Privacy Policy

This Privacy Policy explains how Tableify (“we”, “us”, or “our”), a product of ION Hospitality, collects, uses, and protects your information when you use our website at tableify.com and our software services (the “Service”).

1. Information we collect

Account information. When you sign up, we collect your name, email address, and password (stored hashed). If you sign in via a third-party identity provider such as Google, we receive your name, email, and profile photo from that provider.

Business information. Your restaurant’s name, address, phone number, logo, branding assets, menu items, event spaces, photos, and other content you upload to the Service.

Integrations data. If you connect a third-party service (such as your POS, Stripe, Meta / Facebook / Instagram, or others), we receive and store the data exchanged through that integration on your behalf. This may include contact records, customer messages, opportunity / pipeline data, payment activity, social media engagement, and POS transaction summaries. We only access data you have explicitly authorized through the integration.

Google services. If you connect Google Analytics or your Google Business Profile, or hire Tableify to run your Google ads, section 4 explains exactly what we can see and do in each Google service, how we use that data, how long we keep it, and how to turn it off.

Usage information. Standard logs and analytics — IP address, browser type, pages visited, actions taken — collected via Firebase and industry-standard analytics tools to operate, secure, and improve the Service.

Reservation booking attempts. When you proceed past the guest information step of a restaurant’s booking flow (after entering your name, phone, and email but before completing payment), we save your contact details and intended reservation so the restaurant can follow up if you don’t complete the booking. These records are automatically deleted after 90 days unless the booking is completed. You can opt out of follow-up communications by replying STOP to any SMS or clicking the unsubscribe link in any email.

2. How we use your information

To provide, maintain, and improve the Service
To authenticate users and prevent abuse
To process payments and manage subscriptions
To send service-related messages (account, billing, security)
To respond to support requests and inquiries
To comply with legal obligations

We do not sell your personal information. We do not use customer data uploaded to your Tableify account to train AI models for any purpose outside of your own brand.

3. Sharing your information

We share information only with the parties strictly necessary to operate the Service:

Service providers who help us run the Service: Google Firebase (hosting, authentication, database, file storage), Stripe (payment processing), the AI service providers that power our assistants (see section 11), and similar infrastructure providers. They may use the information only to provide their service to us.
Third-party integrations you connect such as your POS (Toast, Square), Meta, Google, Stripe, and similar — data flows between Tableify and these services according to the connections you authorize.
Legal compliance if we are required by valid legal process (subpoena, court order) to disclose information.

4. Google services and Google user data

Tableify can work with three Google services. Each one asks for its own permission on Google’s own screen, and each can be connected or disconnected on its own. This section lists every Google permission Tableify asks for, what it lets us see or do, and how we treat that data. Whenever a Google service is connected, Google also tells us the email address of the Google account that approved it (the openid and email permissions), so we can show which account is connected. Signing in to Tableify with Google is covered in section 1.

Google Analytics (`analytics.readonly`)

What we access. Read-only reports from the Google Analytics property you choose: website visits, traffic sources and channels, landing pages, devices, cities, key events and campaign results. We cannot change anything in your Analytics account.

How we use it. Only to show these reports in your Tableify dashboard, including how each of your leads found your website, so you can see how your website and marketing are performing.

Google Business Profile (`business.manage`)

What we access. The Business Profile listing you choose: its name, address and other listing details, and the reviews guests leave on it, with any replies.

How we use it. We show your Google reviews in your dashboard and can alert you when new ones arrive. We post a reply to a review on your listing only when you approve that reply, or when you have switched on Stella, our review assistant, to post replies to 4 and 5 star reviews for you. If you switch on event posting, we post the events you create in Tableify to your listing. We do not change your listing’s name, address, hours or other details. To suggest a reply, the review’s text and star rating are sent to the AI service that powers our assistants, only to write that suggestion.

Google Ads (`adwords`)

Who signs in. Tableify’s own team, through Tableify’s Google Ads manager account. Restaurants do not sign in to Google for this.

What we access and how we use it. For restaurants that hire Tableify to run their Google ads, we use this permission to create and manage their ad campaigns (for example budgets, ads, keywords, and pausing or resuming a campaign) and to read the results (such as spend, clicks, calls and reservations) so we can show them in the restaurant’s Tableify dashboard. When a guest books, orders or sends an inquiry after clicking one of those ads, we report that result to Google so the campaign can be measured. Any guest email address or phone number sent with it is scrambled (hashed) first, so Google can match it without receiving it in readable form.

Commitments that apply to all Google data

Not sold. We do not sell Google user data.
No advertising profiles. We do not use Google user data for serving advertisements, including retargeting, personalized or interest-based advertising, and we do not use it to build advertising or user profiles.
No AI training. We do not use Google user data to develop, improve or train generalized AI or machine-learning models, and we do not allow the AI services we work with to do so.
Only for the features above. We use Google user data only to provide or improve the user-facing features described in this section. We do not transfer it to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
Limited human access. We do not allow people to read Google user data unless you have agreed to it for specific data (for example, when you ask our support team to look at a report with you), it is necessary for security purposes such as investigating abuse, it is needed to comply with applicable law, or it is used for internal operations in aggregated and anonymized form.

How we store and protect it. The access Google grants Tableify is stored in a restricted area of our systems that only our servers and authorized Tableify staff can reach. It is never sent to your browser or shown in the dashboard. Google data is encrypted in transit and at rest, and the reports we show are visible only to the people with access to that restaurant’s Tableify account.

How long we keep it. The access Google grants is kept while the connection is on and deleted when it is disconnected. Reports and reviews we have already brought in are kept as part of your account history while your account is active, so your dashboard can still show past months, and are deleted when you ask us to delete them or your account is closed, as described in section 5.

How to disconnect and ask for deletion. You can disconnect Google Analytics or your Google Business Profile at any time with the Disconnect button on the Integrations page in Tableify. That stops all new access and asks Google to cancel the access it gave Tableify. You can also remove Tableify’s access from your Google account at any time at myaccount.google.com/permissions. A restaurant that no longer wants Tableify to run its Google ads can tell us, or remove Tableify’s manager account from its Google Ads account. To ask us to delete the Google data we hold for your account, email support@tableify.com.

Google API Services User Data Policy. Tableify’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data retention

We retain your account and content data for as long as your account is active, and for a reasonable period after termination to comply with legal, accounting, and dispute-resolution obligations. You can request deletion of your data at any time by emailing the address below.

6. Security

Data is encrypted in transit (TLS) and at rest. We use Firebase’s security rules and industry-standard authentication to protect your account. No system is perfectly secure; we cannot guarantee absolute security but we treat your data with the care we would want for our own.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information; to object to certain processing; or to withdraw consent at any time. To exercise these rights, contact us at the email below. California residents may also exercise rights under the CCPA, and EU / UK residents under GDPR.

8. Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, and gather basic analytics. You can disable cookies in your browser, though parts of the Service may not function without them.

9. Children

The Service is not intended for individuals under 16. We do not knowingly collect personal information from children.

10. Marketing communications and consent

When you give us your phone number — for example, when you sign up, request a plan, or use one of our free tools — you agree that Tableify may contact you with marketing texts, marketing emails, and marketing phone calls about our products, offers, and updates. Any marketing phone calls are placed manually by a person; we do not use autodialers, and we do not use prerecorded or artificial-voice messages for marketing calls. Message and data rates may apply to texts, and message frequency varies. You can opt out of marketing texts at any time by replying STOP, and you can opt out of marketing emails using the unsubscribe link in any email. Consent to receive marketing is not a condition of buying anything from us. We will still send you service-related messages (such as account, billing, and security notices) as needed to operate the Service.

11. AI assistant conversations

The Service includes AI assistants and agents that you can chat with. We may store, monitor, and review your interactions and conversations with these assistants to provide support, maintain quality, protect the safety and security of the Service, and improve how the assistants work. Please avoid sharing sensitive personal information you would not want retained in these conversations.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent changes. Material changes will be announced via email or in-app notice.

13. Contact

Questions, requests, or concerns? Email support@tableify.com.