Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account & Contact Information: Your full name, email address, phone number, job title, and restaurant business details provided during registration or setup.
• Business & Operational Data: Financial data, daily sales entries, labour costs, expenses, menu pricing, inventory, wastage logs, food safety records, permits, targets, and other operational data you enter, upload, or generate through the Application.
• Payment Information: Billing-related information processed securely through our payment processor, Stripe. We do not store full credit card numbers on our servers; Stripe handles all card data in accordance with PCI-DSS standards.
• Usage & Technical Data: Device type, browser type, IP address, approximate location (city/region), app interactions, feature usage patterns, and log data collected automatically when you use the Application.
• Communication Data: Records of correspondence with us, including support emails, contact form submissions, and in-app messages.
• Marketing Data (Optional): Your name and email address if you subscribe to our mailing list or submit a review. This is collected only with your explicit consent.

2. How We Collect Information

• Information you provide directly: When you create an account, complete the setup wizard, enter daily operational data, invite team members, or contact us.
• Information collected automatically: Through cookies, analytics tools, and server logs when you access and interact with the Application.
• Information from third parties: From our payment processor (Stripe), authentication providers (e.g., Google for sign-in), and analytics integrations (e.g., Google Analytics), as described in Section 8.

3. How We Use Your Information

We use your information for the following purposes, consistent with PIPEDA's principle of limiting collection and use:

• To provide, operate, maintain, and improve the Application and its features.
• To create and manage your account, authenticate your identity, and manage team member access.
• To process subscription payments, manage billing, and deliver billing-related communications.
• To generate reports, forecasts, dashboards, and analytics from the data you enter.
• To send you service-related notifications, account updates, security alerts, and administrative messages.
• To provide customer support and respond to your inquiries.
• To monitor and analyze usage trends, improve performance, and detect or prevent fraud, abuse, and security issues.
• To send marketing communications, such as our newsletter or product updates — only if you have opted in. You may unsubscribe at any time.
• To comply with applicable Canadian laws, regulations, and legal processes.

4. Legal Basis for Processing

Under PIPEDA, we process your personal information based on your consent, the necessity of the information for the identified purpose, and our legitimate business interests in operating the Service. You may withdraw your consent at any time, subject to legal or contractual restrictions, by contacting us at support@foodierun.ca.

5. How We Share & Disclose Information

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party vendors who help us operate the Application — including Stripe (payment processing), Google (authentication and analytics), and Resend (transactional email). These providers are bound by confidentiality obligations and process data only as instructed by us.
• Team Members: Data you enter may be visible to team members you have invited to your account, in accordance with the access roles you assign.
• Legal Compliance: Where required by law, court order, or government regulation, or to protect the rights, property, safety, or security of our users, ourselves, or others.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of all or part of our business, provided the recipient agrees to honour this Privacy Policy.

6. Data Storage & Security

• Canadian Data Residency: All User Data is stored on secure servers located within Canada and does not leave Canadian jurisdiction, except where you use a third-party integration (e.g., Google sign-in) that processes data under its own policies.
• Encryption: Your data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption protocols.
• Access Controls: We enforce strict role-based access controls. Only authorized personnel with a legitimate business need may access your data. All access is logged and auditable.
• Security Measures: We employ firewalls, secure authentication, regular security reviews, and monitoring to protect against unauthorized access, alteration, disclosure, or destruction of your data.
• Breach Notification: In the event of a privacy breach involving your personal information, we will notify affected users and the Office of the Privacy Commissioner of Canada as required under PIPEDA's breach notification requirements.
• Despite our best efforts, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but we are committed to protecting your data using industry best practices.

7. Cookies & Tracking Technologies

The Application uses cookies and similar tracking technologies (web beacons, pixel tags, local storage) to recognize your browser, remember your preferences, measure traffic, and understand usage patterns. You may set your browser to refuse cookies, but some features of the Application may not function properly without them. We use both essential cookies (required for the Service to function) and analytics cookies (to understand how the Service is used and improve it).

8. Third-Party Services

The Application integrates with the following third-party services, each governed by their own privacy policies:

• Stripe: Payment processing and subscription billing — stripe.com/privacy
• Google (OAuth & Analytics): Sign-in and traffic analytics — policies.google.com/privacy
• Resend: Transactional email delivery — resend.com/legal/privacy

We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

9. Your Privacy Rights

Under PIPEDA and applicable provincial privacy law, you have the following rights regarding your personal information:

• Right of Access: You may request a copy of the personal information we hold about you and information about how it has been used.
• Right to Correct: You may request correction of inaccurate or incomplete personal information.
• Right to Withdraw Consent: You may withdraw consent for the collection, use, or disclosure of your personal information, subject to legal and contractual restrictions.
• Right to Delete: You may request deletion of your personal information upon account closure. Certain data may be retained as required by law or for legitimate business purposes.
• Right to Data Portability: You may export your business and operational data at any time through the Application's built-in export tools.
• Right to Complain: If you believe we have not satisfactorily addressed a privacy concern, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, contact us at support@foodierun.ca. We will respond to your request within 30 days, in accordance with PIPEDA requirements.

10. Data Retention

We retain your personal and business data for as long as your account is active or as needed to provide the Service. Upon account closure, we will delete your personal information within 90 days, except where retention is required by law, to resolve disputes, enforce our agreements, or protect our legal rights. Aggregated, anonymized, or de-identified data that cannot be used to identify you may be retained indefinitely for analytical and product improvement purposes.

11. Children's Privacy

The Application is a business-to-business tool designed for restaurant operators and is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will promptly delete it.

12. International Data Transfers

Your data is stored on servers located within Canada and does not leave Canadian jurisdiction. However, some third-party service providers (e.g., Google, Stripe) may process data in other countries as part of their service delivery. Where this occurs, we rely on those providers' safeguards and compliance with applicable cross-border data transfer requirements. We take reasonable steps to ensure your information receives a comparable level of protection regardless of where it is processed.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated through the Application or via email. We encourage you to review this page periodically. The "Last updated" date at the top indicates when this policy was last revised. Your continued use of the Application after changes take effect constitutes acceptance of the updated policy.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact our designated Privacy Officer: