Privacy Policy

1. Controller and draft status

This Privacy Policy is launch placeholder text pending final legal review. It must be reviewed before publication and customer use.

Draft controller: Tablevert, France, contact@tablevert.com, tablevert.com. Registered office, VAT number, legal registration number, and representative fields are placeholders for replacement.

2. Supported launch countries

Tablevert is prepared for launch support in France, Germany, Sweden, Italy, Luxembourg, and Belgium. Local privacy notices, language requirements, consumer/business notices, and tax-related retention rules may need country-specific review.

3. Personal data we process

• Account data: name, email, phone, role, country, city, language, marketing opt-in, authentication identifiers, onboarding status, and consent preferences.
• Restaurant data: owner-confirmed business profile, Google Place ID, Google Maps URL, minimal Google Places business data, restaurant story, operations, booking links, campaign details, files, and subscription records.
• Creator data: profile, social URLs, follower count, audience information, verification proof, campaign preferences, applications, invites, bookings, content proof, payout ledger, and invoice profile placeholders.
• Billing data: plan, subscription status, Mollie customer/payment/subscription identifiers, billing details, invoices, no-refund policy acceptance, and trial dates.
• Technical data: security logs, cookies, consent records, device/browser signals, campaign tracking events, referrer/UTM fields, and analytics events where consent applies.

4. Purposes and GDPR legal bases

• Contract performance: account setup, onboarding, subscriptions, campaign marketplace workflows, creator matching, applications, booking slots, tracking links, dashboards, invoices, and transactional emails.
• Legitimate interests: security, fraud prevention, duplicate restaurant protection, product reliability, audit logs, abuse prevention, support, and operational administration.
• Consent: Google Analytics, non-essential cookies, future marketing scripts, and marketing emails where required.
• Legal obligations: invoice, tax, payment, accounting, dispute, and compliance retention.

5. Google Places and Google reviews

Tablevert uses Google Places API through backend Cloud Functions to resolve Google Maps URLs and store minimal restaurant onboarding data such as Place ID, display name, address, phone, website, business status, rating, and user rating count where returned.

Tablevert does not scrape Google Maps and does not store Google review content or create a Google review database at launch.

6. Google Analytics and cookies

Google Analytics may be used to understand aggregate product usage only after analytics consent is granted. Analytics should not fire before consent in strict mode.

Necessary cookies or local storage are used for login, account security, consent records, locale preferences, and essential platform behavior. Analytics and marketing categories can be accepted, rejected, or updated later.

7. Gmail transactional emails and marketing opt-out

Tablevert may use Gmail API to send transactional emails about signup, verification, onboarding, trials, subscriptions, payments, campaigns, creator applications, matching, visits, content proof, completion, and admin alerts.

Marketing emails are sent only where marketing opt-in or another valid lawful basis applies. Users can opt out from account settings, unsubscribe links where present, or by contacting contact@tablevert.com.

8. File uploads

Restaurant owners and creators may upload files such as images, PDFs, menu files, verification proof, content proof screenshots, or invoice PDFs. Storage access is restricted by user role, ownership, campaign relation, and admin rules.

9. Sharing and processors

Tablevert may use Firebase Authentication, Cloud Firestore, Firebase Storage, Firebase Cloud Functions, Firebase Admin SDK, Google Places API, Google Analytics where consent applies, Gmail API, Mollie, hosting providers, and operational tools as processors or service providers.

Restaurant and creator data may be shared with the other party only where needed for campaign discovery, applications, matching, bookings, content proof, payout records, or dashboard workflows.

10. Retention and deletion requests

Data is retained only as long as needed for account, campaign, security, billing, invoice, tax, legal, dispute, or operational purposes. Users can submit a data deletion request through /data-deletion or privacy settings.

Deletion requests are reviewed before completion. Active subscriptions, campaign obligations, payout records, invoices, disputes, tax records, and security logs may delay or limit deletion where retention is required.

11. GDPR rights

• Request access, correction, deletion, restriction, portability, or objection where applicable.
• Withdraw consent for analytics, marketing, or other consent-based processing.
• Opt out of marketing email.
• Lodge a complaint with a competent data protection authority.
• Contact contact@tablevert.com for privacy requests.