Cookie Policy

1. Purpose

This Cookie Policy explains how Tablevert uses cookies, local storage, pixels, SDK storage, and similar technologies on tablevert.com and related Tablevert product surfaces.

This Policy should be read together with the Privacy Policy and Terms of Use. Where a signed-in product setting, cookie banner, provider consent dialog, or campaign notice gives more specific information for a feature, that notice applies to that feature.

2. Necessary storage

Necessary cookies and storage are required for Tablevert to operate and are not optional in the product. They support authentication, security, fraud prevention, route protection, consent records, language or country preferences, signed upload sessions, provider OAuth state, checkout state, and core workflow reliability.

Necessary storage does not mean unlimited tracking. Tablevert should store only what is needed for the relevant security, session, consent, or product function.

• Authentication and session security.
• Cookie and privacy consent preferences.
• OAuth state and return paths for connected services such as Meta, Canva, Google, WhatsApp, or payment providers.
• Upload, checkout, account-deletion, and support workflow state.
• Local UI preferences that keep the product usable.

3. Analytics storage

Analytics cookies or similar technologies are used only after analytics consent where required. Tablevert currently designs Google Analytics and Google Consent Mode so analytics does not initialize or send events before analytics consent is granted.

Analytics may help Tablevert understand page views, feature use, errors, campaign funnel behavior, and aggregate product performance. Tablevert should avoid sending unnecessary personal data to analytics tools.

4. Marketing and attribution storage

Marketing cookies, advertising pixels, remarketing tags, and similar attribution tools are used only after marketing consent where required. Marketing consent is separate from account, subscription, provider, campaign-contract, and data-deletion consent.

If Tablevert adds new marketing scripts, retargeting pixels, session replay, heatmaps, affiliate tracking, or similar non-essential technologies, the cookie banner and this Policy must be updated before those tools are activated.

5. Campaign tracking links and QR codes

Tablevert campaign links and QR codes may record campaign page views, redirects, clicks, UTM values, referrers, device/browser category, campaign ID, restaurant ID, creator or application reference where applicable, destination URL, and timestamp.

Campaign tracking is used for campaign dashboards, attribution, fraud prevention, dispute evidence, and product analytics. Public campaign tracking must not expose private restaurant owner data, creator private analytics, provider tokens, or payment details.

6. Email pixels and click tracking

Transactional emails such as account, security, billing, campaign, visit, contract, or data-deletion messages may be sent without marketing cookie consent when they are necessary to operate the service or comply with legal obligations.

If Tablevert later adds email open pixels, click tracking, or similar engagement tracking for marketing or product analytics, Tablevert must disclose the purpose separately and collect the required consent or opt-in before using that tracking. Email tracking is not silently covered by general website cookie consent.

7. Consent controls

Visitors can accept all optional categories, reject optional categories, or open preferences to choose analytics and marketing categories. Rejecting optional categories should be as easy as accepting them.

Anonymous visitor preferences may be stored in local storage. Logged-in users may also have consent stored in their Tablevert user record with version, timestamp, and selected categories so Tablevert can honor choices across sessions where possible.

Users can withdraw or update optional consent through the cookie banner, preferences modal, account privacy settings, browser settings, or by contacting privacy@tablevert.com.

8. Connected services and provider consents

Cookie consent is separate from connected-service consent. Connecting Canva, Instagram, Facebook, TikTok, YouTube, Google, WhatsApp, Meta business tools, Mollie, or another provider may require a role-specific provider consent or authorization prompt.

Provider OAuth state, anti-forgery state, PKCE values, return paths, and connection status may use necessary storage or server-side records so Tablevert can securely complete the connection. Provider tokens and secrets must remain server-side.

9. Retention

• Necessary consent records: generally retained while the consent version is active and for up to 5 years afterward to evidence choices, unless a longer legal need applies.
• Analytics event data: generally retained for up to 26 months unless the configured analytics provider retention is shorter or consent is withdrawn earlier.
• Campaign tracking events: generally retained for up to 24 months after the related campaign closes, unless needed for contract, billing, fraud, audit, or dispute records.
• Security and OAuth state: short-lived where possible; expired OAuth state should be deleted or ignored after the connection window closes.
• Marketing opt-in and opt-out records: retained while the user has an active account and for up to 5 years after withdrawal or closure to honor and evidence the choice.

10. Browser controls

Users can also block, delete, or restrict cookies and local storage through their browser. Blocking necessary storage may prevent authentication, security, provider connections, checkout, upload, or other core Tablevert features from working.

Privacy, consent, marketing opt-out, and data deletion questions can be sent to privacy@tablevert.com or submitted through the Tablevert data deletion request flow.