Privacy Policy

1. Introduction / Who We Are

GETBOOKINGS PTY LTD (“we”, “us”, “our”) operates Tablfy, a B2B SaaS platform available at tablfy.com and through associated applications. Tablfy is built for restaurant owners and managers to consolidate their marketing and booking data into a single dashboard, helping them understand the real ROI of their advertising spend against actual reservations.

This Privacy Policy explains what personal and business information we collect, how we use it, who we share it with, and what rights you have. It applies to all users of the Tablfy platform and any restaurant staff accounts created within it.

We are committed to handling all information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Questions? Contact us at admin@getbookings.io.

2. What Information We Collect

2.1 Account Information

• Full name
• Email address
• Password (stored as a hashed value; we never store plaintext passwords)
• Role within your organisation (owner, admin, manager, or staff)

2.2 Restaurant & Venue Data

• Venue name and location details
• Timezone settings
• Revenue configuration and cover settings
• Branding preferences

2.3 Booking Data

We collect and process booking data in two ways: when you connect your booking management software via email forwarding or direct integration, and when guests book directly through Tablfy-hosted booking pages, widgets, waitlists, or enquiry forms. This may include:

• Customer names, email addresses, and phone numbers
• Booking history, dates, party sizes, and statuses
• Any additional details a guest chooses to provide during booking, such as special requests, occasions, marketing preferences, or optional profile details requested by your venue

This data belongs to your restaurant; we process it on your behalf. We also retain booking data to enhance the guest experience across Tablfy-powered booking widgets, for example recognising returning guests and streamlining repeat bookings.

2.4 Financial & Sales Data

• Daily sales figures
• Payment method breakdowns (e.g. cash, card, split)
• Revenue per cover metrics

2.5 Google Analytics 4 (GA4) Data

When you connect your Google account via OAuth, we pull website sessions, traffic sources, conversion events, and geographic and device breakdowns from your GA4 property. We access only the GA4 properties you explicitly authorise.

2.6 Meta Ads Data

When you connect your Meta Business account via OAuth, we pull ad spend, impressions, clicks, ROAS, and conversion events linked to your Meta Pixel.

2.7 OAuth Tokens

We securely store OAuth tokens for your Google and Meta accounts to enable ongoing data synchronisation. These tokens are stored server-side and are never exposed to the browser.

2.8 Session Data

We use HTTP-only secure cookies to manage authenticated sessions. These cookies are not accessible to JavaScript and are used only for authentication purposes.

2.9 Technical & Attribution Data

When guests use Tablfy-hosted booking pages and enquiry forms, we automatically collect standard technical information, including IP address, device and browser details, and the marketing source that led to the visit (such as campaign and advertising parameters). We use this to attribute bookings and enquiries to the venue's marketing activity and to improve the booking experience.

3. How We Use Your Information

We do not use your data, or your customers' data, for our own advertising, profiling, or any purpose unrelated to operating the Tablfy platform for your business. Conversion reporting to advertising platforms happens only on your behalf, for your own venue's advertising, as described in Section 4.

4. Third-Party Integrations

4.1 Data Hosting

All Tablfy data is stored in a secure database hosted by an enterprise cloud provider based in the United States. All database tables are protected by Row-Level Security (RLS), ensuring each restaurant account can only access its own data. Our hosting provider does not use your data for its own purposes.

4.2 Google (GA4)

We integrate with Google's services using OAuth 2.0. You grant Tablfy access to specific Google resources during the authorisation flow. Our use of Google API data is subject to the Google API Services User Data Policy, including the Limited Use requirements. See Section 5.

4.3 Meta (Facebook Ads Manager)

We integrate with the Meta Marketing API using OAuth 2.0 to retrieve ad performance data from your Meta Business Manager account. We access only the ad accounts you explicitly authorise. See Section 6.

4.4 Meta Pixel & Conversion Measurement

Tablfy supports use of your restaurant's own Meta Pixel for tracking booking conversion events. The pixel is owned and controlled by you. We facilitate configuration and reporting of conversion data but do not operate a shared pixel or use pixel data across accounts. Where your venue has connected its own advertising account, Tablfy may also transmit booking and enquiry conversion events to that platform on your behalf so your venue can measure its advertising. Where these events include guest identifiers (such as email or phone number), they are hashed before transmission in accordance with the platform's requirements, alongside standard technical information such as IP address, browser details, and campaign parameters.

4.5 Reservation & Payment Platforms

Where your venue uses a Tablfy-hosted booking widget, guest booking details are transmitted to your venue's reservation platform to create and manage the booking, exactly as if the guest had booked with your venue directly. Where a booking requires a card pre-authorisation, card details are collected directly by a secure payment provider; Tablfy never receives or stores card numbers. Where your venue connects its payment provider for revenue reporting, we store aggregated transaction summaries only, not individual customer payment details.

5. Google API Limited Use Disclosure

• We only request access to Google user data that is necessary for Tablfy to function.
• We do not use Google user data to serve advertisements.
• We do not allow humans to read your Google user data unless you have explicitly given us permission, it is necessary for security purposes, or we are required to do so by law.
• We do not transfer or sell Google user data to third parties.
• We do not use Google user data to build or augment user profiles for purposes unrelated to Tablfy's core functionality.

6. Meta Ads Integration Disclosure

• We access only the ad accounts and campaigns you explicitly authorise during the OAuth flow.
• Meta Ads data is used solely to populate your Tablfy marketing dashboard.
• We do not share, sell, or transfer your Meta Ads data to any third party.
• We do not use Meta Ads data for our own advertising or marketing purposes.
• OAuth tokens for Meta are stored securely server-side and are never exposed to the client browser.
• You may revoke Tablfy's access to your Meta account at any time through Meta Business Manager settings, or by disconnecting the integration within Tablfy.

7. Data Storage & Security

• Row-Level Security (RLS):Every database table enforces RLS policies; one restaurant account cannot access another's data.
• HTTP-only secure cookies: Session tokens are stored in HTTP-only cookies inaccessible to JavaScript.
• Server-side OAuth token handling: OAuth tokens for Google and Meta are stored and used server-side only.
• HTTPS and HSTS: All communications are encrypted in transit using TLS with HTTP Strict Transport Security enforced.
• Hashed passwords: User passwords are never stored in plaintext.

If you believe your account has been compromised, contact us immediately at admin@getbookings.io.

8. Data Retention

To request account deletion, contact admin@getbookings.io. We will process it within 30 days.

9. Your Rights

9.1 Access

You have the right to request a copy of the personal information we hold about you. We will respond within 30 days.

9.2 Correction

Most account and restaurant data can be updated directly within Tablfy. For other corrections, contact admin@getbookings.io.

9.3 Deletion

You may request deletion of your personal information. We will process requests within 30 days, subject to legal retention obligations.

9.4 Withdrawal of Consent

Where we rely on your consent (e.g. Google or Meta OAuth access), you may withdraw it at any time by disconnecting the integration within Tablfy or revoking access via Google's or Meta's security settings.

9.5 Complaints

Contact us first at admin@getbookings.io so we can attempt to resolve the issue. If unsatisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

10. Australian Privacy Principles Compliance

GETBOOKINGS PTY LTD is committed to complying with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth):

• APP 1: This Privacy Policy sets out clearly how we manage personal information.
• APP 3: We only collect personal information that is reasonably necessary for operating Tablfy.
• APP 5: Users are informed of what data is collected and why at the point of collection.
• APP 6: We only use personal information for the primary purpose for which it was collected.
• APP 7: We do not use personal information for direct marketing without consent.
• APP 8: Where data is disclosed to overseas recipients, we take reasonable steps to ensure equivalent protection.
• APP 11: Technical and organisational measures protect personal information from misuse and unauthorised access.
• APP 12 & 13: Individuals may request access to and correction of their personal information (see Section 9).

11. Cross-Border Data Transfers

Tablfy stores data with a secure cloud hosting provider based in the United States. This means personal information may be transferred to and stored in the US. Our hosting provider maintains SOC 2 compliance and industry-standard data protection practices.

By using Tablfy and creating an account, you acknowledge that your data may be stored in the United States and consent to that transfer.

12. Cookies & Tracking

12.1 Session Cookies

Tablfy uses HTTP-only secure session cookies to manage authenticated user sessions. These cookies are set server-side, inaccessible to JavaScript, and used solely for authentication, not for advertising or tracking.

12.2 Meta Pixel

If you have configured a Meta Pixel on your restaurant's website, that pixel is your own, operating under your Meta Business Manager account. As the operator, your restaurant is responsible for appropriate disclosure to your website visitors.

12.3 No Third-Party Advertising Cookies

Tablfy does not use third-party advertising cookies on the Tablfy platform itself, and we do not share visitor data with advertising networks for our own purposes. Conversion events are shared with a venue's own connected advertising platforms only on that venue's behalf, as described in Section 4.4.

12.4 Persistent Visitor Identifier

Tablfy-hosted booking widgets and events enquiry forms set a first-party browser storage value named tablfy_visitor_id(a random UUID containing no personally identifiable information). This identifier lets us recognise returning visitors across sessions on the same device so we can attribute repeat enquiries and bookings to the original marketing source. Visitors can clear this value at any time by clearing their browser's site data, or avoid setting it altogether by using private/incognito browsing.

12.5 Session Replay

We use a privacy-focused product analytics provider to record anonymised session replays of how visitors interact with our booking widget and events enquiry form. These recordings help us identify usability issues and improve conversion for the restaurants we serve.

• All form input fields are masked by default. Recordings cannot capture passwords, contact details, payment information, or anything typed into a form field.
• Recording only starts after a visitor has shown intent (selected a guest count in the booking widget, or begun typing in the events form). Visitors who land on a page and leave without engaging are not recorded.
• Replays are linked to the anonymous tablfy_visitor_id only; no name, email, or phone number is sent to the provider.
• Recordings are retained for a limited period (typically 30 days) and then automatically deleted.
• Visitors can opt out by clearing their browser's site data, using private/incognito browsing, or enabling Do Not Track in supported browsers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and notify active users via email or an in-app notification. Your continued use of Tablfy after any changes constitutes acceptance of the updated policy.

14. Contact Us