Privacy

This English translation is provided for convenience only. Only the German version is legally binding.

Last updated: October 2026

1. Controller

2. Overview

Tischlink provides businesses such as restaurants, cafés, salons or studios with a guest page that guests open via an NFC table sign or a link. We only process personal data to the extent necessary to operate this website, the management portal and the guest pages. We do not use advertising or analytics cookies, do not use any tracking services and load fonts from our own server.

3. Hosting and server logs

Website, portal and guest pages run on the infrastructure of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), including the database (Cloudflare D1) and file storage (Cloudflare R2). When a page is accessed, Cloudflare processes technically necessary data such as IP address, time, requested address, browser identifier and referrer in order to deliver the page and protect it against attacks.

The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR). A data processing agreement is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses also apply.

4. This website (tischlink.com)

The home page does not set any cookies and does not store anything in your browser. If you write to us by email, we process your details in order to answer your request (Art. 6 (1) (b) GDPR for contract enquiries, otherwise (f)). We delete the correspondence as soon as it is no longer needed and no statutory retention obligations apply.

Enquiry form

Using the enquiry form on the home page, you can send us your phone number, your email address and your name and, optionally, your industry, the number of tables and a message in three steps. So that your enquiry is not lost, we save each step in our database (Cloudflare D1) as soon as you tap “Next” – even if you do not complete the form afterwards. We use this information to answer your enquiry, make you an offer and contact you once about an unfinished enquiry (Art. 6 (1) (b) GDPR).

In the first step, you expressly consent to us contacting you about your enquiry by phone and WhatsApp (Art. 6 (1) (a) GDPR, § 7 (2) UWG). We store the wording and time of this consent as proof. You can withdraw your consent at any time with effect for the future, for example by email to info@tischlink.com or with a short reply via WhatsApp. For messages via WhatsApp, the privacy notice of WhatsApp (Meta Platforms Ireland Ltd.) also applies.

We also forward completed enquiries as an email to our inbox; for sending, we use the service Resend (Resend, Inc., USA) as a processor. We automatically delete stored enquiries after 180 days at the latest, earlier if you wish or withdraw your consent; if a contract results, the statutory retention obligations apply. To protect against misuse, we count enquiries per internet connection for one hour; only an irreversible hash of the IP address is held briefly in the cache, not the IP address itself (Art. 6 (1) (f) GDPR).

5. Management portal for restaurants

User account

For the portal, we store the email address, an encrypted password (only as a hash, never in plain text) and the role of the account. To log in, we set a technically necessary cookie (“sid”) that keeps you logged in for 30 days and is deleted when you log out. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR); for the cookie § 25 (2) No. 2 TDDDG.

Payment processing

Customers pay for subscriptions and setup via the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe processes name, company name, email and billing address as well as payment data (IBAN or card details) in order to process payments, manage direct debit mandates and prevent fraud. Tischlink only receives the payment data in shortened form (e.g. the last four digits). The legal basis is Art. 6 (1) (b) GDPR; we retain invoices for the statutory periods (Art. 6 (1) (c) GDPR). Stripe may also transfer data to the USA; the basis for this is the EU-US Data Privacy Framework and standard contractual clauses. More in the privacy policy of Stripe.

Emails

We send invitations and links for resetting the password via the service Resend (Resend, Inc., USA) as a processor. The email address and content of the message are transmitted.

Reading in menus

If you upload a menu and have it read in automatically, the file is transmitted to Anthropic, PBC (USA) for text recognition and the result is returned to you. Menus usually do not contain any personal data; please do not upload documents containing such data.

6. Guest pages of the restaurants

The respective restaurant is responsible for the content of a guest page (e.g. menu, links, rewards programme). Tischlink processes the guests’ data on behalf of the restaurant.

Page views

We count views of a guest page as daily values per restaurant. No IP addresses, cookies or guest profiles are stored; views by search engines and link previews are filtered out based on the browser identifier.

Rewards and stamp card (optional)

If a restaurant offers a digital stamp card, guests can create one voluntarily. We store a first name (optional), the number of points collected and redeemed and the day of the last point. So that the card is recognised, the page stores a random key in your browser’s storage (localStorage); only a hash of this key is stored on the server. The legal basis is Art. 6 (1) (b) GDPR. The restaurant sees the cards in the portal. The data is deleted when the restaurant ends its programme or its guest page, but automatically at the latest if the card has not been used for two years; you can request deletion from the restaurant or from us at any time.

Stamp card in Apple Wallet (optional)

Guests can also add their stamp card to Apple Wallet. The card is then stored on the guest’s device and shows the restaurant, points balance, reward and – if provided – the first name. So that the points balance updates automatically, Apple Wallet sends us a random device identifier and a push token; we store both together with the card and only use them to announce a changed card. Transmission takes place via the Apple Push Notification Service (Apple Inc.). If the guest removes the card from Wallet, the device reports this and we delete the identifier. The legal basis is Art. 6 (1) (b) GDPR. The restaurant can also announce current offers via the card; notifications can be switched off for the card in Wallet at any time.

Stamp card in Google Wallet (optional)

Guests with an Android smartphone can also add their stamp card to Google Wallet. For this, we transmit to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) the information shown on the card: restaurant with logo and location, points balance, rewards, a link to the stamp card and – if provided – the first name. Google stores the card in the guest’s Google account and displays it on their devices. If the points balance changes or the restaurant announces an offer, we update the card via the Google Wallet API; Google may show a notification on the smartphone, which can be switched off in Google Wallet. Processing by Google LLC in the USA is possible; Google is certified under the EU-US Data Privacy Framework. The use of Google Wallet is also subject to Google’s privacy policy. If the guest removes the card from Google Wallet, we no longer use it; it is deleted together with the stamp card. The legal basis is Art. 6 (1) (b) GDPR.

Wi-Fi

The Wi-Fi credentials come from the restaurant. When connecting, a configuration profile is created on your device; we do not learn whether or with what you connect.

Links to Google, Instagram and websites

Links to Google reviews, Instagram or a restaurant’s website are only opened when tapped. Only then do the privacy policies of the respective provider apply.

7. Tischlink app and App Clip (iPhone)

App for restaurants

The Tischlink app offers restaurant owners the same functions as the management portal; the information in section 5 applies. You log in with the same account; the app stores the login cookie (“sid”) on your device. The app only accesses the camera when you scan a menu, and only accesses the photos and files you select yourself. The app contains no advertising and no analytics or tracking services.

App Clip for guests

When a table sign is tapped, an App Clip may open on the iPhone instead of the website. It shows the same guest page (section 6) and does not process any further data. If you tap “Connect to Wi-Fi”, iOS adds the restaurant’s Wi-Fi after your confirmation; we do not learn whether the connection is established. iOS automatically removes the App Clip if it is not used for a longer period.

8. Storage period

We only store data for as long as is necessary for the respective purpose. Expired logins and links are deleted automatically, uploaded files that are no longer used after 24 hours at the latest. We delete account data after the end of the contract, unless statutory retention obligations apply.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). To do so, write to us at info@tischlink.com.

You can also lodge a complaint with a data protection supervisory authority, in particular in the federal state in which you live or in which we are based.

10. Changes

We adapt this policy when our services or the legal situation change. The version published here applies.