Privacy notice

Draft prepared for legal review. It is written to the Protection of Personal Information Act (POPIA) for restaurants in South Africa. A lawyer must confirm it before it is shown to a paying customer or a store reviewer.

Who we are

VistaIQ is operated by AO-V (the "operator"). Contact: antonio.osato@ao-v.com. The restaurant that signs up (the "owner") is the responsible party for its business data; the operator processes that data on the owner's instructions.

What the app collects

• Account details: your name, email address, role, the restaurant you belong to, and a hashed password. We never store the password itself.
• Device details: a sign-in token for your phone and, if you turn on alerts, a push-notification address for that phone.
• Business documents you upload: supplier invoices, delivery notes, stock-take photos, till exports, bank statements, payroll exports and delivery-platform statements.
• Figures derived from them: sales, purchases, stock, bank movements, cost percentages and the management accounts built from them.
• Activity: who uploaded, approved, counted or changed what, and when. The owner can see this log.

Bank statements and payroll exports can contain personal information about third parties (a customer's name on a payment, an employee's pay). Payroll is stored without names: an opaque reference and a department only.

Why we process it

To give the owner a weekly picture of the business: reconciled bank movements, stock variances, cost against targets, and a profit and loss account. Uploaded photos and documents are read by an AI model (Anthropic's Claude) so that figures can be extracted without retyping. Only the document being read is sent; it is not used to train any model.

Who can see it

• People the owner has approved, and only the parts their role allows. A stock counter sees stock; an accountant sees bank and exceptions; the owner sees everything.
• The operator, only when giving support, and every such access is written to the owner's activity log.
• Service providers that host and process the data: Microsoft Azure (South Africa North region) for database, files and computing; Anthropic for document reading. Each is bound by its own data-processing terms.

We do not sell data, and we do not share one restaurant's data with another. Each restaurant runs in its own isolated database.

How long we keep it

Documents and figures are kept for as long as the restaurant has an account, and for five years after the financial year they belong to where South African tax law requires it. Photos of stock and invoices are kept for 400 days by default. Sign-in tokens expire when you sign out or an owner removes you.

Your rights

Under POPIA you may ask what personal information we hold about you, ask for it to be corrected or deleted, object to processing, and complain to the Information Regulator (South Africa). Send requests to the operator's address above; we answer within 30 days.

Security

Data travels over TLS only. Passwords are hashed with PBKDF2. Access keys are stored as hashes. Files are in private storage with no public links. The app fails closed: anything without a valid sign-in is refused.

Children

VistaIQ is a business tool for people aged 18 and over.

Changes

We will post changes here with a new version and date, and tell owners in the app when the change matters.