Privacy policy

Last updated: 23 October 2026

tableapp.co is made by SMK Tech Labs (Pakistan). Restaurants use it for their table cards, menus, ordering, kitchen and staff screens, billing, deliveries and reports. This policy explains what information tableapp.co and the Tableapp Rider Android app collect, why, who can see it and how long it is kept.

Each restaurant decides how it uses tableapp.co for its own guests and staff. We store and protect that information for the restaurant and never use it for anything else.

What we collect

Guests at a restaurant table

• What you order, any notes, the table number and, if you type it, your name.
• Feedback you choose to send, with a name or contact detail only if you add one.
• Waiter and bill requests from your table.
• A random visitor number saved in your browser, so the restaurant can count visits without knowing who you are. Your cart is also kept in your browser.

Guests don't need an account or an app. We don't collect guests' location.

Delivery customers

When you order a delivery from a restaurant by phone or WhatsApp, its staff enter your mobile number, name(optional), address, landmark and, if you send one, a map location link. The restaurant keeps up to five of your recent addresses so your next order is quicker. Only that restaurant can see them.

Restaurant owners and staff

• Owners: email address and the restaurant's details.
• Staff: name, job (waiter, kitchen, manager or rider), a 4-digit PIN (stored only in scrambled form, so nobody can read it), sign-in times and the actions they take, such as accepting orders or marking bills paid.
• Riders: optionally a mobile number, so the restaurant can call them, plus the location described below.

Bills and tax

Bills record the items, amounts, tax and payment type. If a restaurant turns on FBR invoicing, its bills are sent to the Federal Board of Revenue as Pakistani law requires. Bills don't include guests' names or phone numbers.

Rider location (Tableapp Rider app)

The Tableapp Rider app collects the rider's location only while the rider is on duty, including when the app is closed or the screen is off. This lets the restaurant see where its deliveries are and tell customers when to expect them. Location is never collected while the rider is off duty.

• Who: only riders a restaurant has added as staff. Customers and other staff are never tracked.
• When: from the moment the rider taps Go on duty until they tap Go off duty or sign out. While sharing, Android shows a notification saying the app is using location.
• What: GPS position, accuracy, speed, direction and time, about every 15 to 30 seconds.
• Why: to show the restaurant where each delivery is, so it can give riders orders sensibly, help a lost rider, and settle delivery problems.
• Who can see it: only the owner and order staff (counter and managers) of the restaurant the rider works for. Kitchen staff and other riders can't. We never sell location data or use it for advertising.
• How long: the latest position is kept so the restaurant can see where the rider is now. The history of positions is deleted after 30 days.
• Control: riders can stop sharing at any time by going off duty, signing out, or turning off location permission in Android settings. Without location permission, the rider can still use the app to see and deliver orders, but the restaurant can't see where they are.

Riders also see their own orders in the app, including the customer's name, phone number and address, only until the order is delivered.

To alert riders about new orders even when the app is closed, the app saves a push token (a random code from Google that lets us send a notification to that phone). It contains no name or location, is used only for order alerts, and stops working when the app is uninstalled.

How we use it

• To run the restaurant's service: take orders, show them to the kitchen and staff, make bills, organise deliveries and show reports.
• To keep accounts secure, for example by locking sign-in after too many wrong PINs.
• To give support when a restaurant asks us for help.

We don't show ads, we don't sell personal information, and we don't use it to build profiles of people.

Who can see it

• The restaurant: its owner and staff, each limited to what their job needs. For example, the kitchen doesn't see delivery addresses, and a rider sees only their own orders. One restaurant can never see another restaurant's information.
• tableapp.co support: a small team at SMK Tech Labs, only to set up restaurants and fix problems.
• Service providers: our database and hosting providers (Supabase and Vercel) store and serve the information for us under their own security and privacy terms.
• Google Firebase Cloud Messaging: delivers order alerts to riders' phones. It receives the push token and the alert text (order number and area), never the customer's details.
• FBR: bill details, only when the restaurant turns on FBR invoicing.
• WhatsApp: daily summary reports are sent by the restaurant owner from their own phone. They contain totals only, never customer phone numbers.
• When the law requires it: if a valid legal request makes us.

How long we keep it

• Orders and bills: as long as the restaurant uses tableapp.co, because restaurants need them for their sales and tax records.
• Rider location history: 30 days.
• Delivery customers' saved details: until the restaurant removes them or the customer asks.
• Staff accounts: until the restaurant removes them. Names stay on past orders so records remain correct.
• When a restaurant leaves tableapp.co, it can ask us to delete its information.

Security

All connections are encrypted (HTTPS). Rules on our servers check every request, so each person can reach only what their job and restaurant allow, even if a screen is changed. PINs and passwords are stored only in scrambled form.

Your choices

• Guests and delivery customers can ask the restaurant, or us, to see or delete their details.
• Riders can go off duty, sign out, turn off location permission, or uninstall the app at any time.
• Anyone can email us to ask what we hold about them or to have it deleted, unless the law requires us to keep it (for example, tax records). See Delete your data below.

tableapp.co is not meant for children under 13, and we don't knowingly collect their information.

Delete your data (including the Tableapp Rider app)

Riders, restaurant staff, guests and delivery customers can ask us to delete their information. There is no account to create in the Tableapp Rider app (the restaurant adds its riders), so deletion is done by request:

1. Email smktechlabs@gmail.com with the subject Delete my data.
2. Tell us the restaurant's name, your name and the mobile number the restaurant has for you (or the phone number you ordered with).
3. We may reply to confirm it's really you. We answer within 7 days and finish the deletion within 30 days.

A restaurant owner can also ask for this on behalf of a rider or staff member, or remove them from the Staff page, which stops them signing in straight away.

What we delete

• Riders: name, mobile number, PIN, push token, the saved latest position and all location history.
• Staff: name, mobile number and PIN.
• Delivery customers: name, phone number and saved addresses, including on past orders.

What we keep

• Orders and bills, because the restaurant needs them for its sales and tax records. On these, a deleted person's name is replaced with "Deleted user" and their phone number and address are removed.

Uninstalling the Tableapp Rider app also removes everything it kept on the phone, such as the saved order list.

Changes to this policy

If we change this policy, we'll update it here and change the date at the top. Big changes will also be shown in the app or on the dashboard.

Contact us

SMK Tech Labs, Pakistan
Email: smktechlabs@gmail.com