Privacy Policy

• No analytics service or tracking. We don’t use Google Analytics, advertising pixels or any analytics service, and we don’t count page views or menu scans.
• Click counts: on our own pages (not on shops’ QR menus or online stores), we count clicks on the links that start a free trial, open WhatsApp, download the Windows app or open a demo, as a total for each page and month. Nothing about who clicked is stored: no cookie, no IP address and no device ID.
• Standard request data: like any website, our hosting provider receives your IP address, browser details and the page you asked for. Some stock photos load directly from Unsplash (see Who we share it with).
• Your browser’s storage: our marketing pages set no cookies. Some pages keep a few items in your browser, listed in Cookies and storage.

• Account details: shop name, the mobile number registered to your account, business type or location, logo, plan, trial and renewal dates, languages and exchange-rate settings. If you signed up through WhatsApp, also the Whish number you gave.
• How your registered mobile number is used: it identifies your account and, with your PIN, finds your shop at tablelb.com/login. We use it to reach you about your account and to send announcements from Table, on WhatsApp. It is in your QR menu’s public page data, and customers see it after they order with Whish, OMT or Neo, even if you set a separate order number. Until you set one, the menu’s call and WhatsApp buttons use it too.
• Payment settings: the Whish, OMT and Neo numbers and the order phone number you show customers.
• Business details (Management → My company): name, legal name, address, phone, email, website, tax and registration numbers, bank details, logo and receipt text. They are printed on receipts and invoices. If you trade under your own name, some of this is personal data.
• Your name on the admin profile.
• Your conversations with Table’s WhatsApp assistant: your messages, transcripts of your voice notes, the assistant’s replies, a short AI-written summary of the conversation that we keep and update, notes you ask it to remember, and a log of actions it took.
• Photos: images you send to Table’s WhatsApp number and product photos you upload in the apps.
• Billing records: payments you make to Table (amount, method, reference and notes), codes you redeem, and renewal requests you send on WhatsApp.
• Support records: tickets you send from the app (title, description, contact details you add, app version, and any screenshots, screen recordings or voice notes you attach, plus the help-assistant conversation if you send it to us), whose text may also be forwarded to our team on WhatsApp; our notes about your account, such as your email, address, Instagram, previous system, how you heard about us or who referred you, other contact people at your business with their role and phone number, the hardware we installed with its model and serial number, and follow-ups; reminders we send you; a log of support actions such as PIN resets; and your AnyDesk ID if you give it to us.
• Signing up and signing in: when you sign up, your shop name, mobile number, business type and your till’s web address may be sent to our team on WhatsApp. With your sign-up we also receive where that browser tab’s visit to our website began: the first page of ours it opened, the name of the website that linked to it (such as google.com) and any campaign tags (utm_…) in its address. We keep them with your account to learn which pages and campaigns bring new shops. We record the times of failed PIN attempts, and keep counters of recent attempts by IP address to limit abuse (see Apps and devices below).

The shop creates staff accounts and chooses which features to use. Depending on those choices, Table stores:

• Staff profile: first and last name, optional email, PIN (with one-way hashes of it; see Security for when it is also kept in readable form), access level, role, wage type and rate, weekly shift schedule, overtime setting and card colour.
• Time clock: clock-in and clock-out times, hours worked, amounts owed and notes. When payroll is switched on, cashiers are clocked in automatically when they sign in to the till. Changes to time-clock entries are logged with who made them; changes logged by earlier versions of Table hold the last two digits of the PIN used instead.
• Excused absences: the date, whether it is paid, and a short reason. A reason could include health information, such as “called in sick”, so keep these notes short.
• Activity: the staff member’s name on the sales, payments, shifts (including cash counted and any difference), voids, refunds, expenses and other records they make.
• Delivery drivers: name, optional phone number and pay rates.
• Biometric sign-in (passkeys): if someone sets up Face ID, fingerprint or Windows Hello, the face or fingerprint stays on the device. We store the passkey’s public key (which can check a sign-in but can’t be used to sign in by itself), a device label and the dates it was registered and last used. A successful biometric check signs the person in without their PIN. Older passkey records also hold a copy of the PIN; it is no longer used, and it is erased at the shop’s next sign-in with its main PIN or a passkey.
• Failed sign-ins: the times of failed PIN attempts.

What we hold about you depends on how you order and which features the shop uses.

• QR menu orders: your name and phone number, the items, add-ons and notes, the total, the payment method and whether it is delivery or pickup. For delivery we also keep your address, delivery zone, any coupon and, if you shared it, a Google Maps link to your location. The shop sees the order in its till and owner phone app, and we send these details to the shop on WhatsApp. For a cash order, the menu also opens WhatsApp on your phone with the order written out (the order reference, items, total, your name, address, location link if shared, zone, the amount you will pay with and your notes), and you send it yourself to the shop’s number.
• Your location: collected only when you tap to share it at delivery checkout on the QR menu. There is no background tracking.
• Online store orders: your name and phone number, the items, the payment method, your notes and, for delivery, your address. We send these to the shop on WhatsApp, and you may get updates about your order on WhatsApp from Table’s number. When you check an order’s status, the order reference and your phone number are sent in the web address of the request.
• Coupons: when you use a coupon online, we record the code and your phone number so the shop’s per-customer limits work.
• Reviews: after a QR menu order you can leave a 1–5 star rating and a comment. We don’t attach your name or phone number. Ratings of 5 stars, and of 1 or 2 stars, are sent to the shop owner on WhatsApp with the comment. When the owner asks the shop’s WhatsApp assistant for a report, one comment from that period, if there is one, is sent with the shop’s figures to our AI provider to write the report. If you tap the button to review the shop on Google, we record the tap and your rating, with nothing about you.
• “Ask our AI Chef” chat: your last 10 messages in the chat (and the AI’s replies) are sent, with the menu, to our AI provider to get a reply. We don’t save the chat.
• In the shop: if the shop creates a customer record for you, it can hold your name, phone, email, address, birthday, company, tax number, notes, total spent, number of visits, price tier, VIP level, loyalty points, credit limit and payment terms. Shops can also import customer lists from a file. Your name is saved on sales linked to you, and the sale notification sent to the owner on WhatsApp includes your name and the items. If you buy on credit, the shop keeps what you owe, and the owner’s app may alert them about your credit and your birthday.
• Other records a shop may keep: reservations, open tabs and deliveries (name, phone, address, party size, times and notes); chalet self-orders (name, phone and notes, printed on the kitchen ticket); car rentals (the renter’s contact details, any additional driver, and vehicle inspection photos); session packages (your name, phone and the sessions booked and paid); phone top-ups and transfers (the recipient’s phone number); and warranties (the product’s serial number with your sale, which also appears in the owner’s WhatsApp notification).
• Quotations: a shop can send you a quotation as a link. The page shows the quotation as it would print, including the customer details on it, to anyone who has the link. It is not listed in search engines.
• Customer display: the screen facing you shows the items and totals of your sale and, on the shop’s own devices and on screens the shop has paired, your name and loyalty points if the sale is linked to you.

The QR menu has no customer accounts or login. The web addresses of an older, switched-off customer sign-in still answer, though. If someone uses them directly, we store the phone number and a one-time code, which is sent by SMS if we have SMS set up, or on WhatsApp if that number messages our number asking for it. Completing the sign-in creates a customer account (phone number and name) and a session cookie, and keeps any delivery addresses saved through it (up to 10).

When you order hardware or a bundle through online checkout at tablelb.com/shop, we keep your name, phone number, business name, address, notes, the items and the payment status, plus the phone number that paid, as reported by Whish. When Whish confirms a payment, the order details are sent to our team on WhatsApp. If you order on WhatsApp instead, we receive what you send in your message. Either way, we contact you on WhatsApp to arrange delivery and installation.

If a shop records a supplier, including a farmer whose produce it sells on consignment, it can store the contact person’s name, phone, email, address, tax number, payment terms and notes.

If you message Table’s WhatsApp number or email us, we keep your messages (see WhatsApp messages). If you ask about Table, we may keep a short record of you as a possible customer: your name, phone, area, type of business, how you found us and notes about our conversations.

• Abuse prevention: we keep counters of recent attempts, keyed by IP address, for sign-ups, Find my shop, the till’s PIN sign-in, the AI Chef chat, menu translation, online-store orders and order-status checks, orders from our shop, device pairing, redeeming renewal and licence codes, and our operator console’s sign-in. The switched-off customer sign-in counts attempts by phone number.
• Error reports: if an app hits an error, it sends us the error message, technical details and browser or app details, which we store with the shop’s account so we can fix problems.
• Device reports: the Windows app reports a random device ID, the shop, its version and its update channel when it starts. Our apps also report when a device loses or restores its pairing, and when a device lands on a missing page. After a connection problem, the Windows app reports how it recovered: the internet addresses it found for tablelb.com, whether a proxy was set up and whether our site answered.
• Shop network: when a shop chooses a main till (Settings → General → Shop network), we keep the network’s key and where the main till is: its device ID, computer name, private addresses on the shop’s network and port, so the other tills can find it. Without internet, the Windows tills on the shop’s network then exchange open tables, kitchen rounds and their unsynced sale lines (item and quantity), and tills that share a register the amounts, payment methods and times of their unsynced sales, refunds and cash drawer entries (with each entry’s reason), directly with the main till, encrypted with a key unique to the shop.
• Pairing code on the clipboard: on a Windows computer, Download and Copy code on our sign-up page copy the text “Table pairing code: ABC-XYZ” to your clipboard; on other devices Copy code copies just the code. The sign-up page never reads your clipboard. The Windows app reads it only on its pairing screen, while the app is not paired and nobody has typed there: when the screen opens and each time the app window comes back to the front, but not on the screen that “Unpair this device” in the till’s settings opens; and once right after the app pairs, to check whether the clipboard still holds the code it used. Only text that is exactly such a pairing code is used, and only that code is sent to us, to pair the app as a typed code would; anything else on the clipboard is left alone and sent nowhere. After pairing, the app clears that text from the clipboard if it still holds the code just used. What the app keeps about it is listed in Cookies and storage.
• Menu translation: when a QR menu is shown in Arabic or French, untranslated menu text is sent for translation. Only menu text is sent; the counter above keeps your IP address.
• Camera and microphone: the till and owner app can use the camera to scan barcodes; codes are read on the device and camera images are not sent to us. The microphone is used only when you choose to speak to the help assistant or record a voice note for a support ticket.

• We receive your messages, voice notes and photos, and we store your messages, the transcripts and the assistant’s replies.
• We may send you new-order and sale notifications, reviews, daily and weekly summaries, licence and billing reminders, service alerts, and announcements from Table to all owners.

• When you order online, the shop’s WhatsApp notification includes your name, phone number and notes and, for delivery, your address and your location link if you shared it.
• When a sale in the shop is linked to your customer record, the owner’s WhatsApp sale notification includes your name and the items.
• From Table’s number you may receive updates about an online-store order, a “ready around” time when the shop sets one, and promotional messages (broadcasts) that the shop sends. A broadcast from the shop’s WhatsApp assistant goes to phone numbers on the shop’s online orders and deliveries from the last 90 days; a shop can also pick customers from its customer list.
• Broadcasts from a shop’s WhatsApp assistant end with “Reply STOP to opt out”. If you reply with just STOP or UNSUBSCRIBE (or the same in French or Arabic, such as “وقف”), we put your number and the date on one opt-out list for all of Table and reply to confirm. From then on, promotional messages that any shop sends through Table’s number, from its WhatsApp assistant or by picking customers in the app, skip your number, including shops you only order from later. Messages about your own orders still arrive. This also works from a number that is a shop’s registered mobile number on Table; that shop’s own alerts and WhatsApp assistant carry on as before.
• If you message our number asking about your order, we look up the latest order placed with your phone number, at any shop on Table, and reply with its status.

• Messages from numbers that are not linked to a shop are stored, and the sender’s number can be stored with them. Our AI assistant answers them and treats them as a possible new sign-up. When it replies, the assistant is sent only your own recent messages to us and its replies to you, not other people’s. Messages of this kind stored without a number are kept but never sent to the assistant again.
• Any image sent to our number is saved in public storage, at a random web address. AI “studio” photos made from them are stored the same way, and when one becomes a product photo, its address appears on the shop’s public menu. Older images and studio photos are at addresses that include the sender’s phone number, and stay there.
• If a number messages ours asking for a sign-in code (for example “TABLE CODE”), we reply with any unexpired code waiting for that number.

The Table apps, QR menus, online stores, quotation links and our sign-in and download pages install an offline helper (a “service worker”) so they can open without internet. Our other website pages, the sign-up page and our shop don’t.

On the till this storage belongs to the Windows app, and uninstalling the app does not remove it. In the owner app, waiter tablets and price checkers it is the browser’s storage.

• Secure connections (HTTPS) everywhere, and browsers are told to always use one for our site.
• Browser protections that stop other websites from showing our pages inside theirs, and limit which scripts the apps, QR menus and online stores can run.
• Our server code keeps each shop’s data separate. Through our apps and servers, most till data can only be read or changed with the shop’s PIN, and refunds, cash and other protected actions also need a signed staff session with the right access level. What the Management, Settings, Reports and Sales history screens load and save is also checked on our servers against the signed-in person’s access level (see the limits below).
• The main admin PIN is kept on our servers as a one-way hash, staff PINs are moving to one-way hashes (see the limits below, for when a PIN is still kept in readable form and for the hash used for offline sign-in), and repeated wrong PINs slow down and then temporarily block further attempts.
• For offline sign-in, the apps receive scrambled (hashed) copies of staff PINs, not the PINs themselves.
• The current apps send the PIN, or the till’s device token, in a request header rather than in the web address, and after a reload a till sends its device token instead of the main admin PIN.
• A customer display on another computer or tablet is paired once with the shop PIN; once a shop has paired a screen, unpaired screens receive nothing.
• Versions of the Windows app after Standard 2.0.23 and Legacy 1.0.68 give silent printing, the cash drawer, shutting the computer down and their other device functions only to pages on Table’s own web addresses, and do not load other websites inside the app. A till keeps the older, looser check of the version it has until it installs one of those versions.
• Biometric sign-in uses passkeys, so face and fingerprint data stay on the device.
• When the payment numbers customers pay to are changed in the app, the change is logged and we send the owner a WhatsApp message.
• Backups, both the one you download from the app and our nightly copy, leave out PINs and passkey records.
• We check Meta’s signature on every incoming WhatsApp message before acting on it.
• Sign-up, sign-in, online-store checkout, our shop’s checkout and code redemption limit repeated attempts.
• Our operator console uses a signed session cookie and limits repeated sign-in attempts.
• Nightly backups go to private storage.

• The main admin PIN is kept on our servers as a one-way hash; an older shop’s starting PIN stays in readable form until it is first used.
• Staff PINs are moving to one-way hashes in two stages. Until we switch on the second stage, a staff PIN that is set or changed is still stored in readable form beside its hashes, so an older version of Table keeps working. From the second stage, a new staff PIN is kept only as hashes, and an older staff record keeps its readable PIN until the owner’s till next loads the staff list or that PIN is next used.
• A passkey record (from biometric sign-in) made before we stopped copying PINs into them holds a copy of the PIN until someone next signs in to the shop with its main PIN or a passkey.
• For offline sign-in, each staff record on our servers also holds a second, faster hash of the staff PIN, and tills and waiter tablets keep copies of it; someone who copies one could work out the PIN by trying every possible PIN.
• Nightly backups made before we started leaving PINs out of them contain staff PINs and passkey records. They are deleted as newer backups replace them, except copies that no newer backup replaces, such as those of a deleted account.
• Tills keep the main admin PIN in readable form beside their device token until our servers tell them to delete it, which they do from the second stage above. The owner app keeps a device token when you choose to stay signed in, and a waiter tablet keeps a scrambled check of its PIN; copies saved by older versions of those apps hold the PIN in readable form until the app next opens.
• A till’s device token works like the main admin PIN for most actions: someone who copies it from the till can use it until it expires, at most 30 days after it was issued, or until the PIN is changed.
• The current apps send the PIN in a request header. Older copies of the apps, until a device loads the new version, still put it in the web address, so PINs can appear in plain text in our hosting provider’s request logs.
• Photos and support-ticket attachments (screenshots, recordings and voice notes) are stored at public links: anyone who has a link can open it. Images sent to our WhatsApp number, and AI studio photos made from them, now get a random address, but older ones are at addresses that include the sender’s phone number. A quotation link shows that quotation to anyone who has the link.
• Opening the cash drawer outside a sale is checked by the till app only. The level checks on Management, Settings, Reports and Sales history apply to requests from the till's own screens; a request made directly with the shop's owner credential, such as the sign-in a till keeps, counts as the owner's. Data those screens share with the sale screen, such as products, customers, stock counts and tables, is not re-checked against the user's access level.
• We don’t add our own encryption to stored data beyond what our providers offer.
• Table’s team can access all account data, and our automated checks can use every shop’s PIN-protected functions.
• Some shop details are public by design and can be read without a PIN by anyone who has the shop’s Table web address: the QR menu’s page data, including the account’s registered mobile number and the Whish, OMT and Neo numbers the shop set; the product list used by the price-check screen, including barcodes and SKU/PLU codes; the items and totals of the sale on the customer display, until the shop pairs its first customer-display screen (from then on only paired screens and the shop’s own devices receive it); what a receipt prints from Management → My company: the shop name, logo, website, address, phone, email, legal name, tax and registration numbers, receipt header and footer, and tax rates (the bank details need a PIN); the licence plan, whether it is active or paused, and how many days are left; which of these add-ons the licence includes: the QR menu, the online store, chalets, session packages and extra cash registers (and how many), how many waiter-tablet slots it has, and what those cost at list price (the itemised bill and any agreed price need a PIN). Only enter business details you are happy to make public.

No system is perfectly secure. If you think something is wrong, tell us on WhatsApp at +961 81 664 397 or by email at tableposlb@gmail.com.