Privacy Policy

Last updated: 24 October 2026

Tawlify lets guests order from their table at cafés and restaurants, and lets those venues run their orders. This policy explains what personal data we handle, why, and what you can do about it. It follows the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) and applies wherever you use Tawlify.

Who we are

Tawlify is run by AleyLabs, Aley, Lebanon (“we”). We are the controller ofTawlify accounts, this website and our sales contacts. For the orders, tables and staff accounts of a venue, the venue is the controller and we process that data on its behalf as its operator.

Our data protection officer (encarregado) can be reached at hello@tawlify.com for any question or request about your data.

What we collect and why

• Guest account: your email or phone number and the name staff call you by. Used to sign you in with a one-time code and to show staff who an order is for. Legal basis: performance of a contract (art. 7 V).
• Orders: the venue, table, items, notes, totals, payment status and when each change happened. Used to prepare and serve your order, shown in your order history, and counted toward the stamp card at venues that run a loyalty program. Legal basis: performance of a contract (art. 7 V); the venue keeps its sales records to meet its legal obligations (art. 7 II).
• Ratings and requests: the stars and optional comment you give a completed order, and what you ask staff for from your table (waiter, bill, water, cleaning, your car) with when it was answered. Shown to the venue to improve its service; a low rating's comment is emailed to the venue owner. We don't post your rating anywhere: if you choose to review the venue on Google, that happens on Google under its own terms. Legal basis: the venue's legitimate interest in its service quality (art. 7 IX).
• Venue staff: work email, a password hash and their role. Used to sign in to the order board and to record who changed an order. The venue owner's email also gets our welcome, invoice, receipt and billing reminder emails, and we keep notes of our calls with them. Legal basis: performance of a contract with the venue (art. 7 V).
• Pilot and call requests: name, business, city, email, WhatsApp number and notes you send us from the website or when booking a call. Used to contact you about Tawlify. Legal basis: preliminary procedures for a contract you asked about (art. 7 V).
• Support chat: your name, email and the messages you send with “Chat with us” on our website or venue admin, plus the page you started on. Used to answer you, by chat or by email if you've left. Legal basis: preliminary procedures for a contract you asked about, or our contract with the venue (art. 7 V).
• Security data: your IP address and failed sign-in or code attempts, kept briefly in memory to stop abuse. Legal basis: legitimate interest in keeping the service secure (art. 7 IX).
• Usage analytics, only if you accept them: pages visited (without the link's secret parameters), device and browser type, rough location and actions such as placing an order. We never send your name, contact or order notes to analytics. Legal basis: your consent (art. 7 I).

We don't sell personal data, and we don't use it for advertising.

Cookies

• Necessary (always on): signed cookies that keep you signed in to your account (90 days), at your table (3 hours) or on the staff screens (12 hours), and two that keep your support chat (90 days, only once you write to us; your browser also remembers the last reply you read). Tawlify can't work without them.
• Analytics (only with consent): Google Analytics cookies (_ga, _ga_*), kept up to 2 years. Google signals and ad personalisation are turned off.

You can accept or reject analytics in the banner, and change your mind any time with “Cookie settings” at the bottom of our website. Rejecting deletes the analytics cookies.

Who we share it with

• The venue you order from sees your name and that order. Venues don't see your contact details or your orders at other venues.
• Service providers who process data for us under contract: Fly.io (hosting and database), Tigris (menu photos), Resend (our emails, including sign-in codes), Meta (sign-in codes on WhatsApp), Telegram (where our team reads and answers support chats), Google (Analytics, only with consent), Cal.com (booking calls), Stripe (venues paying their Tawlify subscription by card; card details go to Stripe, never to us) and OpenAI (reading the PDF menus venues choose to import, and answering questions guests type into “Ask about the menu”, sent with the venue's menu but without your name or contact).
• Public authorities, only when the law requires it.

International transfers

Our servers are in the European Union (Frankfurt), and some providers, such as Google, process data in the United States and other countries. We only use providers that offer the safeguards LGPD art. 33 requires, such as standard contractual clauses.

How long we keep it

• Guest accounts: until you delete them. A deleted account can be restored by signing in within 30 days; after that your contact, name and rating comments are erased, and past orders stay with the venue as anonymous sales records (with their star ratings).
• Sign-in codes: 10 minutes. Security counters: minutes, in memory only.
• Venue and staff data: while the venue uses Tawlify, then as the venue instructs.
• Pilot and call requests, and support chats: up to 2 years after our last contact, or sooner if you ask.
• Analytics: 14 months in Google Analytics.

Your rights

Under LGPD art. 18 you can, free of charge:

• confirm whether we process your data and get a copy of it;
• correct incomplete, inaccurate or outdated data;
• have unnecessary or excessive data anonymised, blocked or deleted;
• take your data to another service (portability);
• delete data processed with your consent, and withdraw that consent;
• know who we share your data with, and what happens if you don't consent;
• object to processing that doesn't follow the law.

Guests can do most of this themselves on your profile: change your name, download your data, or delete your account. For anything else, email hello@tawlify.com and we'll reply within 15 days. Requests about a venue's orders or staff accounts go to that venue, and we'll help it answer. You can also complain to Brazil's data protection authority (ANPD) at gov.br/anpd.

Security

Connections are encrypted (HTTPS), sessions are signed cookies, passwords are hashed, sign-in codes are stored only as hashes, and every venue sees only its own data. If a breach could put you at risk, we'll tell you and the ANPD.

Children

Tawlify accounts are for people 18 or older. Children can order with an adult at the table.

Changes

We'll update the date above when this policy changes, and tell signed-in guests and venues about important changes before they apply.