This policy explains how Spinoza Hospitality (“we”, “us”) handles personal data in Resto360, our restaurant management platform on the web and in the mobile apps (the “Service”).
In short: restaurant businesses use Resto360 to run their operations and staff. We process the data they put in only to provide the Service. We don't sell personal data, we don't show ads, and the Service has no advertising or analytics trackers.
1. Who is responsible for your data
- Business data. Each restaurant business that uses Resto360 (the “Customer”) decides what data about its staff and guests goes into the Service, and why. For that data the Customer is the controller and we process it on the Customer's behalf. If you work for a Customer, your employer is your first point of contact for your data.
- Account and billing data. For the details of the people who sign up, sign in and pay for the Service, we are the controller.
2. What we collect
When you sign up or sign in
- Name, email address, password (stored only as a secure hash) and your company name.
- If you sign in with Google: your name and email address from your Google account.
- If you request access to a company account: your name, email, mobile number (verified by SMS code), branch, position and, optionally, your employee code.
Data a Customer enters about its staff
- Identity and contact details: name, employee code, phone, email, photo.
- Employment details: position, branch, hire date, contracts, leave, training, performance and disciplinary records.
- Pay details: salary, allowances, deductions, bank account and social-insurance numbers. These are visible only to payroll, HR and finance roles, and to the employee themselves.
- Identity documents and certificates the Customer uploads, such as national ID, health certificate and education certificate.
- Medical-insurance enrolment details, which can include family members.
- Attendance times from the Customer's time-clock devices. We receive clock-in and clock-out times only. We do not receive fingerprints or other biometric templates.
Operational data
- Sales, orders, inventory, purchasing, supplier and accounting records, mostly imported from the Customer's own systems (point of sale, delivery platforms, e-invoicing).
- Photos and scans users take in the app: receipts, invoices, card-settlement slips, maintenance issues, waste and security-camera snapshots.
- Your device location, only when you submit a task report and allow location access, to confirm where the task was done.
- Guest information: public reviews and reviewer names from review sites, voucher holder names, and delivery customers' names and phone numbers from delivery platforms.
- Anonymous staff messages sent through the “Speak Up” page. These carry no login and no phone number, and a name only if the sender chooses to give one.
Technical data
- A notification token for your device, so we can send push notifications.
- An activity log of actions in the account, such as who approved an invoice, and which screens are used, so the Service can show recent activity and frequent shortcuts.
- Security records, such as failed sign-in attempts and the IP address they came from, used to block password guessing.
Payments
Card details are entered on Stripe's checkout page and handled by Stripe. We receive only a customer reference, the plan and the subscription status, never full card numbers.
3. How we use data
- To provide the Service: show dashboards and reports, run payroll and HR workflows, reconcile sales and settlements, and send the notifications and SMS messages the Customer sets up.
- To keep it secure: authentication, role-based and branch-based access control, rate limiting and fraud prevention.
- To bill the Customer and manage the subscription.
- To support users and fix problems.
- To read documents and photos with AI when a user chooses a scan or translation feature.
Our legal bases are performing our contract with the Customer, the Customer's instructions for the data it controls, our legitimate interest in keeping the Service secure, and legal obligations such as tax records.
We do not sell personal data, use it for advertising, or use Customer data to train AI models.
4. Who we share data with
We use the following service providers to run Resto360. Each receives only what it needs for its task.
| Provider | What it does | Location |
|---|---|---|
| Supabase | Database, file storage, sign-in and server functions | EU (Frankfurt, Germany) |
| Netlify | Hosts the web app | Global network |
| Stripe | Subscription payments | USA / EU |
| Anthropic | AI reading of scanned documents and photos, translation | USA |
| Google (Firebase) | Push notifications | USA / global |
| “Sign in with Google”, and importing business reviews | USA / global | |
| Victory Link | Sending SMS messages and codes | Egypt |
When a Customer connects its own systems, such as a point-of-sale system, attendance devices, delivery platforms or the Egyptian Tax Authority's e-invoicing, data moves between Resto360 and those systems on the Customer's instruction.
We may also disclose data when Egyptian law or a valid court order requires it.
5. Where data is stored
Data is stored in the European Union (Frankfurt, Germany). Some providers listed above process data in other countries, including the United States. We use providers that commit to appropriate safeguards for such transfers, as required by Egypt's Personal Data Protection Law.
6. How long we keep data
- Customer data is kept while the Customer's subscription is active. After it ends, the data is deleted 30 days later, unless the Customer asks for an export first or the law requires us to keep certain records, such as invoices.
- Activity-feed events are deleted after 90 days. Screen-usage records are kept while the account is active.
- SMS verification codes expire after 10 minutes. Access requests expire after 30 days.
- Billing records are kept for as long as Egyptian tax law requires.
7. Security
- Data is encrypted in transit (HTTPS).
- Each Customer's data is isolated from every other Customer's at the database level, and inside an account access follows each user's role and branch.
- Sensitive staff data, such as salary, bank details and national ID, is restricted to payroll, HR and finance roles. Staff documents and photos are kept in private storage.
- Sign-in endpoints are rate-limited against password guessing.
No system is perfectly secure. If a breach affects your personal data, we will notify the Customer and the authorities as the law requires.
8. Your rights
Under Egypt's Personal Data Protection Law (No. 151 of 2020) you can ask to access, correct or delete your personal data, and object to or restrict its processing.
- If you are an employee or guest of a restaurant that uses Resto360, contact that business first. It controls your data and can correct or delete it, and we will help it respond.
- For your own account or billing data, email support@getresto360.com. We will respond within the time the law allows.
9. Children
The Service is for businesses and their adult staff. It is not directed at anyone under 18.
10. Changes to this policy
We will post any changes on this page and update the date above. For material changes we will also notify Customers by email or in the app.
11. Contact
Spinoza Hospitality · Egypt
Privacy questions: support@getresto360.com