Privacy Policy

Tavoleria LLC Effective Date: May 18, 2026

Tavoleria LLC ("Tavoleria," "we," "us," or "our") respects your privacy. This Privacy Policy describes how we collect, use, and share personal information when you visit tavoleria.com (the "Website") or otherwise interact with us as a customer, prospective customer, vendor, or other business contact.

Tavoleria sells custom commercial hospitality furniture — primarily custom commercial tables made with Cosentino's Dekton material and related products — to commercial buyers such as restaurants, hotels, designers, architects, and contractors. We are a business-to-business company and do not sell to consumers through this Website. We do not offer customer accounts, e-commerce checkout, or chatbot interactions on the Website.

This Privacy Policy applies to information we collect through the Website, by email, by telephone, or in the course of a commercial relationship with you. By using the Website or otherwise sharing information with us, you agree to the practices described in this Policy.

1. Who We Are and How to Contact Us

Tavoleria LLC Principal place of business: 304 S. Jones Blvd. #1559, Las Vegas, NV 89107 Privacy inquiries: privacy@tavoleria.com General sales inquiries: sales@tavoleria.com

2. Information We Collect

Information You Provide

When you submit our Website contact form, send us an email, call our business phone line, or otherwise communicate with us, we may collect:

• your name;
• your business email address;
• your business telephone number (if you provide one);
• the name of your company and your role;
• the details of your inquiry, including specifications, project descriptions, sketches, drawings, photos, and other content you share with us;
• voice messages and call transcriptions when you call our business phone line (see Section 4); and
• any other information you choose to provide.

We collect this information directly from you. Providing information is voluntary, but if you choose not to provide it we may be unable to respond to your inquiry or fulfill your order.

Information We Collect Automatically

When you visit the Website, we and our service providers may automatically collect:

• your IP address (which may be truncated or anonymized depending on the analytics configuration);
• your device type, browser, and operating system;
• pages you view and links you click;
• the date and time of your visit and the approximate duration of your session;
• the referring website that brought you to ours; and
• general location information inferred from your IP address (typically city or region level, not precise location).

We collect this information using cookies and similar technologies. See Section 6.

Information We Do Not Collect

We do not collect Social Security numbers, government identification numbers, financial account numbers, payment card data through this Website (payment for any order is handled separately by invoice), health information, biometric identifiers, precise geolocation, or information about your race, ethnicity, religion, sexual orientation, or political views. We do not knowingly collect information from individuals under the age of 18.

3. How We Use Information

We use personal information for the following purposes:

• to respond to your inquiry and provide you with a quote;
• to manage and fulfill orders you place with us, including communicating with suppliers, fabricators, and shipping carriers on your behalf;
• to maintain a record of our customer and lead relationships in our customer relationship management ("CRM") system so that we can follow up on prior inquiries and serve repeat customers efficiently;
• to administer our business, including bookkeeping, recordkeeping, and routine business operations;
• to improve the performance and content of our Website;
• to comply with our legal obligations, including tax recordkeeping and contract enforcement; and
• to enforce our rights, prevent fraud, and protect the security of our systems and our customers.

We do not send promotional newsletters, advertising blasts, or other marketing emails unrelated to your specific inquiry, project, or business relationship with us. Communications we send you will be tied directly to your inquiry, your quote, your order, or your existing business relationship with us.

4. Telephone Communications, Voicemail, and Transcription

Tavoleria uses Quo (formerly OpenPhone) for its business telephone system. When you call our business phone number, the following may occur:

• We may receive your phone number, the time and duration of your call, and other standard call metadata.
• If you reach our voicemail or call us outside of our normal business hours, an AI-assisted voice attendant may answer the call, take a message, and generate a written transcription of your voicemail or message.
• We retain call metadata, recorded voicemails, and any AI-generated transcriptions as part of our customer-relationship records.

By calling our business phone line and leaving a voicemail, you consent to the voicemail-recording and transcription practices described above. We do not secretly record live calls. Where any applicable law requires the consent of all parties to record a live call, we will not record the live call without your express consent given on the call.

5. With Whom We Share Information

We share personal information only in the limited circumstances described below.

Service Providers

We engage trusted third-party service providers to operate our business. These service providers process information on our behalf and are contractually required to handle it consistent with this Policy and applicable law. Our principal service providers and the information they process on our behalf are:

• HubSpot, Inc. — customer relationship management (CRM), deal pipeline tracking, and shared customer inbox. HubSpot stores contact information, communication history, and project records associated with your inquiry. HubSpot maintains a published Data Processing Addendum and security program; see hubspot.com for details.
• OpenPhone (Quo Technologies, Inc.) — business telephone services, including voicemail, AI-assisted call handling, and call transcription. OpenPhone processes call metadata, voicemail audio, and transcriptions.
• SiteGround Hosting Ltd. — Website hosting services. SiteGround processes Website traffic and server logs.
• Google LLC — Website analytics through Google Analytics 4 ("GA4"). GA4 processes pseudonymous analytics identifiers and Website usage data. See Section 6.
• Professional advisors — our accountants, attorneys, insurers, and similar professional advisors, when their work requires access to information about specific customers or projects.

Business Partners Necessary to Fulfill Your Order

If you place an order with us, we may share information with our suppliers (including Cosentino and base-frame manufacturers) and our shipping carriers as necessary to produce and deliver your order. Information shared with these parties is limited to what is necessary for them to perform their role — typically project specifications, delivery address, and contact information for logistics coordination.

Legal Compliance and Protection of Rights

We may disclose personal information when we believe in good faith that disclosure is necessary to:

• comply with a subpoena, court order, or other legal process;
• comply with applicable law or regulation;
• enforce our rights under any contract with you;
• protect the rights, property, or safety of Tavoleria, our customers, our employees, or others;
• investigate or prevent fraud, security incidents, or other illegal activity; or
• respond to claims or assertions of legal liability.

Business Transitions

If Tavoleria is involved in a merger, acquisition, sale of all or substantially all of its assets, financing, reorganization, dissolution, or similar business transaction, personal information may be transferred to the successor entity or to participants in the transaction, subject to the protections of this Policy.

Sale and Sharing of Personal Information

We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising. We do not engage in targeted advertising based on personal information collected through this Website.

6. Cookies and Tracking Technologies

The Website uses cookies and similar technologies to operate, secure, and analyze use of the Website. Cookies are small data files that a website places on your device.

Cookies We Use

• Strictly necessary cookies. Used to operate the Website, maintain session state, and protect against abuse. Cannot be disabled without affecting Website functionality.
• Analytics cookies (Google Analytics 4). Used to understand how visitors navigate and use the Website. GA4 sets cookies including _ga and _ga_*. These cookies allow us to count visits, identify popular pages, and measure traffic sources.
• Service-provider cookies (HubSpot). Used by our customer relationship management provider (HubSpot, Inc.) to identify Website visitors across sessions and associate Website activity with inquiries or contacts in our CRM. HubSpot sets cookies including hubspotutk (a persistent visitor-identification cookie), __hssc (a short-lived session cookie), and __hssrc (a session-start cookie). These cookies are tied to the HubSpot service-provider relationship described in Section 5.

We do not use cookies for advertising, retargeting, or cross-context behavioral tracking.

Managing Cookies

Most browsers allow you to block or delete cookies through browser settings. If you block analytics cookies, you can still use the Website fully; we will simply have less insight into how it is being used.

Global Privacy Control and Do Not Track

Where transmitted by your browser, the Global Privacy Control ("GPC") signal is honored by us as a valid request to opt out of any "sale" or "sharing" of personal information in jurisdictions where such an opt-out applies. We do not sell or share for cross-context advertising in any event, so the effect of a GPC signal is to confirm our existing practice.

The Website does not respond to "Do Not Track" browser headers separately, but it honors Global Privacy Control as described above.

7. Your Rights and Choices

Depending on where you live, you may have rights with respect to personal information we hold about you. These rights generally include:

• Right to know / access. The right to know what personal information we hold about you, how we collected it, the purposes for which we use it, and to whom we have disclosed it.
• Right to delete. The right to request that we delete personal information we hold about you, subject to exceptions (for example, we may need to retain information to complete a transaction, comply with legal obligations, or defend legal claims).
• Right to correct. The right to request that we correct inaccurate personal information.
• Right to data portability. The right to receive a copy of personal information we hold about you in a portable format.
• Right to opt out of sale or sharing. Where applicable, the right to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. As stated above, we do not engage in either.
• Right to limit use of sensitive personal information. Where applicable, the right to limit our use of sensitive personal information. We do not collect or use sensitive personal information for purposes that would trigger this right.
• Right to non-discrimination. We will not discriminate against you for exercising any of your privacy rights — for example, by denying you services, charging different prices, or providing different quality of service.

To exercise any of these rights, contact us at privacy@tavoleria.com. We may need to verify your identity before responding to your request, typically by confirming information already in our records or by requiring you to respond to your request from an email address associated with your contact in our system. We will respond to verified requests within the timeframes required by applicable law (typically forty-five (45) days, with one possible extension when reasonably necessary).

You may also designate an authorized agent to make a request on your behalf. We may require the agent to provide proof of authorization and may verify your identity directly.

8. State Privacy Law Disclosures

California Residents (CCPA/CPRA)

In addition to the rights described in Section 7, California residents have the following specific rights and disclosures under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA"):

Categories of personal information we collect. In the past twelve months, we have collected the following categories of personal information about California residents: identifiers (name, email, phone, IP address); commercial information (project records, quote history, order history); internet or other electronic network activity (Website browsing and interaction data); and audio information (voicemails and call transcriptions where applicable).

Sources of personal information. We collect personal information directly from you, automatically from your interaction with the Website, and from our service providers acting on our behalf.

Business purposes for collection. We collect personal information for the purposes described in Section 3 of this Policy.

Categories of personal information disclosed. In the past twelve months, we have disclosed the categories of personal information identified above to the service providers and business partners described in Section 5.

Sale and sharing. We do not sell personal information and we do not share personal information for cross-context behavioral advertising. We have not sold or shared personal information about California residents (including any minor under 16) in the past twelve months.

Retention. We retain personal information for the periods described in Section 9.

To exercise your CCPA/CPRA rights, contact us at privacy@tavoleria.com.

Other State Privacy Laws

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, Iowa, Indiana, Tennessee, Montana, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island, Kentucky, or another U.S. state with a comprehensive consumer privacy law, you have rights under your state's law substantially similar to those described in Section 7 above. We honor these rights regardless of jurisdiction. To exercise them, contact us at privacy@tavoleria.com.

If you are dissatisfied with our response to a privacy request, you may appeal by emailing us at privacy@tavoleria.com with the subject line "Privacy Request Appeal." If we deny your appeal, you may also contact your state attorney general's office to file a complaint.

9. Data Retention

We retain personal information for as long as we have a legitimate business need for it, and otherwise as follows:

• Customer records (completed transactions). Retained for seven (7) years after completion of the transaction, consistent with business-records retention norms, tax-record-retention requirements, and applicable statutes of limitations.
• Lead records (inquiries that did not result in a transaction). Retained for twenty-four (24) months after the most recent contact, after which the lead record is archived or deleted.
• Telephone records (call metadata, voicemail, transcriptions). Retained for twenty-four (24) months after the call, unless the call relates to an active or completed transaction, in which case it is retained with the corresponding customer record.
• Website analytics. Retained in aggregate or pseudonymous form according to Google Analytics 4's default retention settings (typically fourteen (14) months for user-level and event-level data).
• Records subject to legal hold or pending claim. Retained as long as the legal hold or claim is active, notwithstanding the retention periods above.

When personal information is no longer needed for the purposes described in this Policy, we will delete it or render it permanently anonymous.

10. Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, or destruction. These measures include encryption of data in transit using TLS, vendor-managed encryption at rest where applicable, limited employee access on a need-to-know basis, vendor due diligence and data processing agreements with our service providers, and routine review of our security practices.

No security program is perfect, and we cannot guarantee that personal information will never be subject to unauthorized access or use. If we become aware of a security incident that affects personal information about you, we will notify you in accordance with applicable law.

11. Children's Privacy

The Website is intended for use by businesses and is not directed to children under 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will delete it promptly. If you believe we may have collected information from a child under 18, contact us at privacy@tavoleria.com.

12. International Users

Tavoleria is located in the United States. Personal information we collect is processed and stored in the United States. If you access the Website from outside the United States, you understand and agree that your information may be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country of residence. Tavoleria does not currently offer products or services to data subjects located in the European Economic Area, the United Kingdom, or other jurisdictions whose data-protection laws would impose specific cross-border transfer requirements; if you contact us from such a jurisdiction, we will handle your information consistent with this Policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make changes that materially affect how we handle personal information, we will revise the "Effective Date" above and, where required by law, pro