Cookie Policy

This Cookie Policy explains how InstaTable ("we", "us", "our") uses cookies and similar tracking technologies on our websites and applications, what each category does, and how you can control them.

It supplements our Privacy Policy, which explains in more detail how we handle personal information.

1. What are cookies and similar technologies?

A cookie is a small text file stored on your device by your browser when you visit a website. Cookies let websites remember you between visits — for example, to keep you signed in, remember your language preference, or measure how the site is being used.

We also use related technologies that work similarly to cookies, including:

Local storage and session storage — key-value data your browser stores for a specific site.
IndexedDB — a small in-browser database used for offline behaviour and performance.
Pixel tags / web beacons — tiny images embedded in pages or emails that record that they were loaded.
SDK identifiers — IDs generated by third-party SDKs (e.g. analytics, marketing).

For simplicity, we refer to all of these as "cookies" in this policy.

Cookies can be:

First-party — set by InstaTable when you visit instatable.net, app.instatable.net, op.instatable.net or book.instatable.net.
Third-party — set by another organisation whose code we load. Analytics and marketing tools (such as Google Analytics or Meta Pixel) are loaded only on our marketing website, instatable.net, and only after you accept them.

They can also be:

Session cookies — deleted when you close the browser.
Persistent cookies — stored for a set period (e.g. 1 hour to 24 months) or until you delete them.

2. Categories of cookies we use

We group cookies into four categories. Only Strictly necessary cookies are always on. The other three categories require your consent and can be changed at any time using the cookie settings button on our marketing website.

Where each category is used. Our marketing website (instatable.net) may use all four categories, subject to your choices. Our restaurant dashboard (app.instatable.net), operations console (op.instatable.net) and booking pages (book.instatable.net, including booking widgets embedded on restaurant websites) use only strictly necessary cookies and similar storage — we do not run analytics or advertising tools on them.

2.1 Strictly necessary cookies (always on)

These are essential for the Platform to work. Without them, you would not be able to sign in, complete a booking, or use the dashboard securely.

Purpose	Examples
Authentication and session	Supabase Auth session token, refresh token
Security and abuse prevention	CSRF token, rate-limit identifier, Cloudflare Turnstile anti-bot check
Routing on the right subdomain	Domain and subdomain preference cookies
Cookie-consent record	Your consent choices and timestamp
Booking widget state	In-progress booking step, party-size selection

We rely on the "strictly necessary" exemption from consent requirements in NZ guidance under the Privacy Act 2020, PIPEDA implied consent for obvious uses, and GDPR Article 5(3) ePrivacy for these cookies.

2.2 Functional cookies (optional)

These remember your preferences to give you a smoother experience.

Purpose	Examples
Remembering UI preferences	Sidebar collapsed state, theme, table density
Remembering language and region	Locale code, country selection
Remembering the last restaurant you booked with	Restaurant slug

Disabling functional cookies will not break the Platform but you may have to set preferences each time.

2.3 Analytics cookies (optional, consent required — marketing website only)

These help us understand how people use our marketing website so we can improve it. Analytics is off by default, runs only on instatable.net, and is loaded only after you accept.

Provider	Purpose	Typical retention
Google Analytics 4 (via Google Tag Manager)	Page views, sessions, traffic sources	14 months

Where possible we configure IP anonymisation and disable ad-personalisation signals.

2.4 Marketing cookies (optional, consent required — marketing website only)

These help us measure the effectiveness of our marketing on instatable.net and, occasionally, show you InstaTable adverts elsewhere..

Provider	Purpose	Typical retention
Meta Pixel (Facebook / Instagram)	Conversion tracking from our marketing site, lookalike audience building	Up to 24 months
LinkedIn Insight (if used)	Conversion tracking from LinkedIn ads	Up to 24 months

Marketing cookies are off by default and only set after you accept.

2.5 Error monitoring (all our sites)

We use Sentry to detect and diagnose errors on all our sites, so we can fix problems quickly and keep the Platform secure. Sentry does not set advertising cookies. It may record a masked replay of a small sample of sessions and of sessions where an error occurs — all text, form inputs and images are hidden in these replays — and we remove secret links (such as invitation, gift-card, cancellation and unsubscribe links) and email addresses before any data is sent. Error data is kept for up to 90 days. We rely on our legitimate interest in running a reliable and secure service for this processing.

3. Third-party cookies you may encounter

Some pages load embedded content or scripts from third parties. Those parties set their own cookies governed by their own privacy policies:

Google Fonts — font delivery (no advertising cookies; minimal request logs).
Google Analytics 4 — analytics, when consent is given.
Meta Pixel — marketing attribution, when consent is given.
Paddle — subscription checkout and payment processing (Paddle is our Merchant of Record).
Supabase — authentication session cookies (strictly necessary).
Cloudflare Turnstile — anti-bot check on some public forms (strictly necessary).
Sentry — error monitoring (see section 2.5).
Twilio / WhatsApp Business (when enabled) — message delivery telemetry.

We do not control these third parties and we are not responsible for their cookies. Analytics and marketing scripts are loaded only on instatable.net, and only after you give the relevant consent.

4. How long cookies last

Cookies last from the duration of a single session (a few minutes) to up to 24 months for some analytics and marketing identifiers. You can delete cookies at any time via your browser settings.

5. How to manage your cookie choices

5.1 Via our cookie banner

When you first visit our marketing website, we present a cookie banner with three options:

Accept all — turn on functional, analytics and marketing cookies.
Reject non-essential — keep only strictly-necessary cookies on.
Customise — choose each category individually.

You can change your choices at any time using the cookie settings button (🍪) shown on our marketing website.

5.2 Via your browser

All modern browsers let you view, block and delete cookies. You can also enable a "Do Not Track" or Global Privacy Control (GPC) signal. Helpful links:

Disabling all cookies may break the Platform — you may not be able to sign in or complete a booking.

5.3 Via opt-out tools

For some advertising and analytics cookies, you can also opt out at:

6. Do Not Track and Global Privacy Control

We honour Global Privacy Control (GPC) as a valid opt-out signal for non-essential cookies. If your browser sends a GPC signal, we will treat that as a rejection of analytics and marketing cookies on your visit.

The "Do Not Track" header is treated identically.

7. Cookies in emails

Marketing and transactional emails we send may contain tiny tracking pixels that record whether an email was opened and which links were clicked. This helps us and our Tenants measure deliverability. You can disable email tracking by configuring your email client to block remote images.

8. Children

We do not knowingly use cookies to collect personal information from children under 16. See section 13 of our Privacy Policy.

9. Changes to this Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in technology, regulation or our practices. We will update the effective date at the top and, for material changes, notify you in advance via the cookie banner or by email.

10. Contact

Questions or complaints about cookies should go to privacy@instatable.net.

Tags managed by Google Tag Manager

On our marketing website (instatable.net) only, InstaTable uses Google Tag Manager (GTM) to load analytics and marketing tags. GTM itself is loaded only after you accept analytics or marketing cookies, and each tag runs only if you have accepted its category. Currently configured tags may include:

Google Analytics 4 — page views and traffic sources (analytics consent required)
Meta Pixel — conversion tracking and ad measurement (marketing consent required)

GTM and these tags are never loaded on our dashboard, operations console, booking pages, or embedded booking widgets.