Privacy policy

What this covers

This policy applies to Restavo Cloud — the hosted service at our own domains — and to this marketing site.

It does not apply to a Restavo you run yourself. The self-hosted edition talks to your database, on your infrastructure, and sends us nothing. We cannot read it, back it up or delete it for you.

We act in two different roles, and the difference matters

For everything your restaurant puts into Restavo — orders, staff records, inventory, customer enquiries — you decide what is collected and why. You are the controller; we process it on your instructions and do nothing else with it. We do not mine it, sell it, rent it, or use it to train models.

For your own account with us — who signed up, which plan, support conversations, invoices — we are the controller, because those decisions are ours.

What we collect

Account and identity: name, email address, a hashed password (never the password itself), the organisation and restaurants you belong to, and your role in them. Sessions are held in an httpOnly cookie and exchanged for short-lived access tokens.

Operational data you enter: restaurants and branches, menus and prices, orders and their line items, payments and transactions, employee records including pay and time off, incident records, inventory movements, and your public storefront content.

Storefront visitors: if a diner submits your storefront's contact form we store the name, email and message they typed. Their IP address is stored only as a salted one-way digest, used to rate-limit abuse, and only when that salt is configured.

Technical records: server and error logs needed to keep the service up and to investigate incidents.

This marketing site runs no analytics, no advertising pixels and no third-party trackers. Your theme and language preference are kept in your own browser's local storage and never sent to us.

Why we are allowed to hold it

To perform our contract with you: running the service, authenticating you, taking payment, providing support.

Our legitimate interests: keeping the service secure, preventing fraud and abuse, and understanding aggregate product usage. We do not rely on legitimate interests for anything a reasonable customer would be surprised by.

Legal obligation: invoices and tax records we are required to keep.

Consent, where we ask for it — for example marketing email, which you can stop at any time without affecting your account.

Who else touches your data

We use a small number of service providers, each under a written data-processing agreement and each given only what it needs: cloud hosting and managed databases, an image and media CDN for photos you upload, an email provider for verification and transactional mail, and — only if you connect it yourself — Slack for operational notifications.

We will give you the current list of subprocessors on request and tell you before we add one that handles your data.

We disclose data to anyone else only when you tell us to, or when we are legally compelled — in which case we will tell you unless we are prohibited from doing so. Your data is not an asset we sell.

How long we keep it

While your account is open, we keep your data so the service works — a restaurant needs last year's numbers.

When you close your account we delete your production data within 30 days. Encrypted backups age out on their own rolling schedule, within 90 days.

We keep what the law requires us to keep, principally invoices, and security logs for as long as they are useful for investigating an incident.

What you can ask us to do

You can ask for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing based on legitimate interests, and ask for your data in a portable machine-readable form.

Write to us and we will answer within 30 days. We will not charge you and we will not make you explain why.

If you are a diner rather than a Restavo customer, the restaurant holds your data and we act on their instructions — ask them first, and we will help them comply.

How we protect it

Traffic is encrypted in transit and data is encrypted at rest. Passwords are hashed, never stored or recoverable in plain text. Access tokens are short-lived and signed.

Every request is scoped to one restaurant and branch, and staff access inside our team is limited to the people who need it for support or operations.

No system is perfect. If a breach affects your data we will tell you promptly and tell you what we know, including what we do not yet know.

Where it lives

Our infrastructure and our providers may process data outside the country you operate in. Where that happens we rely on the standard contractual protections available to us, and we will tell you which regions your data sits in if you ask.

Not for children

Restavo is a tool for businesses. It is not directed at children and we do not knowingly collect data from anyone under 16. If you think we have, tell us and we will delete it.

Changes

When we change this policy we update the date at the top. If a change materially affects what we do with your data we will tell you before it takes effect, not after.