Privacy policy

Controller: ALGD LTD, company number NI744090, 121 Glencam Road, Omagh, Tyrone, BT79 7HB, United Kingdom. Data-protection contact: support@restaurantrollup.com.

What we hold

Account details for each group (group name, owner name and email), a login per user (email and a scrypt hash of the password — never the password), and the operational data the group uploads: sites and their POS vendor, the POS export files themselves (including the raw rows), normalised daily sales/labour figures, vendor invoice totals, audit checklists, audit answers and audit photos.

Data about your staff and your suppliers

A labour export or an employee-hours report can name individuals, and audit photos can show people and premises. You are the controller of that content and decide what is uploaded; we are the processor, and we process it only to produce the pack, the digest and the audit record for your group. We do not sell it and we do not use it to train anything.

Where it lives

On servers provided by Fly.io (US region, iad), with the database and uploaded photos on an encrypted-at-rest volume. Email is sent through Amazon SES. Payment details are held by Stripe, Inc.; card numbers never reach us. Emails and files are transmitted over TLS.

Cookies

Two cookies at most: a session cookie (HttpOnly, SameSite=Lax) that keeps a signed-in user signed in, and — for the demo only — that same session cookie marked as the demo. No analytics, no advertising trackers, no third-party embeds, no external fonts or scripts.

Retention and your rights

Records are kept while the group's account is open and deleted within 30 days of a deletion request. Any user can export the group's pack as CSV at any time. Data subjects can write to support@restaurantrollup.com to exercise access, correction, objection or deletion rights; requests about a group's records are handed to that group, and we help where we can.

International transfers

Our infrastructure providers (Fly.io, Amazon, Stripe) may process data outside the UK/EEA; those transfers rely on their standard contractual clauses.