Legal document

Cookie Policy

This policy lists, one by one, the cookies Tablia uses — on the site www.tablia.com.br and on the platform app.tablia.com.br. Nothing generic: name, purpose, duration and whether the page's JavaScript can read it.

Last updated: August 21, 2026

This is a translation. The binding version of this document is the Portuguese one, published at tablia.com.br. It carries the same version number — the version identifies the document, not the translation. Where the two diverge, the Portuguese text prevails.

1. What cookies are

Cookies are small text files a site writes into your browser and gets back on later visits. They let the site remember something between one page and the next — that you signed in, for instance.

There are also similar technologies, such as the browser's local storage, that keep information on your device without technically being cookies. They are in section 4, because for you the effect is the same.

2. On the site — `www.tablia.com.br`

This site writes no cookies of its own. It is published as static content, with no login system, no cart and no preferences to remember.

There is one audience measurement tool: Google Analytics, loaded through Google Tag Manager. It measures which pages help and which get in the way — and it only starts working after you accept, in the banner shown on your first visit. Until you answer, or if you decline, none of these cookies is written.

There is no heatmap, no session recording, no advertising network pixel and no profiling. We do not sell or share this data with any advertiser.

Cookie	What for	Duration	Only after consent
`_ga`	Tells one visitor from another, without knowing who you are.	2 years	Yes
`_ga_PTVSJD80GD`	Keeps the state of your browsing session.	2 years	Yes
`tablia_consent`	Stores your answer to the banner, so we do not ask again. It is not a cookie: it is local storage, and it is never sent to the server.	Until you clear it	No — it is written when you answer, including when you decline

The first two belong to Google and sit under the tablia.com.br domain. They only exist if you accept; if you decline, Google receives only a count with no identifier, which cannot recognise the same browser across two visits.

The typefaces are loaded from Google Fonts. Loading a font transmits your IP address to Google, but writes no cookie in your browser.

There is one exception that is not created by this site but inherited from the platform. It is explained in section 5.

3. On the platform — `app.tablia.com.br`

The platform uses three cookies, all strictly necessary to make it work. There is no advertising cookie, no profiling cookie and no third-party cookie.

Cookie	What for	Duration	Readable by JavaScript
`tablia_auth`	Keeps you signed in after login. Without it you would have to type your username and password on every screen.	30 days	No — flagged httpOnly, the page's JavaScript cannot read it
`csrftoken`	Stops another site from sending requests on your behalf while you are signed in. It is CSRF protection.	1 year	Yes — out of technical necessity: the system has to read it to send it back with every request
`sessionid`	Session for Tablia's internal admin panel. It is not created during normal use of the platform by a store.	2 weeks	No — httpOnly

All are marked secure — they travel only over HTTPS — and with SameSite Lax, which stops them being sent from a third-party site in a dangerous request.

Without these cookies the platform cannot be used. Blocking them in the browser is the same as being unable to sign in.

4. Local storage

On this site

Two things, both on your device and neither sent to the server:

Your answer to the cookie banner, so we do not ask again on every page. It stays until you clear it, and the button in section 6 erases it.
The form draft, when a submission fails. If the security check expires or a field is missing, we keep what you typed to give it back on the next screen — otherwise you would have to write it all again. It lives in the tab's memory and disappears when you close it. Acceptance of the Policy is not kept: it is asked for again on every submission.

On the platform

The platform keeps three pieces of information in your browser's local storage. They are never sent to the server automatically — they stay on your device so the interface does not have to fetch the same data on every screen.

Key	What it holds	When it is erased
`store`	Data for the store you are in: name, identifier and display settings.	On logout
`user`	Your display data: name and role in the store.	On logout
`i18nextLng`	The language chosen in the interface.	When you clear site data in the browser

None of them holds a password, an access token or any customer quote data.

5. Cookies across subdomains

The platform's cookies are registered on the .tablia.com.br domain, not only on app.tablia.com.br. The consequence is direct, and we would rather state it than leave it implicit:

If you are signed in to the platform and visit this site, your browser will send the tablia_auth and csrftoken cookies along with the request, even though the site does nothing with them.

The site is static and does not read those cookies. Even so, it is information leaving your browser towards a server that does not need it, which is why it is written here. Anyone who has never signed in to the platform is unaffected: with no login, the cookies do not exist.

6. The consent banner

Consent is only required for cookies that are not necessary: advertising, audience measurement, profiling, social networks. The platform cookies in section 3 are strictly necessary and rest on performance of the contract — there is nothing to consent to there, because declining them means being unable to use the service.

The audience measurement in section 2 is the exception, and it is why the banner exists. It appears on the first visit and offers two options of the same size: accept and decline. There is no hidden button and no "manage preferences" that nudges you towards accepting. Declining is one click, the same as accepting.

Until you answer, the browser is instructed to deny storage — nothing is written while the banner is on screen. This version of the document delivers what the previous one promised: we adopted an analytics tool, and the consent mechanism arrived before the first cookie.

Changing your mind

Withdrawing has to be as easy as consenting. The button below erases your answer and brings the banner back, so you can choose again.

7. How to control and erase

The control belongs to your browser, and it works for any site. In the settings, look for "cookies and site data":

Chrome: Settings → Privacy and security → Cookies and other site data
Firefox: Settings → Privacy & Security → Cookies and Site Data
Safari: Settings → Safari → Advanced → Website Data
Edge: Settings → Cookies and site permissions

Erasing tablia.com.br data ends your platform session and clears the local storage from section 4. Nothing is lost: the data stays on the server and comes back at your next login.

Signing out with the logout button also erases the authentication cookie and clears local storage. It is the most direct route on a shared computer.

8. Changes and contact

If the list of cookies changes, this page is updated and the date at the top changes with it. Any change that introduces a non-essential cookie comes with a consent mechanism.

This policy complements the Privacy Policy, which covers all processing of personal data by Tablia.

Data Protection Officer: Carolina Porto · [email protected]

Tablia Serviços Tecnológicos Ltda. · Company ID (CNPJ) 53.734.413/0001-66 · Rua Professor Estevão Pinto, 555 — Serra, Belo Horizonte, MG, CEP 30.220-060