Privacy policy

About this policy

Tabletop ("the app") is a Shopify app for restaurants and cafés, published by Thrivepine ("we", "us"). This policy explains what information the app collects when a merchant installs it, how we use it, and the choices merchants and their customers have.

Merchants decide how they use the app with their customers. For their customers' information, the merchant is the controller (the business responsible for it) and we process it on the merchant's behalf, under the merchant's instructions and the data processing terms we agree with them.

Information we collect from merchants

• Store details from Shopify: store domain, store name, currency, time zone and the store's locations and their addresses.
• Menu details from Shopify: products, variants, prices and collections, read when the menu is built. The app also creates one hidden product for paid options.
• Settings the merchant chooses in the app: features switched on, stations, printers, screens, floor plans, QR codes and the like.
• Staff details from Shopify POS: the staff member's Shopify ID and name, recorded with actions such as voids and transfers for the activity log.
• Access tokens Shopify issues to the app. They are encrypted at rest.
• Billing is handled by Shopify. We see the plan and subscription status, never card details.

Information about merchants' customers

The app keeps only what a kitchen and dining room need to serve an order:

• A guest name, seat names and order notes entered by staff or by the guest, to show on tickets, screens and pickup boards.
• A phone number, only when a guest gives one to be texted for that order or that waitlist visit. Phone numbers are encrypted at rest.
• Shopify order and customer IDs, to match paid orders to kitchen tickets.
• Table bookings, when the merchant uses the app's reservations: the guest's name, email address, an optional phone number and note, the party size and time. Email addresses and phone numbers are encrypted at rest. The guest's booking page opens only with a random link given to the guest. If the merchant asks for a deposit, the guest's email goes to Shopify, which sends the invoice; the paid deposit is an order in the merchant's Shopify store.
• For curbside pickup, the car details the guest types (such as make, color or plate) and when they tapped "I'm here".
• Built-in loyalty, when the merchant uses it: the guest's Shopify customer ID with a points balance and the history of points earned and redeemed. No other details are kept for loyalty.
• Staff time clock entries (clock-in and clock-out times, breaks, job and declared cash tips) and tip distributions, for the merchant's payroll. These are about the merchant's staff, not guests.
• Items, quantities, prices and times of each order.
• Guests who order with a QR code don't create an account. The guest page sets no cookies and uses no tracking or advertising technology; it remembers a large-text preference on the guest's own device only.
• Orders, payments, addresses and customer profiles are held by Shopify, not by the app.

Information collected automatically

• Paired screens and printers report their name, status and when they last connected.
• To prevent abuse of public pages (screen pairing, QR ordering, pay links, table bookings), we count requests per IP address or QR code. Addresses are stored only as keyed one-way hashes and deleted within 24 hours.
• Request logs record the page and status but not query strings or the secret parts of printer and QR addresses.
• Our hosting provider keeps standard server logs (IP address, time, page requested) for security. We keep personal details out of application logs.

How we use information

• To provide the app: open checks, kitchen tickets, kitchen screens, QR and online ordering, the waitlist and reports.
• To send the texts a guest asked for, such as "your order is ready". The app doesn't send marketing texts.
• To take table bookings, show them to the merchant's staff, and let the guest see or cancel their booking.
• To keep the app secure, prevent abuse and fix problems.
• To answer support requests from merchants.
• We don't sell personal information, share it for cross-context behavioral advertising, or use it to make decisions with legal or similarly significant effects on anyone.

Who we share information with

• Shopify, which runs the store, POS and checkout the app works with.
• Our service providers, under contracts that limit their use of the information to running the app: cloud hosting and database, and the text message provider when a merchant turns on guest texts.
• Authorities, when the law requires it.
• A buyer or successor, if the app or our business is sold, under this policy.

How long we keep information

• Guest names, phone numbers and order notes: removed from finished orders after 30 days by default. Merchants can choose 7 days to 1 year. Orders left open or unpaid lose them a week after that period, counted from when they were opened.
• Waitlist phone numbers: removed 24 hours after the party is added.
• Curbside car details: removed with the guest's other details on the order.
• Loyalty points: kept while the merchant uses built-in loyalty, so guests keep their points; deleted when the customer asks Shopify to erase their data, or when the store's data is deleted.
• Table bookings: the guest's name, email, phone number and note are removed after the same guest-details period, counted from the booking time. The booking without them (party size, time, table) is deleted with order history.
• Order history without guest details: kept 13 months by default for the merchant's reports. Merchants can choose 90 days to 3 years.
• Printed tickets: 7 days. Activity log: at least 13 months.
• Customer data exports made for a privacy request: 30 days. After an erasure request, our record of it keeps only a one-way reference, not the customer's ID.
• When a merchant uninstalls the app, Shopify asks us to delete the store's data 48 hours later, and we delete all of it. If that request never arrives, we delete the data 30 days after uninstall.

Security

Information travels over encrypted connections (TLS). It is stored in a database encrypted at rest, with phone numbers and access tokens also encrypted individually. Access to production systems is limited to staff who need it, protected by strong authentication, and logged. Printers and screens connect with long random secrets that the merchant can revoke at any time. We have an incident response plan and will notify affected merchants, and Shopify, of a breach as the law and Shopify's terms require.

Your choices and rights

• Customers of a store: contact the store to see, correct or delete your information. When a store passes on a request through Shopify, the app removes or exports your information automatically.
• Merchants: you can see what the app keeps under Privacy in the app, change how long it's kept, and uninstall the app at any time to have your data deleted. Contact us for anything else.
• Depending on where you live (for example California and other US states, the EU, the UK and Canada), you may have rights to know, access, correct, delete or port your information, and to opt out of sale or targeted advertising, which the app doesn't do. We won't treat you differently for using these rights. You can use an authorized agent; we may need to verify the request.

International transfers

The app is hosted in the United States. When information about people in other countries is processed there, we rely on appropriate safeguards such as Standard Contractual Clauses.

Children

The app is a business tool and isn't directed at children under 13. We don't knowingly collect children's information beyond what a store enters to serve an order.

Changes to this policy

We'll post any changes here with a new effective date, and tell merchants in the app about significant changes.

Contact

Thrivepine, Medford, MA 02155, United States. Email: info@thrivepine.com.