Privacy Policy

Last updated: October 19, 2026

This policy explains what Tabbi, Inc. ("Tabbi," "we," "us") collects, why, who sees it, and what you can do about it. It covers the Tabbi app, our web tab flow at pay.tabbi.app, our venue tools at dashboard.tabbi.app and Text Tabbi, and our website at tabbi.app.

The short version

We don't sell your personal information, and we don't run ads. No ad networks in the app, no advertising ID, no cross-app tracking.
Your card number never touches our servers. A card vault holds it. We keep a token, the card brand, the last 4 digits and the expiry.
Venues see what they need to serve you, once you've opened a tab or checked in there: your name, photo, birthday (month and day only), your history with them, and general taste categories, which you can turn off. They see your dietary needs only if you turn sharing on. Section 5 lists all of it.
We use your location while the app is open to show what's nearby and to confirm you're at a venue when you open a tab. We save it on our servers. We never sell it.
You control what other users see in Privacy Settings.
You can delete your account in the app and ask for a copy of your data by email.

1. Who this covers

In short: guests, venue teams, and website visitors.

Guests use the Tabbi app or pay.tabbi.app to find spots, open and pay tabs, earn perks, and connect with friends.
Venue teams are owners, managers and staff who use dashboard.tabbi.app or Text Tabbi. See section 3.
Website visitors browse tabbi.app or fill out a form there. See section 16.

2. What we collect from guests

In short: what you give us, what your phone shares with your permission, and what we learn from how you use Tabbi.

What you give us

Account: mobile phone number (you sign in with a texted code), email, first and last name, and date of birth.
Profile (optional): photos, bio, city and state, school, work, and relationship status.
Dietary needs (optional): allergies and dietary restrictions, including medical or religious ones. Venues see these only if you turn on sharing. See sections 5 and 13.
Payment card: number, expiry, security code, name and billing ZIP.
Messages: 1:1 and group chats with other users.
Support: issue reports and reports about other users.

Cards. You enter your card into fields run by our card vault. We never receive or store your full card number or security code. We keep a token, the card brand, the last 4 digits, the expiry, and a card fingerprint used to prevent fraud. When you save a card, we run a $0 check with your security code and ZIP to confirm it works.

What your phone shares, with your permission

Precise location, only while the app is open. We use it to show nearby spots, send you promotions from nearby venues, suggest people you may know, and confirm you're near a venue before you open a tab or check in. We save your latest location on our servers and update it as you move. We don't ask for "Always" location access.
Arrival reminders. If you allow notifications and location, your phone can remind you when you arrive at a nearby venue, even when the app is closed. Your phone does this with Apple's tools. To avoid reminding you at home, the app works out your home area on your phone. That never leaves your phone.
Contacts. If you allow it, the app reads the phone numbers in your address book, but not names or emails, and sends them to us. We convert each number into a scrambled code (a salted hash) and keep only that code. We use it to show which of your contacts are on Tabbi. This means we process the numbers of people who don't use Tabbi. We don't store the numbers in readable form.
Camera and photos, only to add profile photos. Card scanning uses Apple's on-device scanner, and we don't receive the image.
Calendar, only to add an event you choose. We can't read your calendar.
Notifications, for the alerts in section 4.

You can turn any of these off in your phone's settings. Some features won't work without them. For example, you can't open a tab in the app without location.

What we collect automatically

Tabs and orders: the venue, items, prices, tax, tip, discounts, our fee, timestamps, and the order record from the venue's Toast system.
Activity: friends, blocks, check-ins, favorites, events you mark Going or Saved, and perks earned and used.
Device and usage: push notification tokens, screens viewed, taps and app events, crash and error reports, and your IP address.

We don't use an advertising ID, App Tracking Transparency, or session recording.

What we work out from your activity

Visit stats for each venue: visits, spend, average tab, average tip, top items, and first and last visit.
Taste tags: an AI model reads your order history and assigns general categories, like "craft beer" or "brunch." Venues can see these categories unless you turn taste sharing off (section 5). Health-related categories, such as gluten-free, non-alcoholic or sober, are never shown to venues.

3. What we collect from venue teams

In short: business details, your team login, and what you tell Text Tabbi.

Venue details: name, address, public phone and email, website, menu and reservation links, hours, photos, logo, description and review link. We may pre-fill some of these from public web sources, including the venue's own website.
Team members: name, mobile number, email and role (owner, manager or member). You sign in with a texted code. When you invite someone, we text the number you enter.
Social accounts: if you link Facebook, Instagram or Google Business Profile, we connect through a social posting provider to post for you. Post stats can include the names of people who liked a post.
Text Tabbi: your number, the conversation, and files you send. An AI model reads photos and PDFs once and doesn't keep them. We save notes and preferences about your venue so the assistant gets better. In group texts, other participants' numbers reach us.
Point of sale: we don't receive or store your Toast login. You turn on the Tabbi integration inside Toast.
Money: we don't collect your bank or payout details. Tab payments settle to the venue through Toast.

4. How we use information

In short: to run tabs, power the app, keep people safe, and improve Tabbi. Not to advertise.

Open, track and close tabs. Charge our tab fee and your tip, and email receipts.
Confirm you're near a venue to open a tab or check in.
Show nearby venues, specials and events.
Send notifications: tab updates and auto-close warnings, arrival reminders, new venues nearby, and promotions from nearby venues. You can turn these off on your phone.
Run perks, including welcome, visit and birthday perks.
Run social features: friends, People You May Know (based on your approximate location and contacts), check-ins and chat.
Give venues the guest information in section 5.
Run Text Tabbi and venue content tools (section 7).
Prevent fraud and abuse: bans, blocked cards, decline limits, and reviewing reports.
Fix bugs and understand which features get used.
Follow the law and enforce our Terms of Use.

5. What venues see about you

In short: venues get a guest profile so they can recognize and serve you. You control your birthday, dietary sharing and taste sharing.

A venue can see your guest profile only after you've had a tab there (open or past) or while you're checked in there. Favoriting a venue doesn't open your profile to it. The profile includes:

your name, photo, bio and city
your birthday, month and day only, never the year or your age. Hidden if you set your birthday to Private
your history at that venue: visits, first and last visit, spend, tips, items ordered, top items and past tabs
general taste categories based on what you order across Tabbi (categories only, never item names, other venues' names, or health-related categories), unless you turn taste sharing off
your allergies and dietary needs, only if you turn on "Share dietary needs with venues"
whether you're checked in right now, and whether you've favorited the venue

Venues can also see who is on their open tabs (name and photo), who is checked in, who has favorited them, and who has marked their events Going or Saved.

Toast. When you open a tab, we write your name, phone number and email onto the venue's check in Toast, labeled "Last, First - Tabbi." Once there, that record is held by the venue and Toast under their own privacy practices.

Text Tabbi. Venue owners and managers can get the same guest information by text that they see in their dashboard, for example "a regular just arrived." Other staff can't. We never send your phone number or email through Text Tabbi.

Bans. Tabbi can ban an account. A venue can ask us to ban a guest, and we review each request. A Tabbi-wide ban disables sign-in and blocks the card used.

You can turn dietary sharing on or off in Settings, and taste sharing off in Privacy Settings, at any time. With taste sharing off, a venue sees only your history at that venue.

6. What other users see

In short: you choose, in Privacy Settings.

Most visibility settings start on. You can change:

profile visibility (Friends or Public)
check-in visibility (Friends or Private)
whether you appear in search and in People You May Know
whether opening a tab checks you in automatically
whether friends see events you're Going to or Saved, and your new favorites
who sees your birthday: Everyone, Friends & Venues (the default), Only Venues, or Private
which details non-friends see: last name, bio, city, school, work, relationship status, favorites and mutual friends

Also:

Friends see your full profile and get a notification when you check in.
Photos: people who aren't your friends don't see your photos in the app.
Contact matching: people who have your phone number may see that you joined Tabbi, even if you turn off "Appear in search."
Blocking someone hides you from each other, including in chat.
Chat: messages from non-friends go to a separate requests inbox. Our chat provider stores messages. We may review messages when someone reports them, or to enforce our Terms.

7. How we use AI

In short: AI helps venues run their listings. No AI feature talks to guests.

AI providers run Text Tabbi and the venue web chat, write venue descriptions and promo copy, create promotional images from a venue's logo, photos and brand style, create guest taste tags from order history, and help fill in venue details.
Guest data reaches AI only through venue tools: taste tags, and guest lookups by owners and managers in Text Tabbi. Your phone number and email are never sent to these tools.

8. Who else receives data

In short: companies that help us run Tabbi, under contracts that limit what they can do with your data.

Hosting and infrastructure: our database, file storage, sign-in, email and texts. Receives everything we store.
Toast: the venue's point of sale, where tabs open and get paid. Receives your name, phone, email, card (through our vault), items and tip.
Card vault and payment processors: store your card and process our tab fee, the opening hold, and card checks. Receive your card details, ZIP and the amount.
Chat and push notification providers: receive your user ID, display name, photo, messages, push token and notification text.
Analytics and error reporting: receive your user ID, screens, taps, events, and technical details about errors.
Maps and address lookup: receive map and location requests.
AI providers: see section 7.
Messaging for Text Tabbi: receives venue team numbers and messages, and guest names in alerts.
Social posting providers and platforms: receive captions, images and linked venue accounts.
Web research providers: receive venue names and websites.
Website hosting and analytics: receive what you submit in website forms, and pages viewed, the referring site and your browser type.

We also share information when the law requires it, to protect people's safety or our rights, or as part of a merger, acquisition or sale of assets. If that happens, the new owner must honor this policy or tell you before changing it.

9. What we don't do

We don't sell personal information, and we don't share it for targeted advertising.
We don't sell precise location data to anyone.
We don't run ads in the app.
We don't make automated decisions that have legal or similarly significant effects on you.

10. How long we keep data

Account and profile: until you delete your account.
Records of past tabs and payments, bans, and safety reports: kept after account deletion, as long as needed for tax, accounting, chargebacks, fraud prevention and enforcing bans.
Notifications, check-ins, Text Tabbi conversations and AI drafts: deleted or expired automatically after a limited time. Opt-outs are kept, so we keep honoring them.
Venue notes: until the venue leaves Tabbi.
Database backups: kept for a limited time.

11. Deleting your account

You can delete your account in Account Settings. When you do, we:

delete your sign-in and your profile details: name, email, phone, birthday, bio, photos, location, preferences and allergies
remove your saved cards from our card vault
delete your friends, close friends, blocks, favorites, check-ins, event activity and notifications
delete your chat account, the contact codes you uploaded, and all push notification tokens
remove you from any venue teams and cancel pending invites

We keep only the records listed in section 10. Venues keep your past tabs in their sales records, but can no longer see your profile.

12. Your rights

In short: every user gets these rights, wherever you live.

Know and access what we have about you, and get a copy.
Correct anything that's wrong. Most of it you can fix in the app.
Delete your data, in the app or by email.
Withdraw permission for location, contacts or notifications in your phone's settings. Turn off dietary sharing in Settings and taste sharing in Privacy Settings.
Fair treatment. We won't treat you differently for using these rights.

How to ask. Email contact@tabbi.app from the email on your account, or include the phone number on your account. We'll confirm it's you, then respond within 45 days. You can use an authorized agent with your signed permission.

13. Sensitive data and consumer health data

In short: we treat precise location and dietary needs as sensitive, and use them only with your permission.

Precise location is collected only after you allow it, and only while the app is open.
Dietary needs are optional. Sharing with venues is off until you agree on a consent screen, and we record when you agreed. You can turn sharing off or delete them at any time in Settings.

Consumer Health Data Notice (Washington, Nevada and similar laws)

What we collect: allergies and dietary restrictions you add, including medical or religious ones, and health-related taste categories, such as gluten-free, non-alcoholic or sober, created from your orders.
Why: so venues know about your dietary needs when they serve you, if you choose to share, and to run taste tags.
Where it comes from: you and your order history.
Who receives it: venues where you have or had a tab or are checked in, for dietary needs and only if you turn sharing on. Health-related taste categories are never shown to venues. Our hosting provider stores this data, and our AI provider creates taste categories.
Your rights: see it, get a list of who received it, delete it, and withdraw consent by turning sharing off in Settings or emailing contact@tabbi.app.
We never sell health data or use it for anything else.

14. Security

We protect data with encryption in transit and at rest, limited staff access, and by keeping card numbers out of our systems. No system is perfect. If a breach affects you, we'll notify you as the law requires.

15. Age

Tabbi is for people 18 and older. You give your birthday and confirm you're 18 or older when you sign up. We don't knowingly collect data from anyone under 18. If we learn we have, we'll close the account and delete the data. Tell us at contact@tabbi.app if you think someone under 18 has an account.

16. Our website

When you fill out a form on tabbi.app, such as Contact, Request a Demo, Recommend a Venue or Become an Ambassador, we collect what you submit, like your name, email, phone and message, and use it to respond.

Our website and web tools use cookies and similar technologies so they work and so we can understand how they're used. You can block cookies in your browser, though some features may not work. We don't respond to browser "Do Not Track" signals, and we don't let other companies track you across other sites through ours.

17. Texts and email

We text sign-in codes and order updates, and email receipts. We don't send guests marketing email or texts. If we ever do, we'll ask first and give you an easy way to stop.

Text Tabbi sends alerts, recaps and tips only to venue team members who texted it first. Reply STOP to stop them, or HELP for help. Message and data rates may apply.

18. Changes

We'll post any changes here with a new date. For material changes, we'll tell you in the app or by email before they take effect.

19. Contact

Tabbi, Inc.

25 Draper Street, Unit 423

Greenville, SC 29611

contact@tabbi.app