Privacy policy

1. Scope and responsibility

This notice covers the tablettt website, native and browser apps, account administration, enquiries and technical support. When a venue uses tablettt for orders, reservations, payments or staff administration, the venue determines the purposes of that processing and is the controller. We process that venue data on its documented instructions as a processor under Article 28 GDPR. The venue must provide its own privacy information, legal bases and retention periods; this notice does not replace it. Contact the venue about its guest or employment records. We assist it with requests.

2. Controller and contact

The following operator is responsible for the website and for the account, contractual and security processing described here. You can use the contact below for privacy enquiries and to exercise your rights.

3. Website access and server logs

When you access our services, the hosting server receives your IP address, request time, requested URL, HTTP status, transferred volume, browser and operating-system information and, if sent by your browser, the referring page. We use these data to deliver the service, investigate errors and protect it against abuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, reliable service. Access and error logs rotate daily with 14 archived rotations; entries can therefore remain for approximately 15 days. Evidence needed for a specific security incident may be retained until the incident and related claims are resolved.

4. Accounts, invitations and correspondence

For accounts we process your name, email address, password hash, verification status, authentication and recovery information, sessions, IP address and browser information, organization membership, permissions and registered-device identifiers. We use these data to establish and secure access, administer the customer relationship and send invitations, verification messages, security codes and password resets. Article 6(1)(b) GDPR applies where necessary for a contract with you or steps you request before entering one. For users acting for a venue and for abuse prevention, Article 6(1)(f) GDPR applies: our legitimate interests in providing the contracted service and protecting accounts. A venue may supply your name, email address and permissions through an invitation or staff account rather than you entering them yourself.

If you contact us, we process your contact details, message and related correspondence to answer the enquiry, fulfil a contract or resolve a support issue. The basis is Article 6(1)(b) GDPR for contractual enquiries and Article 6(1)(f) GDPR for other enquiries, with the legitimate interest of responding to communications. Please do not include passwords, payment-card details or unnecessary guest or staff data in messages or support descriptions.

5. Cookies, local storage and device functions

The static marketing and privacy pages do not use analytics, advertising trackers, third-party embeds or application cookies. Fonts and other page assets are served from our own hosting. The apps use authentication cookies or secure device credentials, local settings and local databases to provide sign-in, your selected language and appearance, carts, offline data and pending operations. Browser data can remain until you clear site data or the app removes or replaces them; clearing them may remove unsent work. Device credentials remain until revoked or removed. Access to or storage on your device for a service you expressly request is based on section 25(2)(2) TDDDG; any associated personal-data processing uses the legal bases stated in this notice. Optional access requiring consent must be requested separately before it occurs. The app can request camera access for QR scanning; you can refuse or revoke permission in your device settings.

6. Venue, guest, payment and staff data

Depending on the features enabled by the venue, tablettt processes orders, table or tab labels, receipts, payment references, fiscal signatures, reservation names and contact details, booking times, party sizes and notes, and staff profiles, permissions, schedules, working hours and payroll-related records. Staff or device identifiers may be associated with changes and transactions. These data may be held locally on venue devices and synchronized to the cloud. Payment-terminal and fiscal providers receive the data needed for the venue's configured payment or fiscal service. We do not use venue records for advertising or employee-performance profiling. The venue supplies the applicable legal bases, recipient details and retention rules in its own notice and processing instructions.

7. Diagnostics and technical support

The app keeps a bounded local technical log for up to seven days. A support report is uploaded only after someone selects Send report; failed uploads may retry for up to seven days. Reports contain the submitted description, report time, app and device context, business/location/device identifiers and, if selected, a snapshot of recent sanitized technical records. The technical-log builder excludes receipt and order contents, payment amounts, passwords, screenshots and raw network responses. Free-text descriptions are provided by the sender. Reports expire from the live support system after 30 days. Authorized platform support staff with multi-factor authentication can inspect reports and relevant business activity; their access is audited. Support is based on Article 6(1)(b) GDPR where necessary for a contract with you and Article 6(1)(f) GDPR for secure operation and troubleshooting. Venue data remain subject to the venue's instructions. Selecting Send report is not consent on behalf of guests or coworkers. There is no automatic crash-report upload or continuous device telemetry.

8. Hosting, recipients and international transfers

Our production server and object storage are hosted in Nuremberg, Germany, by Hetzner Online GmbH. Hosting includes service delivery, storage and backups. Access is limited to authorized personnel and service providers requiring it for their tasks. We may also disclose data to authorities or professional advisers where required by law or necessary to establish, exercise or defend legal claims. We do not sell personal data.

Transactional emails are delivered through Resend (Plus Five Five, Inc., United States). Resend receives recipient addresses, message contents and delivery metadata, including account-verification, invitation and recovery messages and, where used, venue reservation notifications. Resend's data processing addendum incorporates the European Commission's standard contractual clauses for relevant transfers outside the EEA. Processing may take place in the United States, where government-access rules and remedies differ from those in the EU. You may request information about the applicable safeguards and a copy through our privacy contact. Provider information is linked below.

Cloudflare, Inc. provides network protection and delivery for the tablettt service endpoints routed through its proxy. For those endpoints it receives IP addresses, request and connection information and the traffic needed to deliver the service. This serves our legitimate interest in secure, reliable delivery under Article 6(1)(f) GDPR. Processing can occur outside the EEA, including in the United States. Cloudflare's data processing addendum sets out its applicable transfer safeguards, including standard contractual clauses. Our domain also uses Cloudflare for authoritative DNS; DNS hosting alone does not route website contents through its proxy.

9. Storage periods and deletion

Account information is kept while the account is needed to provide the service, then deleted or restricted unless a legal duty or a specific unresolved claim requires further retention. Enquiries are kept until dealt with and, where necessary, for the applicable contractual, limitation or statutory retention period. Expired credentials can no longer authorize access; expiry does not necessarily mean every related security or audit record is immediately erased. Server logs and diagnostics follow the periods above. Encrypted operational database backups have a 30-day retention period; deleted live data may remain in existing backups until they expire and are not used for ordinary operations. Venue transaction, staff and fiscal records follow the venue's documented retention instructions and legal obligations. Deleting an account does not erase legally retained fiscal records. We restrict retained data to the relevant retention purpose.

You can permanently delete your personal account through our account-deletion page. Sign in, confirm your email and enter the emailed confirmation code. This removes account details, sign-in credentials, sessions, memberships and personal notifications from the active service. A last business owner must assign a successor first; unfinished legacy imports must be finished or cancelled. If you cannot complete these steps or are closing a business, contact us. Venue, fiscal, employment and audit records remain subject to the retention rules above; existing operational backups expire within 30 days.

Delete your account

10. Your rights

Subject to the legal conditions, you can request access and a copy of your personal data (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability for automated processing based on consent or contract (Article 20 GDPR). Where processing relies on consent, you can withdraw it at any time without affecting processing already carried out. Contact us using the details above. We may ask only for information necessary to confirm your identity. We normally respond within one month; a lawful extension of up to two further months for complex or numerous requests will be explained within the first month. Rights concerning venue-controlled records should be addressed to that venue.

Right to object: Under Article 21 GDPR, you may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. We then stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or need it for legal claims. You may object to direct marketing at any time without giving reasons.

You can complain to a data protection supervisory authority, in particular in the EU Member State of your habitual residence, workplace or the alleged infringement (Article 77 GDPR). You do not have to contact us first. A directory of European supervisory authorities is linked below.

11. Required information and automated decisions

Technical connection data are necessary to deliver an online service. Account and security details are necessary to create and protect an account; without them we cannot provide authenticated access. Other enquiry details are voluntary unless needed to handle your request. Required guest and staff fields are determined by the venue. We do not make decisions based solely on automated processing that produce legal or similarly significant effects under Article 22 GDPR, and do not use personal data for advertising profiling.

12. Changes and further information

We update this notice when our processing changes. The date above identifies this version. Material new purposes or consent requirements will be communicated before the relevant processing starts. The following links provide the legal text, provider information and supervisory-authority contacts.

• GDPR / DSGVO
• § 25 TDDDG
• Hetzner
• Resend
• Cloudflare
• European data protection authorities