This notice explains how Tabled handles information across usetabled.com, our signed-in web experiences, our mobile apps, and the business and team tools that support the service. It describes what we collect, why we use it, who receives it, how long we keep it, and how you can manage your information.
We receive information you provide, information generated when you use Tabled, and information from services you choose to connect. A business or another member can also provide information about an interaction with you, such as an order, booking, message, or shared post. The information involved depends on the features you use and the permissions you grant.
We use information to provide and personalize Tabled, maintain accounts and permissions, show relevant places and events, support community and messaging features, fulfill transactions, respond to requests, measure service performance, prevent fraud and abuse, moderate content, troubleshoot problems, and keep financial and operational records.
We disclose information as needed to operate the service, fulfill your requests, and protect Tabled. Recipients can include:
We do not sell personal information, and we do not disclose it to third parties for cross-context behavioral advertising.
Retention depends on the record and why it exists. Account information remains while your account is active. Our current automated database and continuous media backup settings retain recovery data for 35 days. This is a recovery window, not a 35-day expiry for your account or customer records. Existing preservation snapshots or previously created backups may be retained longer. Messages, transactions, moderation records, support correspondence, security logs, analytics, and business records are kept only as long as reasonably needed for the service, safety, accounting, fraud prevention, dispute handling, or applicable recordkeeping requirements. Provider settings and backup cycles can affect when a deleted item disappears from every system.
Account-scoped first-party mobile analytics events expire after 180 days. Anonymous first-party business activity counters and de-linked aggregate market-demand counts expire after 800 days, which preserves two complete year-over-year reporting windows without keeping an open-ended event history. When you withdraw analytics consent or delete your account, Tabled immediately deletes the short-lived, account-linked demand guards and subtracts each recent contribution that is still linked by one of those guards. Tabled normally keeps a guard for the current partial date plus two completed dates; the daily deletion sweep can add up to one grace day. After that period, an older count has no account identifier by which Tabled can attribute or reverse it; that anonymous aggregate remains until its 800-day expiry. Optional Google Analytics data currently follows a two-month event-data and fourteen-month user-data retention setting in Tabled’s Analytics property.
OAuth authorization codes, access tokens, and refresh tokens for optional ChatGPT and Claude connectors follow the five-minute, 15-minute, and 30-day lifetimes described above. Only their hashes are stored. Authorization-code rows are scheduled for deletion 30 days after code expiry, and token family rows 30 days after refresh-token expiry. Revocation makes a credential unusable before that scheduled deletion; account deletion removes the account's connector credential rows immediately.
New password-recovery and email-verification records are scheduled for deletion within 30 days after the link expires. Tabled does not add raw IP address or browser user-agent fields to new application audit, waitlist, or one-time-link records. Older records and provider-managed security logs can follow a separate reviewed cleanup or provider retention cycle.
Self-service account deletion disables the account, removes sign-in credentials and active sessions, and scrubs profile fields from the account record. A deactivated technical row and records needed for financial, operational, fraud, safety, or referential-integrity purposes may remain. Business owners must transfer ownership or close the business before deleting their account. See account deletion instructions.
Available privacy rights and exceptions depend on where you live and the nature of the record. We may need to verify your identity before acting on a request.
You can browse public marketing pages, places, events, lists, and public profiles without signing in. An account is required for private or personalized features such as saving, posting, messaging, managing visits, and using account tools. Business administration requires an authorized business membership. Platform administration is restricted to authorized Tabled team members.
Device location is optional. Tabled asks for permission before accessing it and follows the permission you select. Nearby discovery uses a location fix to find places. You can instead choose a city or enter an address. Your device can allow approximate location, limit access to when you use the app, or deny access.
Visit reminders can monitor proximity to followed places on your device when permission allows. A reminder does not automatically create or publish a visit: tapping it logs a private visit, whose visibility you can change in the app. Driver live-location sharing sends coordinates to assigned active deliveries after the driver turns sharing on; those positions support delivery status for the recipient and authorized business team. The current driver app shares while its dashboard is open. Delivery position events may remain with the delivery record after sharing stops.
Turn off device-location access at any time in your browser or device settings. Drivers can also turn off live sharing from the delivery dashboard. Stopping location collection does not erase a previously saved visit, delivery address, or delivery record; you can request access or deletion using the contact details below. General browsing remains available without device location. We do not use precise location for advertising or sell location information.
The web and phone assistants are AI, not people. Immediately before you connect, Tabled tells you that Tabled, ElevenLabs, and their service providers—including third-party large-language-model providers—may record, view, store, and share the voice or text conversation to provide the service, improve products and services, train machine-learning models, and comply with applicable law. Choosing “Agree and continue,” and each later interaction with the assistant, means you consent to that processing.
You can ask for a human at any point or contact hello@usetabled.com without using the assistant. Assistant conversations are retained only as long as reasonably needed for support, service operation, quality, safety, and legal obligations, subject to provider settings and backup cycles. You may ask us to delete a support conversation.
You can choose to add Tabled as a user-added Model Context Protocol connector in ChatGPT, provided by OpenAI, or Claude, provided by Anthropic. A connection works only after you sign in to Tabled and approve the scopes shown on Tabled's authorization screen. You can decline instead. Every Tabled connector tool is read-only: it cannot save, post, message, order, book, change an account, or administer a business. Availability as a custom connector does not mean that Tabled has been approved for or listed in an OpenAI or Anthropic marketplace or directory.
Local recommendations. If you approve recommendation access and direct the assistant to use it, the assistant can send a structured search request containing search terms, a place-or-event-or-deal category, city and state, and filters such as open now, maximum distance, and result limit. It can send precise latitude and longitude only when you or the assistant supplies them for that request; Tabled does not independently obtain your device location through MCP. Tabled can use your saved taste, drink, vibe, dietary, neighborhood, going-out-frequency, price, and travel radius settings internally to rank results. The assistant receives public place, event, and deal details; distance and open-state information when applicable; the public Tabled business slug needed to refer to that business in an authorized follow-up; and concise recommendation reasons, which can reveal that a result matched one of your preferences. It does not receive an internal ranking score, a candidate or business database identifier, or your complete preference profile as a tool result.
Operator market demand. This separate scope is available only when the signed-in account is a member of the requested verified, active business. The assistant sends that business's public slug and a 7-, 30-, or 90-day period. Tabled returns only completed dates and thresholded market-level request counts by limited categories such as intent, daypart, and results or no results. A daily cell is omitted unless at least five distinct consenting accounts contributed to that exact cell. The disclosed totals are request signals and lower bounds, not unique people. This tool does not return another business's private records, individual account activity, raw Ask Tabled prompts, saved Ask searches, query text, coordinates, or identifiers from the underlying demand aggregates.
What the assistant provider receives. OpenAI or Anthropic already processes the request you make in its assistant under that provider's terms and settings. Through the connector, the chosen provider also sees the structured tool input it sends and the result Tabled returns. Tabled's MCP service does not receive the surrounding ChatGPT or Claude conversation, and it does not send stored raw Ask Tabled prompts. Tabled never includes your password, Tabled product session, authorization code, access token, or refresh token in a tool result, and it does not send connector credentials to the other assistant provider or to a business operator.
Connection and credential records. To establish and protect a connection, Tabled processes your Tabled account identifier; the chosen client's verified identifier and redirect address; the approved scopes and protected resource; a PKCE challenge; a random token-family identifier; and creation, code-use, expiry, revocation, and scheduled deletion times. Tabled stores only one-way hashes of OAuth authorization codes, access tokens, and refresh tokens—not their raw values at rest. An authorization code is single-use and expires after five minutes, an access token after 15 minutes, and a refresh token after 30 days. Authorization-code records are scheduled for deletion 30 days after code expiry, and token-family records 30 days after refresh-token expiry.
Rotation, disconnecting, and account security. Each successful refresh retires the old refresh token and issues a new pair; replaying a retired refresh token revokes the whole token family. A standard connector revocation, when sent by the provider, also revokes that family. You can remove or disconnect Tabled in the provider's connector settings to stop future connector use through that provider, or decline a later authorization request; the provider's handling of its copy follows its own controls and privacy policy. Changing, setting, or resetting your Tabled password revokes existing connector token families at Tabled and invalidates unused authorization codes. Suspending the Tabled account makes access and refresh credentials unusable. Self-service account deletion deletes the account's OAuth codes and token records along with its active sessions.
Optional web analytics. Google Analytics 4 is off until you choose Allow analytics. When allowed, it uses first-party cookies and pseudonymous client and session identifiers to measure public page use and page-performance measures such as loading, responsiveness, and visual stability. It can also process approximate location and browser or device information. Both event types use approved page types only; public profile handles and record identifiers are collapsed to route shapes before measurement. We do not intentionally send search terms, URL query values, URL fragments, raw referrer paths, or referrer query values. Same-site referrers may be reduced to an approved route shape, and cross-site referrers are reduced to their origin. Performance totals cover only opted-in page loads where measurement was active in time and can omit the first page on which you make that choice. Google Analytics is disabled on sign-in and sign-up, account, administration, contact, submission, business-claim, deletion, invite, order-link, and driver-link routes. Advertising storage, advertising personalization, and Google Signals are disabled.
Mobile product analytics. Tabled mobile apps can use Google Analytics for Firebase and Tabled's first-party analytics service to record bounded app-use events such as screen views and feature interactions. First-party events are linked to the signed-in account so consent and deletion apply to the correct person. These events help us understand reliability and product use. Mobile analytics starts off and both services run only after you enable it in the app's privacy settings; neither is used for third-party advertising.
Optional menu analytics. Signed-in accounts can separately opt in through account preferences to let Tabled count menu opens, visible pairing suggestions, and opening a suggestion to customize it. This supports internal product measurement by our admin team, not advertising or business-facing customer reports. Declining does not affect ordering or taste sharing. Events contain an approved action, account link, consent revision and hourly server receipt time, not menu text, taste values, products, restaurants, location, device or session identifiers. A shared consent generation prevents restored consent from silently restarting collection. The active-store retention cutoff is 60 days; daily cleanup removes expired records and outages can delay removal. Withdrawal deletes linked active events when the server receives it. Account closure removes events and consent history. Database backups normally expire within 35 days, with incident-preservation exceptions described above; they are not immediately purged by withdrawal. A record can therefore persist for about 95 days from collection, plus cleanup delays or an incident preservation hold. Before reopening a recovered database, restored menu events must be removed and a fresh consent generation requires new opt-in.
First-party business activity counters. Public place and event pages send aggregate actions such as a profile view, directions click, calendar add, or RSVP to Tabled. The counter record contains the business, action, web-or-app source, and time—not a Tabled account ID, session ID, device ID, or unique-visitor identifier. These counters are not a count of unique people and operate separately from your optional Google Analytics choice. The live IP can still be processed in memory for rate limiting or by infrastructure security systems without becoming part of the activity counter.
Account presence. When a signed-in app or browser is active, Tabled records a last-active time linked to that account. Presence visibility currently starts on for new accounts; accepted friends can see an “active now” indication for a short window. Turning presence visibility off prevents that friend-facing display, but does not currently stop the internal last-active update, which also supports service operation and aggregate active member reporting.
You can allow or decline optional website analytics at any time. Declining disables future Google Analytics collection and removes Google Analytics cookies available to this site. The choice does not disable required sign-in storage, security logging, aggregate business activity counters, or signed-in presence.
Current choice: No choice yet. Google Analytics is off until you allow it.
Tabled uses HTTPS, access controls, scoped administration, and provider security features to protect information. The web service runs through CloudFront and application servers, with static assets stored in S3. Routine API application logs keep request time, method, an approved route shape, response status, latency, and request ID; they omit raw URLs, query values, dynamic path identifiers, IP addresses, and browser user-agent strings. CloudFront, hosting, identity, email, analytics, and anti-abuse providers can process or retain separate network and browser security data under their controls. Access and retention vary by system. No method of transmission or storage is completely secure.
We may update this notice as Tabled changes. The date above shows the latest revision; material changes may also be announced in the service.
Send privacy questions or requests to hello@usetabled.com. You can also use the contact form, which is protected by Cloudflare Turnstile and relayed to our inbox through Resend.