1. Controller and scope
Tabblify is responsible for data it processes to operate its sites and services. Venues using Tabblify may also act as controllers of their customer and staff data. For privacy questions or requests, contact us on WhatsApp at +52 814 812 4671.
2. Data we may process
- Visitors: language preference, analytics consent, and limited technical browsing data.
- Owners and staff: name, email, phone, role, credentials managed by our identity provider, and venue data.
- Venues: trade name, address, country, currency, hours, logo, menus, tables, staff, and operations settings.
- Diners: account information when registered, email or WhatsApp details supplied for receipts and status updates, orders, items, amounts, and delivery or payment states.
- Payments: identifiers and status information supplied by Stripe. Tabblify does not store full card details.
3. Purposes
We use this data to create and secure accounts, configure venues, display menus, process and communicate orders, facilitate payments, send receipts and operational notifications, provide support, prevent fraud, comply with applicable obligations, and improve the service.
4. Analytics and cookies
The public site uses Google Analytics and Microsoft Clarity only after you accept analytics. These tools help us understand which content and calls to action are useful. We do not send email addresses or other direct identifiers to them. You can reject or change your choice through “Cookie preferences” in the footer.
5. Providers and transfers
We may share strictly necessary data with providers that operate infrastructure, authentication, maps, email, messaging, analytics, and payments, including AWS, Google, Meta, Microsoft, and Stripe. Some providers may process data outside the user’s country under their applicable contractual and legal mechanisms.
6. Retention and security
We retain data as needed to provide the service, meet obligations, resolve disputes, and protect the platform. We apply reasonable technical and organizational controls, but no internet-connected system can guarantee absolute security.
7. Your rights
Depending on your jurisdiction, you may request access, correction, deletion, portability, objection, or restriction, and may withdraw consent. We will verify identity before responding and handle requests within the applicable period.
8. Children
Administrative accounts are intended for people legally able to contract. The service is not designed to intentionally collect children’s data without authorization required by applicable law.
9. Changes
We may update this policy to reflect changes to the product, providers, or applicable requirements. The effective version date will appear on this page.