Privacy Policy

1. Information We Collect

We collect different types of information depending on how you interact with Tablekard:

For Dine-In Customers

• Account Information: Name, email address, and profile photo — collected when you sign in via Google OAuth or Magic Link email login.
• Phone Number: Optionally provided in your profile and used for payment prefilling.
• Order Data: Menu items selected, variant and add-on choices, quantities, order type (dine-in or takeaway), and special cooking instructions.
• Location Data: GPS coordinates (latitude, longitude, accuracy) collected via your browser to verify you are within the restaurant's geofence radius before placing an order.
• Feedback & Reviews: Star ratings (1–5) and written comments submitted after your dining experience.
• Favourites: Menu items you bookmark for quick access.

For Restaurant Owners & Staff

• Business Information: Restaurant name, contact email, phone number, physical address, and geographic coordinates.
• Account Credentials: Name, email, and role (admin or staff) linked to your Supabase Auth account.
• Payment Configuration: Razorpay API keys and webhook secrets (stored encrypted in Supabase Vault — we never store these in plaintext).
• Menu & Operational Data: Menu items, categories, pricing, images, 3D model URLs, operating hours, branding settings, and table configurations.

From Our Landing Website

• Lead Information: Owner name, restaurant name, phone number, and optionally email, location (country, state, district) — submitted through our contact and registration forms.

2. How We Use Your Information

• Order Processing: To place, track, and fulfil your food orders in real-time between customers and restaurant kitchens.
• Payment Processing: To facilitate secure payments via Razorpay (UPI, credit/debit cards, net banking, and mobile wallets).
• Location Verification: To confirm you are physically present at the restaurant before allowing order placement (geofencing).
• Personalised Recommendations: To suggest menu items based on ordering patterns using our built-in collaborative filtering algorithm. This runs entirely within our platform — no data is sent to external recommendation services.
• Feedback & Improvement: To help restaurants improve their offerings based on customer ratings and reviews.
• Account Management: To manage your profile, order history, favourites, and restaurant subscriptions.
• Communication: To respond to your enquiries submitted via our contact forms and to send essential service notifications.

3. Data Sharing & Third-Party Services

We do not sell your personal information. We do not use any third-party analytics or advertising trackers (no Google Analytics, no Mixpanel, no ad pixels). We share data only with the following service providers essential to operating Tablekard:

• Supabase: Our database and authentication provider. Stores all platform data with Row Level Security (RLS) policies ensuring users can only access their own data. Handles Google OAuth and Magic Link authentication.
• Razorpay: Our payment gateway. Processes online payments (UPI, cards, net banking, wallets). Your payment details are handled directly by Razorpay and are never stored on our servers. Payment credentials for restaurants are encrypted via Supabase Vault.
• Google: Provides OAuth sign-in. When you sign in with Google, we receive your name, email, and profile photo as permitted by your Google account settings.
• Restaurant Partners: Customer order data (items, instructions, table number) is shared with the respective restaurant to fulfil your order. Restaurant staff can view customer profiles only for orders placed at their establishment.
• Legal Requirements: We may disclose information when required by law, regulation, or legal process.

4. Data Storage & Security

• Row Level Security: All database tables are protected with Supabase RLS policies, ensuring customers can only read their own orders, profiles, and feedback. Restaurant staff can only access data for their own restaurant.
• Encrypted Secrets: Sensitive merchant credentials (Razorpay API keys, webhook secrets) are stored in Supabase Vault with encryption — never in plaintext.
• Secure Authentication: User sessions are managed via Supabase Auth using JWT tokens. We support Google OAuth and passwordless Magic Link login.
• Payment Security: All online payment flows use Razorpay's hosted checkout with server-side HMAC signature verification to prevent tampering. Order totals are recalculated server-side before payment creation.

5. Cookies & Browser Storage

Tablekard does not set any custom advertising or tracking cookies. We use browser storage as follows:

• Session Storage: Used to temporarily store your active restaurant context, table ID, cart items, and special instructions during your browsing session. This data is automatically cleared when you close your browser tab.
• Local Storage: Used minimally to store your notification sound preference for the live order queue. Supabase Auth may also use local storage to persist your login session.
• No Third-Party Cookies: We do not use Google Analytics, ad trackers, or any third-party cookies.

6. Device Permissions

Tablekard may request the following browser permissions, all of which are optional and can be denied:

• Camera: Used for scanning QR codes at your table. You can always enter the table URL manually instead.
• Location: Used to verify you are physically at the restaurant (geofencing). Required for placing orders at participating restaurants.
• Vibration & Audio: Used to alert you when your order is ready in the live queue. Can be toggled off.

7. Your Rights

You have the following rights regarding your personal data:

• Access & Update: You can view and edit your profile information (name, email, phone, avatar) at any time from the Profile page in the app.
• Order History: You can view and download PDF receipts of all your past orders.
• Deletion: You may request complete deletion of your account and associated data by contacting us at contact@tablekard.com.
• Opt-out: You can deny camera, location, and notification permissions at any time through your browser settings.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of Tablekard after any changes constitutes acceptance of the updated policy.

Questions About Your Data?

If you have any questions about this Privacy Policy or how we handle your data, reach out to us at contact@tablekard.com or call +91 91018 40955.