Chính sách bảo mật — Tablir

English version

Last updated: 2 October 2026 · Provided by CÔNG TY TNHH IR TECH ("we").

1. Data we collect

2. Device permissions & why

• Location — to verify a staff member is at the store when clocking in (Staff app); to set the store location used for delivery pricing (Owner app). Read only when you act, never as continuous background tracking.
• Camera & Photos — to take or choose dish and store images; in the Staff app the camera is also used to scan an invitation code to join a store.
• Notifications — new and overdue orders, leave, attendance approval results, rejected shifts, payslips, reviews, request tickets, support-team replies, plan renewal reminders.
• “On shift” foreground service (Staff app, Android only) — keeps a notification showing your elapsed shift time while you are clocked in, even if the app is swiped away. It runs only for as long as you are on shift.

3. Data sharing

We do not sell personal data. Data is processed by these infrastructure providers in order to run the service:

• Google Firebase (auth, photo storage, push notifications) — see Google’s policy.
• Google (Sign in with Google) — only if you choose Continue with Google to sign up or sign in. Google verifies your identity and returns an identifier and your email address, which we send to our own servers to create your account or open a session. Our servers store your Google account identifier, linked to your Tablir account, to recognise you the next time you sign in; that link is deleted together with your Tablir account (section 4). On the web versions of the two apps, however, the Google button is drawn by Google itself (Google Identity Services), so your browser contacts Google as soon as the sign-in screen or the sign-up screen opens, even if you do not choose Google; your email and identifier are still handed over only when you choose Continue with Google. We send Google no store, HR or order data this way — see Google’s privacy policy.
• Apple — only if you choose Continue with Apple to sign up or sign in. Apple verifies your identity and returns an identifier and email address, or a private relay address if you hide yours. As with Google, our servers store your Apple account identifier, linked to your Tablir account, for later sign-ins, and that link is deleted together with your Tablir account. If you choose Hide My Email, the system receives only the hidden address Apple issues, not your real email — the app will warn you that you may be unable to recover your account, and let you enter an email address (optional); if you do, you must verify it with a code sent to that address, and it then becomes your sign-in email. We send Apple no store, HR or order data — see Apple’s privacy policy.
• Our own servers — they hold store, HR and order data.
• Weather service (Open-Meteo) — we send it the coordinates the owner saved as the store’s location to price bad-weather delivery surcharges. The owner sets those coordinates in settings — typed in, or filled from their device’s current location via a Use current location button. We never send this service a staff member’s location or a customer’s address.
• PayOS (payment gateway, a Vietnamese company) — used when a store enables bank-transfer/QR payment for its customers’ orders. We send PayOS four things: the order number, the amount, a bank-transfer memo (the order number plus the store’s name — no list of items and no table number) and two return addresses (one for payment completed, one for cancelled); we send no customer name, phone number or email. When a customer proceeds to pay they are handed over to PayOS’s own page, so the banking steps happen on PayOS’s infrastructure, not ours. Once the customer has paid, PayOS sends back a transaction notice to our servers, and we store that notice as received for reconciliation. It may include the order number, the amount, the store’s receiving account and — if the payer’s bank provides them — the sender’s name, account number and bank. This record is not deleted with the store; there is currently no automatic deletion for it.
• Zalo (VNG) — when a guest scans the QR code on a table, the menu opens inside the Zalo app as a mini app. That means Zalo knows who opens which store’s menu, and when. To prepare for sending the guest order-status updates through Zalo — a feature that is not active yet; today our servers send nothing to Zalo — the app calls Zalo’s user-info function: once the guest consents, Zalo returns an identifier together with a name and profile picture — but the app keeps only the identifier and sends it to our servers with each order; our servers store it with the order and the ordering session. The name and profile picture are not stored, are never sent to our servers, and are not used for anything.
• Our own mail server — sends: email-verification codes at sign-up, password-reset codes, the verification code required to delete a store, admin and affiliate invitations, an email letting a staff member set their own password when the owner creates their account, plan renewal reminders, a notice when your login email is changed (sent to the old address), a notice when a store is scheduled for deletion, and affiliate payout statements (a copy may also go to our accounting address). Our email never contains your password — only a one-time code, or a link for you to set one yourself.

Within a store, HR data is visible only to authorized owner/manager/HR; employees see only their own data and assigned work.

4. Retention & deletion

Where data is stored

Our primary server and database — which hold store, HR and order data — are operated by an infrastructure provider in Vietnam.

Backups. Database backups are created automatically every day and written to that same server’s disk; we keep the 10 most recent. No copy is currently pushed outside the server. So data deleted from the live system remains in these backups for up to about 10 days, after which it is overwritten.

⚠️ But not all data stays inside Vietnam. The services listed in section 3 are foreign services — Google (photos, push notifications, sign-in), Apple (sign-in), Open-Meteo (weather) — so the data sent to them is processed outside Vietnam. PayOS and Zalo are Vietnamese companies. We deliberately do not repeat that list here: section 3 is the one in force, and two copies of a list will drift apart.

How long we keep it, and how deletion works

Data is kept while the account and store are active. You can ask for deletion at any time — the exact steps, including if you have already uninstalled the app, are on the Delete your account & data page.

5. Security

Connections use HTTPS/WSS. Passwords are hashed (bcrypt) and never stored in plain text. Access is controlled by function-level permissions.

6. Children

Tablir is a business operations tool. It is not intended for anyone under 16 and we do not knowingly collect children’s data.

7. Your rights

You may access, correct or request deletion of your personal data.

To delete your account and data, follow Delete your account & data. That page separates three different things: an owner deleting a store; an employee asking to end their job at a store, for the owner to approve; and deleting your own Tablir account outright — the last needs nobody’s approval and cannot be undone. That page also has an email route for anyone who has already uninstalled the app or cannot sign in — and for owners who want to delete their Tablir account, since the Owner app has no button for that yet (the Staff app does: My profile → Delete your Tablir account).

8. Contact

Provided by: CÔNG TY TNHH IR TECH
Email: contact.irteam@irtech.vn · Phone: +84 968 534 201
Address: 93 To Hien Thanh Street, Hai Ninh Ward, Ha Tinh Province, Vietnam