1. What we collect
When you browse, the hosting infrastructure receives technical request information, including your IP address, requested page, time and browser information, to deliver and protect the website. If you accept them in the cookie banner, Google Analytics and Microsoft Clarity also collect how you use the pages (section 7).
When you submit a form, the fields sent are your email address, request type, language and page; restaurant enquiries also include the name, restaurant and covers you provide. For the launch list, we first send a confirmation link to the address you entered; the request only counts once you have opened it and confirmed your address with the button on our site (double opt-in), and we record the date of that confirmation. These requests are recorded in our form database (section 5). If you email us directly, we receive the information in your message. Please do not send card details, passwords or health information.
2. How we use it
We use contact details to answer your request. We send launch updates only to addresses whose owner has confirmed them, and only because they asked for them. You can stop these updates at any time, free of charge, by replying to any of our emails or writing to requests@tavoli.org; this is also how we meet the Swiss rules on unsolicited advertising (Unfair Competition Act, art. 3 para. 1 let. o).
Technical information protects the site and prevents spam and duplicate submissions. Where the GDPR applies, we rely on consent for launch emails and on our legitimate interests in answering enquiries and operating a secure website. With your consent, visit statistics and page-use data show us which pages help and what to simplify (section 7); you can withdraw it at any time.
3. Who receives it
The Tavoli team handles enquiries. Infomaniak Network SA hosts the website and its form database (the requests register) on a server in Switzerland, and Resend, Inc. delivers the emails sent from the forms; both act as our processors under a data processing agreement. Our mailbox requests@tavoli.org, which also holds the confirmed launch-list addresses, is hosted by Gandi SAS in France; mailbox providers of the people who write to us process their side of the correspondence. Once the Tavoli service launches, its data (guest profiles, preferences, restaurant and payment records) will also be hosted by Infomaniak Network SA in Switzerland.
Only if you accept them in the cookie banner: Google (Google Ireland Limited, Google LLC) receives visit statistics for Google Analytics and the technical data needed to deliver Google Tag Manager, and Microsoft (Microsoft Ireland Operations Limited, Microsoft Corporation) receives page-use data for Clarity, as providers of these tools.
This website does not share dining profiles with restaurants, sell personal information or send it to advertisers.
4. The payment demonstration
The interactive phone is a demonstration. Its tables, balances, points and payment actions are examples. It does not open a real account, reserve funds, charge a card or record a real restaurant visit. No real payment, allergy or dining-profile data is collected through it.
5. Retention
Enquiry emails are kept only as needed to answer and follow up your request. Launch contact details are kept for the updates you requested, until you unsubscribe. Any longer retention for a specific legal obligation or dispute is assessed separately.
The form database records each request sent: request type, language, page, email address and date; for restaurant enquiries, the name, restaurant and number of covers given; for the launch list, only confirmed addresses, with the confirmation date. It serves to answer and follow up requests and to send the launch updates you asked for; only the Tavoli team reads it, through a protected export. It also stores keyed technical fingerprints, attempt counts and delivery status, never plain IP addresses. A confirmation link is valid for 48 hours and its sealed content is readable only by our server. Housekeeping removes rate-limit rows older than 24 hours, delivery fingerprints older than seven days and requests older than 24 months; an unsubscription or a deletion request is handled before these deadlines, which do not guarantee deletion at the exact date.
Hosting and email providers may retain operational logs or backups under their service settings, typically for a few days to a few weeks.
6. Your rights
Under applicable data-protection law, you can ask to access or correct your data and request deletion. Where the legal conditions apply, you may also request portability or restriction, object to processing and withdraw consent for future use. Write to requests@tavoli.org; we may need proportionate information to verify your identity.
Access requests are normally answered within 30 days. You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC), or the relevant supervisory authority where the GDPR applies.
7. Cookies and local storage
Always active: your cookie choice is kept in your browser’s local storage for six months, after which we ask again. If a page fails to load after an update, a temporary browser session value prevents repeated reloads; it is removed once the page has loaded. Fonts and images are served with the site, and demo choices remain in the current page and are not sent as dining records.
Only if you accept them in the cookie banner, category by category: Analytics uses Google Analytics 4 to count visits, pages viewed, forms sent (never what you type in them), how visitors arrived, device type and approximate country and region, as well as Google Tag Manager to load Google’s measurement tags. Google Analytics sets the first-party cookies _ga and _ga_<ID> for up to 13 months; Google Tag Manager sets no cookie. Google signals and advertising features are switched off, Google Analytics does not store IP addresses, and the statistics are kept for 14 months.
Site improvement uses Microsoft Clarity to show how pages are scrolled and clicked, as heatmaps and session replays in which what you type is masked. It sets the cookies _clck (one year) and _clsk (one day), and Microsoft may set its own cookies on its domains; replays are kept for 30 days and heatmaps for up to 13 months.
Until you agree, none of these tools is loaded and nothing is sent to Google or Microsoft. You can change or withdraw your choice at any time with the “Cookie policy” link at the bottom of every page; withdrawing switches the tool off and deletes its cookies on this site. We use no advertising trackers or marketing cookies, and infrastructure providers may process technical information needed for delivery and security.
8. Contact
For privacy questions, data requests or withdrawal from launch updates, contact Tavoli SARL at requests@tavoli.org.
9. International processing
This website, its form database and, from launch, the data of the Tavoli service are hosted by Infomaniak Network SA in Switzerland. Our mailbox is hosted in France (European Union), which Switzerland recognises as providing adequate protection. The emails sent from the forms are delivered by Resend, Inc., which processes data in the United States; this transfer relies on the standard contractual clauses included in its data processing agreement, recognised by the Swiss Federal Data Protection and Information Commissioner. If you accept them, Google Analytics, Google Tag Manager and Microsoft Clarity data may also be processed in the United States by Google LLC and Microsoft Corporation. Both are certified under the Swiss-U.S. Data Privacy Framework, which Switzerland has recognised as providing adequate protection since 15 September 2024.
10. Current status and changes
If sending fails or is unavailable, the message shown means the request has not been confirmed as sent; please use requests@tavoli.org instead.
We will update this notice when the processing changes and show the new date here. A future account, restaurant or payment service will require its own information before collecting the corresponding data.