.

For card payments through Mollie Connect, the restaurant uses its own Mollie account and is the merchant of record. Mollie processes payment data under its own terms and privacy notice for its payment services.

3. Users covered by this Policy

• Business Users, including restaurant owners, restaurant operators, hospitality groups, agencies, employees, contractors, and authorized representatives using Tablevert for restaurant marketing and creator campaigns.
• Creators, including influencers, content creators, food reviewers, freelancers, and other individuals who create profiles, apply for campaigns, accept invitations, schedule visits, submit deliverables, or receive campaign-related records.
• Restaurant team members, including owners, managers, waiters, cashiers, bar, kitchen, delivery, and Hygiene staff, and invited external Hygiene reviewers, who use the Tablevert mobile app, web POS, kitchen displays, or Hygiene workflows, including on their own personal phones where the restaurant allows it.
• Restaurant customers and delivery customers whose order, contact, delivery, receipt, preference, unsubscribe, or support information is processed through a restaurant's Tablevert POS, loyalty, ordering, messaging, or delivery-provider workflow.
• Visitors and prospects who browse Tablevert websites, request demos, communicate with Tablevert, subscribe to updates, or interact with public campaign or landing pages.
• Authorized Tablevert personnel and service providers who operate, review, moderate, support, secure, or audit the platform.

4. Personal data we collect

The categories of personal data we collect depend on the features used, the user's role, the country, and the connected services authorized by the user or business account owner.

• Account and identity data, including name, email address, phone number, role, organization, country, city, language, authentication identifiers, onboarding status, consent records, and account preferences.
• Restaurant and business data, including business name, location, address, Google Place ID or other platform account identifiers, website, phone number, opening hours, business categories, attributes, photos or media references, restaurant profile details, operational notes, booking links, campaign briefs, and authorized representative details.
• Creator data, including profile information, social profile URLs, audience or follower information, portfolio information, campaign preferences, location, availability, applications, invitations, bookings, content proof, deliverables, creator media library records, Canva import/reference records, payout or invoice profile data, and verification information.
• Campaign and marketplace data, including campaign briefs, deliverables, visit windows, messages, applications, approvals, locked campaign terms, QR codes, tracking links, content proof, performance estimates, reports, moderation records, and audit logs.
• POS and delivery-order data, including order numbers, table or counter references, basket items, menu item identifiers, prices, pickup or delivery timing, delivery addresses where applicable, customer names, phone numbers, email addresses, delivery notes, allergy or preference notes provided in the order, delivery status, courier or tracking references, cancellation, refund, chargeback, and support records.
• Mobile app and staff device data, including staff sign-in email, role, restaurant assignment, protected PIN verification data, PIN session records, a random app installation identifier, a restaurant-scoped device key and device identifier, till registration details where a device is used to take payments, device block or revocation events, app version, and encrypted offline service records held on restaurant devices.
• Voice ordering data, where a restaurant has switched voice ordering on, consisting of the text transcript of what a waiter dictated and the restaurant's menu text. Voice audio does not leave the phone.
• Shift check-in data, where a restaurant uses NFC shift start and close, consisting of the shift start and close times, the restaurant tag used, how presence was confirmed (location, restaurant Wi-Fi, or restaurant network), and, only when the location decided it, the distance, accuracy, and place of the one location reading taken at that tap.
• Fiscal data, including tamper-evident records of orders, receipts, payments, refunds, voids, cancellations, daily and periodic closures, till registrations, and the staff member or till that performed each action, as required by fiscal law in France, Germany, and Sweden.
• Hygiene data, including temperature, cleaning, receiving, traceability, incident, and other food-safety records, the identity of the person who recorded each entry and when, photo evidence, corrective actions, Hygiene plan setup answers, and external reviewer access records.
• Delivery provider connection data, including Deliveroo, Uber Eats, and Wolt restaurant, store, venue, site, menu, order, webhook, permission, status, and provider account identifiers needed to operate the authorized integration.
• Commercial and billing data, including plan, subscription status, trial dates, payment identifiers, invoices, billing details, tax or VAT information, payout records, payment history, cancellation records, and no-show or dispute information.
• Technical and security data, including IP address, device and browser information, identifiers, event logs, authentication logs, error logs, fraud-prevention signals, referrer and UTM data, cookie identifiers, consent logs, and system audit trails.
• Communications data, including support requests, demo requests, feedback, newsletter interactions, sales and marketing email opens or clicks, operational notices, survey responses, unsubscribe requests, and records of requests made to Tablevert.

5. Sensitive data and children

Tablevert is not intended for children and does not knowingly offer the platform to children. Users must satisfy the minimum age required under the Terms of Use and applicable local law.

Tablevert does not require users to provide special-category personal data such as health data, biometric data, precise political opinions, religious beliefs, or similar sensitive information. Users must not submit sensitive personal data unless Tablevert has expressly requested it for a lawful and necessary purpose.

Some restaurant workflows may incidentally involve health-related information, for example a guest's allergy or dietary need mentioned in an order or a voice transcript, or food-handler fitness and exclusion records that food-safety law requires a restaurant to keep in its Hygiene records. Tablevert processes such information only as needed for the restaurant's order or legal food-safety obligation, keeps voice transcripts transient, and asks staff not to dictate guest names or other unnecessary personal details.

6. How we collect personal data

• Directly from users when they create accounts, complete onboarding, configure profiles, publish campaigns, apply for campaigns, upload files, connect accounts, send messages, request support, or submit forms.
• From business customers and authorized representatives when they invite team members, configure restaurant accounts, manage campaign workflows, review creator applications, or provide information about campaign participants.
• From connected platforms and APIs when a user or authorized business representative grants access to platform data through OAuth, account authorization, API credentials, or another approved connection method.
• From delivery and ordering providers such as Deliveroo, Uber Eats, and Wolt when a restaurant authorizes a connector or when order, menu, delivery, cancellation, support, or status data flows through an authorized POS integration.
• Automatically through the platform when users interact with the website, dashboards, campaign links, QR codes, emails, cookies, analytics tools, security systems, or logs.
• From service providers and processors that support authentication, hosting, payments, analytics, communications, security, storage, and operational services.

7. Purposes and legal bases

Tablevert processes personal data only where it has a lawful basis under applicable privacy law. Depending on the user's location and the feature involved, the lawful basis may include contract performance, legitimate interests, consent, legal obligations, or steps taken before entering into a contract.

• To create and manage accounts, authenticate users, verify authority, provide dashboards, operate subscriptions, and deliver the platform under the Terms of Use.
• To onboard restaurants, maintain business profiles, prevent duplicate or unauthorized business claims, manage creator campaigns, support creator applications, coordinate bookings, process deliverables, and provide campaign reporting.
• To enable restaurants and creators to discover, evaluate, negotiate, confirm, perform, and evidence creator marketing collaborations.
• To operate connected platform integrations, request minimum necessary permissions, retrieve authorized data, keep disclosures accurate, and comply with the applicable API provider terms.
• To operate POS and delivery integrations, including menu, store, venue, site, order, webhook, delivery-status, cancellation, refund, courier, customer-support, and provider-reconciliation workflows for authorized restaurants.
• To provide the Tablevert mobile app to restaurant teams, including staff sign-in, device registration, attribution of orders, payments, and Hygiene records to the person who made them, offline service, and remote blocking of lost devices or departed staff, based on the restaurant's legitimate interests and, where applicable, the employment relationship.
• To record when staff start and close shifts and confirm at that moment that they are at the restaurant, for working-time records and, in Sweden, the staff ledger (personalliggare), based on the restaurant's legal obligations where they apply and its legitimate interest in reliable attendance records.
• To keep fiscal records, register tills, and support fiscal declarations, closures, and inspections where a restaurant is legally required to do so in France, Germany, or Sweden, based on the restaurant's legal obligations.
• To keep reliable Hygiene and food-safety records and give invited external reviewers read-only access, based on the restaurant's legal obligations and legitimate interests.
• To process payments, maintain invoices and accounting records, manage taxes, investigate disputes, enforce agreements, and comply with legal obligations.
• To secure the platform, prevent fraud, detect abuse, moderate content, audit account activity, troubleshoot errors, improve reliability, and protect Tablevert, users, and third parties.
• To send operational, transactional, security, billing, campaign, and support communications.
• To send marketing communications where permitted by law and, where required, with consent.
• To perform analytics, product measurement, and service improvement, subject to consent where required for non-essential cookies or similar technologies.

8. Connected platform APIs and platform data

Tablevert may allow authorized users to connect third-party accounts, business listings, advertising accounts, social media accounts, delivery-provider accounts, ordering platforms, or platform profiles so that Tablevert can provide onboarding, campaign creation, campaign reporting, creator matching, analytics, POS, delivery, and operational workflows.

The exact permissions requested depend on the feature selected. Tablevert requests only permissions that are relevant to the active feature and does not request access solely for future, undeployed, or unrelated features.

9. AI-assisted matching and automated support

Tablevert may use rule-based systems, analytics, and AI-assisted tools to recommend creators, explain potential campaign matches, organize campaign information, classify content, support moderation, prepare operational suggestions, summarize information, or assist support workflows.

AI-assisted outputs are intended to support human decision-making. Tablevert does not guarantee that a match, recommendation, ranking, or performance estimate will produce a specific campaign result, booking volume, revenue amount, follower growth, or return on investment.

Where applicable law gives users the right to object to certain profiling or request human review of significant automated decisions, users may contact Tablevert using the privacy contact listed below.

Tablevert uses Anthropic's Claude models as an AI processor for two restaurant features where they are enabled: turning a dictated order transcript into a draft order, and drafting the restaurant-specific wording of a Hygiene plan from the owner's setup answers. In both cases the output is a draft. A waiter checks every order line before it is sent, and the owner verifies and submits the Hygiene plan, whose legally mandatory parts come from country rules and templates rather than from AI. Neither feature makes decisions about staff, and neither is used to evaluate staff.

10. Tablevert mobile app for restaurant teams

The Tablevert mobile app lets restaurant owners, managers, and staff take orders, run kitchen tickets, take payments, issue receipts, keep Hygiene records, and start and close shifts. This section explains the additional processing involved. It applies only where a restaurant uses the app and, for optional features, only where the restaurant has switched them on.

11. Cookies and similar technologies

Tablevert uses necessary cookies, local storage, and similar technologies for authentication, session management, security, consent records, language or country settings, platform reliability, and essential product functionality.

Where required, analytics, advertising, marketing, or non-essential measurement technologies are used only after consent. Users may reject, withdraw, or update non-essential cookie consent through the consent tools made available by Tablevert.

Tablevert may use email open pixels, click tracking, tagged links, and similar email engagement technologies in newsletters, sales emails, and marketing emails to measure delivery, opens, clicks, campaign/source attribution, list health, relevance, and suppression. Where required, Tablevert uses this tracking only with consent or another lawful basis. Users may opt out through the unsubscribe button or link at the end of the email they received, through available preference tools, or by contacting privacy@tablevert.com.

Cookie availability and categories may vary by market, browser, device, and feature.

12. Sharing personal data

Tablevert does not sell personal data in the ordinary meaning of that term. Tablevert shares personal data only where necessary to provide the platform, comply with law, protect rights, operate integrations, manage contracts, or support users.

• With restaurants, agencies, creators, and authorized team members where needed to run campaign discovery, applications, approvals, bookings, deliverables, content proof, reporting, and dispute workflows.
• With processors and service providers that support hosting, authentication, storage, databases, cloud functions, analytics, payments, communications, security, support, monitoring, and operational tooling.
• With connected platform providers where the user or authorized representative connects an account, uses an integration, requests an API workflow, or where data must be exchanged to perform the authorized feature.
• With Deliveroo, Uber Eats, Wolt, and other delivery, POS, ordering, logistics, or marketplace providers where a restaurant enables an authorized connector or where data must be exchanged to fulfill, update, cancel, support, or reconcile an order.
• With Google (Firebase and Google Cloud) for hosting, databases, authentication, storage, app integrity checks, logging, and, only after consent, crash reports and push notifications; with Anthropic for AI drafting of voice orders and Hygiene plans where those features are enabled; and with Mollie for payments.
• Within a restaurant, with the owner, managers, and team members whose role allows them to see the relevant orders, payments, or Hygiene records, and with external Hygiene reviewers invited by the restaurant, who receive read-only access.
• With fiscal providers, certified signing devices or control systems, tax authorities, and food-safety inspectors where fiscal or food-safety law requires records to be signed, declared, exported, or shown during an inspection.
• With legal, tax, accounting, banking, compliance, insurance, security, and professional advisers where needed for business operations, disputes, compliance, or risk management.
• With public authorities, courts, regulators, or third parties where required by law, lawful request, legal process, contract enforcement, safety, fraud prevention, or protection of rights.
• In connection with a merger, acquisition, financing, reorganization, asset sale, insolvency, or similar corporate transaction, subject to appropriate confidentiality and data protection safeguards.

13. International transfers

Tablevert may process and store personal data in countries other than the user's country of residence, including countries where Tablevert, its service providers, connected platform providers, or support teams operate.

Where applicable law requires a transfer mechanism, Tablevert uses appropriate safeguards such as adequacy decisions, standard contractual clauses, data processing agreements, supplementary measures, or another lawful transfer basis.

Tablevert's main database and backend functions run in the European Union (Google Cloud region europe-west1, Belgium). Voice order transcripts and Hygiene plan inputs sent to Anthropic may be processed outside the European Economic Area, including in the United States; such transfers rely on the EU-U.S. Data Privacy Framework where applicable or on standard contractual clauses in Anthropic's data processing terms. Some Firebase services, such as crash reporting, may also process data outside the European Economic Area under Google's data processing terms.

14. Retention

Tablevert retains personal data only for as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law, contract, tax rules, accounting obligations, platform policies, dispute handling, security needs, or legitimate operational requirements. The periods below are product defaults and may be shortened or extended where mandatory law, provider rules, legal holds, or active disputes require it.

• Account and profile data: while the account is active and generally up to 24 months after closure, unless deletion is requested earlier or retention is needed for legal, billing, fraud, audit, campaign, or dispute reasons.
• Campaign, booking, content proof, creator application, reporting, marketplace, contract, no-show, cancellation, and dispute records: generally for the life of the campaign and up to 6 years after campaign closure to evidence performance, contract acceptance, payments, disputes, and compliance.
• POS, customer-order, delivery, courier, cancellation, refund, support, and delivery-provider reconciliation records: generally for the life of the order and up to 6 years after order closure where needed for fulfillment evidence, accounting, chargeback, dispute, provider-policy, or legal purposes; invoice, tax, and accounting records may be retained for the statutory period in the relevant market.
• Billing, invoice, payment, tax, payout, accounting, subscription, and checkout records: for the statutory accounting and tax period required in the relevant jurisdiction; for France-facing accounting records this may be up to 10 years.
• Fiscal records, including till journals, receipts, closures, till registrations, and integrity proofs: for the period required by fiscal and accounting law in the restaurant's market. In France this is 6 years for fiscal data and integrity proofs and up to 10 years for accounting documents; in Germany up to 10 years for records and 8 years for vouchers; in Sweden until the end of the seventh year after the end of the financial year. Tablevert designs its fiscal archive for 10 years in the European Union.
• Voice ordering: voice audio is never stored, and transcripts are not stored by Tablevert; they exist only in memory while a draft is prepared. Anthropic's handling is governed by its data processing terms.
• Shift start and close records, including how presence was confirmed and any location reading taken at that tap: as long as the restaurant must keep working-time records in its market (for example, the Swedish staff ledger is kept for 2 years), and not used for any other purpose.
• Offline service records on restaurant devices: until they have been uploaded to Tablevert's servers, after which the server copy follows the retention periods in this section.
• Hygiene and food-safety records, including locked logs, corrective actions, and photo evidence: for the period the restaurant is required to keep them under food-safety law, and otherwise while the restaurant's Hygiene workspace is active, unless a longer period is needed for an incident, inspection, legal claim, or legal hold. External reviewer access ends when it expires or is withdrawn.
• Staff sign-in, PIN session, device registration, till registration, and device block records: while the staff member or device is active for the restaurant, and afterwards as long as needed for security, audit, fiscal, or dispute purposes. Crash reports, where consented, are kept according to Google Firebase Crashlytics retention settings.
• Security logs, authentication logs, abuse-prevention records, rate-limit records, and system audit trails: generally up to 12 months, or longer where needed to investigate abuse, fraud, security incidents, legal claims, or provider-policy issues.
• Connected platform tokens, secrets, OAuth state, temporary export URLs, and active connection metadata: while the integration is connected and needed for the authorized feature; short-lived OAuth state is expired quickly; tokens and secrets are deleted or revoked on disconnect where technically available.
• Connected platform imported/synced data, including Canva imports, social media records, comments, metrics, messages, and provider-sourced files: while the connected feature or campaign workflow needs them, then deleted on disconnect or account deletion unless minimal retention is required for campaign, legal, billing, audit, security, or dispute purposes.
• Newsletter, sales-email, and marketing-email engagement records, including open pixel events, click events, campaign/source tags, suppression events, and unsubscribe requests: generally up to 24 months for engagement measurement, while opt-out or suppression records are retained as long as needed to honor the user's choice and prevent further marketing.
• Cookie consent, marketing opt-in/out, provider consent, campaign contract acceptance, billing/no-refund acceptance, and data deletion request records: generally while the account is active and up to 5 years after the last relevant interaction to evidence compliance and honor user choices.
• Public or anonymous deletion requests and support requests: generally up to 24 months after closure, unless needed longer to evidence request handling or comply with legal obligations.

15. Security

Tablevert uses operational, technical, and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, and destruction.

Security measures may include access controls, authentication controls, role-based permissions, encryption where appropriate, logging, monitoring, backup practices, secure development practices, least-privilege access, and review of service provider security measures.

For connected services such as Canva, Deliveroo, Uber Eats, Wolt, Meta, WhatsApp, and Google, Tablevert keeps provider secrets, webhook secrets, OAuth states, PKCE verifiers, refresh tokens, access tokens, and temporary export URLs on the secure backend and does not return those values to browser clients.

In the mobile app, offline service records are stored encrypted with keys protected by the device's hardware-backed key store, devices prove possession of a restaurant-scoped key before they can act offline, local data is shared only with devices whose current permissions allow it, the app locks when it goes to the background, and owners can block lost devices or departed staff. Hygiene evidence is stored in write-protected storage that clients cannot change.

No online service can guarantee absolute security. Users are responsible for maintaining the confidentiality of their credentials, using secure devices, and promptly notifying Tablevert of suspected unauthorized account access.

16. Privacy rights and data deletion requests

Depending on the user's location and applicable law, users may have rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or information about the processing of their personal data.

Users may also request deletion of their Tablevert account data or connected platform data. Deletion requests are reviewed before completion because active subscriptions, unpaid amounts, campaign obligations, dispute records, tax records, invoices, payout records, security logs, legal holds, or statutory retention obligations may require Tablevert to retain certain information.

Withdrawing consent or disconnecting an integration does not affect processing already performed lawfully before withdrawal and may prevent Tablevert from providing related features.

For technical support with account access, integrations, upload/import workflows, or Tablevert product issues, users may contact support@tablevert.com. Privacy rights and deletion requests may continue to be sent to the privacy contact listed below.

17. Supervisory authorities and complaints

Users may contact Tablevert first so that Tablevert can review and respond to privacy concerns. Users may also have the right to lodge a complaint with a competent data protection authority or supervisory authority in their country of residence, workplace, or the place where the alleged infringement occurred.

18. Marketing communications

Tablevert may send marketing communications where permitted by law. Where consent is required, Tablevert sends such communications only after consent has been obtained.

Tablevert newsletters, sales emails, and marketing emails may include tracking pixels, click tracking, tagged links, or similar technologies as described in the cookies and similar technologies section above. Users may opt out of marketing emails and marketing email tracking at any time by using the unsubscribe button or link at the end of the email they received, through available account or preference tools, or by contacting privacy@tablevert.com.

After an opt-out, Tablevert may keep a suppression record to honor the request and prevent further marketing. Transactional, security, billing, legal, campaign, order, delivery, support, and other operational messages may continue where necessary to provide the platform, fulfill orders, protect accounts, or comply with law.

19. Third-party links and services

The platform may contain links to third-party websites, applications, payment services, social networks, platform APIs, booking tools, or other services that Tablevert does not own or control. Those third parties process personal data under their own terms and privacy policies.

Users should review the applicable third-party notices before authorizing integrations, following links, making payments, or sharing personal data with third-party services.

20. Changes to this Policy

Tablevert may update this Privacy Policy from time to time to reflect changes in the platform, applicable law, connected platform requirements, security practices, or business operations.

Where a change materially affects how Tablevert uses personal data, Tablevert will provide notice or obtain consent where required by law or applicable platform policy before applying the change to the affected processing.

What changed in this version: staff shift check-in with the restaurant's NFC tag (a location or restaurant network check at shift start and close only), Google and Instagram sign-in in the mobile app, choosable voice-recognition providers, and push notification tokens. The effective date above is the date of this version.