Privacy Policy

About this policy

This policy explains how TABLEVA handles personal information on our website and in our early-access restaurant purchasing service. TABLEVA is operated by TABLEVA LTD, a company registered in England and Wales (company number 17510922) whose registered office is Flat 37 Bentham House, 2-4 Station Way, London, England, SE18 6FJ (“TABLEVA”, “we”). When a business supplies operational information about other individuals, TABLEVA may process that information on its behalf.

Information we handle

Account information includes your email, profile, role, workspace membership and preferences. Credentials and sessions are handled through our authentication service.

Restaurant and supplier information may include products, recipes, prices, purchases, invoices, sales, stock, waste, surplus and delivery records. Uploaded files and imports may contain names or business contact details. Only provide information you are authorised to share and avoid unnecessary personal or sensitive information.

Supplier discovery may use publicly advertised business information, source URLs and review records. Public-source information is distinguished from verified supplier capabilities and is subject to review.

How and why we use information

We use information to create and secure accounts, provide workspace features, process authorised imports and actions, support purchasing analysis and Luma recommendations, maintain evidence and audit records, and diagnose problems. Private customer records are not public demo data.

Depending on the activity, our legal basis is performing an agreement, legitimate interests in providing and securing a business service, meeting legal obligations, or consent where required. We consider individuals’ interests when relying on legitimate interests. Optional consent can be withdrawn without affecting earlier lawful processing.

If you approve monthly accounts in Profitability, we add up results across restaurants to understand how restaurants do after joining TABLEVA: what they’re left with after food and staff costs compared with the same months before they joined, and what TABLEVA cost them. Only TABLEVA’s own team sees these totals. They never show a restaurant’s name or its own figures, demo workspaces are left out, and nothing is shown for fewer than five restaurants. We use them, as part of our legitimate interests, to improve TABLEVA and to describe in general terms how restaurants do after joining, and we’ll ask before using any one restaurant’s results.

Monthly accounts, and the payroll and labour totals in them, are visible to the restaurant’s owner and to anyone on the team the owner gives accounts access, such as their accountant or a manager. The owner can remove that access at any time, and only the owner approves a month. When a month's approved accounts show a restaurant was better off after staff costs than before it, by the rule shown in Profitability, that gain counts in the restaurant's Total Saved, and only the owner and people with accounts access can see it. It isn't used for billing.

Cookies and similar technologies

TABLEVA LTD is the controller for cookies and similar technologies on tableva.ai. We ask before using anything that isn't strictly necessary, under the UK Privacy and Electronic Communications Regulations (PECR) and UK GDPR. Optional cookies are off until you choose “Accept all” or switch a category on; “Reject all” is as easy as accepting, and closing or ignoring the banner is not consent.

Strictly necessary (always on, no consent needed): sign-in session storage from our authentication service, security, the private workspace and one record of your cookie choice (the categories you chose, the policy version and the date). That record holds no identifier and is kept for up to 12 months, after which we ask again. Rejecting optional cookies never signs you out or stops the service working.

Analytics (only if you accept it): Google Analytics (Google Ireland Limited / Google LLC) to count visits and see which public pages are useful. Cookies such as _ga and _gid typically last up to 2 years and 24 hours respectively. We don't use session recording.

Marketing (only if you accept it): Meta Pixel (Meta Platforms Ireland Limited), LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) and Google Ads (Google Ireland Limited) to measure whether our adverts lead to visits and sign-ups. They may set cookies such as _fbp and _fbc (up to 90 days), li_ and lidc (up to about 6 months) and _gcl_ (up to 90 days). With marketing or analytics accepted we also remember, on your device, the advert or QR code that brought you here (source, medium, campaign and QR batch only) until you withdraw consent or clear your browser storage.

Meta Conversions API (only if you accept marketing): when we successfully receive a website enquiry, when you create a TABLEVA workspace, and when you start your Founding 200 free days by saving a card, our server tells Meta the relevant event happened. This lets us measure which Meta adverts lead to sign-ups, even when a browser blocks the Pixel, and lets Meta show our adverts to people more likely to sign up. We send what happened (enquiry received, workspace created or free days started), when, its general kind and the TABLEVA page it happened on; your email address and TABLEVA user ID, each hashed (turned into a one-way code) before it leaves our server where available (website enquiries have no TABLEVA user ID); your IP address and browser details; and the _fbp and _fbc cookies the Pixel set. Meta uses the hashed details to match the event to a Meta account, where there is one. If you haven't accepted marketing on the device you're using, nothing is sent.

Automatic advertising page-view tags load only on public pages after consent. For a specific completed sign-up or trial, the Meta Pixel may load on that private workflow solely to report that one consented conversion, without recording private-page browsing. The two Conversions API events above are the only thing we send to Meta from the workspace. We never send invoices, prices, orders, stock or other workspace data to any of these providers, and we don't use automatic form data collection.

Changing your mind: use “Cookie settings” at the bottom of any page to switch categories on or off at any time. When you withdraw, we stop loading the tools and stop sending Conversions API events, ask Meta and Google to stop through their consent controls, reload the page so running scripts stop, and delete the first-party cookies and storage they set on tableva.ai where your browser allows. Data a provider has already received, and cookies a provider set on its own domain, can't be removed from our site; you can delete them in your browser settings or ask the provider directly under its own privacy policy. Withdrawal doesn't affect processing before it.

Meta, LinkedIn and Google may process this information outside the UK, including in the United States. Where they do, they rely on safeguards such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum. Each provider is also responsible for its own use of the data under its own privacy terms.

How you heard about TABLEVA

When you set up a workspace we may ask, optionally, how you heard about TABLEVA (for example a QR code, Instagram, Google, LinkedIn, a recommendation or something else). We store your answer, and the advert, QR code or invite link reference you arrived with, only if you tick the box to agree. An invite link is one a business you trade with sent you itself, by email or a message; its reference tells us which business invited you, never anyone's name or email address. TABLEVA never sends these invites. It's linked to your account, used only to understand which marketing works, never sold, and kept while your account is open or until you ask us to delete it. Leaving it blank never affects your account.

Sharing and service providers

Authorised workspace members access information according to their permissions. Service providers process information for hosting, authentication, storage and other configured services. Authorised payment or POS connections involve the relevant provider and its own privacy terms. Information may also be disclosed where legally required or necessary to protect the service and its users.

Where processing involves transfers outside the UK, applicable safeguards must be used, such as an adequacy decision or appropriate contractual safeguards. We do not promise a particular data-residency location. Provider and transfer details can be requested through the contact approach below.

AI document reading is optional and chosen per document. When a workspace member opts in, that invoice or menu file is sent to our AI service provider (OpenAI models accessed through Lovable's AI gateway on a zero-data-retention basis) only to create a draft for that member to check. The draft is not trusted, saved or used to change stock until a member confirms it. Suppliers can opt in the same way for a price list: each page is sent to the same provider only to draft products and prices, which stay private to the supplier's team and change nothing in its catalogue until an owner or manager checks and publishes them. Do not opt in for files containing unnecessary personal information.

Sign-ups, enquiries and our customer records

When you create a TABLEVA workspace, we keep a record of it in our customer records: your email address, the business name and main contact name you gave, whether it's a food business or a supplier, the date, and whether you came through our website or, if you agreed at set-up to save how you heard about TABLEVA, an invite from a business you trade with. When you send us a question through the form on our website, we keep what you send: your business name, your name, your email address, your phone number if you gave one, whether you're a supplier or a food business, your message and which page you sent it from. To stop the form being misused, we count the messages sent from each internet address in an hour, using a one-way code made from the address rather than the address itself. We use these records to reply to you, to help you get set up and to understand how businesses find TABLEVA, as part of our legitimate interests in running a business service. We never add invoices, prices, orders, stock or other workspace data to them.

These records are kept in HubSpot, our customer records (CRM) provider, which processes them for us. HubSpot may process them outside the UK, including in the United States; where it does, it relies on safeguards such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum. We keep them while you use TABLEVA or we're in touch with you, and you can ask us to delete them using the contact details below.

Retention, security and deletion

We retain information while needed to operate your account and for relevant legal, accounting, security and dispute-resolution purposes. Transaction and audit records may need to remain after closure, and backups may expire separately. We do not promise immediate deletion from every system.

Access controls and other safeguards protect the service, but no online system is risk-free. Request account closure or deletion through the operator; closing a browser or removing an import does not necessarily delete related records.

Your rights and contact

Under UK data-protection law, individuals may have rights to access, correct or erase information, restrict or object to processing, and receive certain information in a portable form. These rights depend on the circumstances. You can complain to the UK Information Commissioner’s Office (ICO).

For privacy questions or rights requests, email help@tableva.ai or write to TABLEVA LTD at its registered office: Flat 37 Bentham House, 2-4 Station Way, London, England, SE18 6FJ. If your information was supplied by your employer or another customer business, that business may be the appropriate first contact. We may need to verify your identity before acting on a request.

Policy updates

We may update this policy as the service evolves. The date above identifies this version. Material changes will be communicated through an appropriate available channel.