B2B SaaS Data Privacy & Service Provider Terms

1. Scope & Relationship of the Parties

These B2B SaaS Data Privacy & Service Provider Terms ("Privacy Terms") govern the collection, transmission, storage, and processing of business and consumer information in connection with the GastroMais US SaaS Platform.

• Merchant as the Business / Controller: The restaurant merchant ("Merchant") determines the legal basis, culinary purposes, and operational objectives for collecting customer names, phone numbers, delivery addresses, and order histories.
• GastroMais US as the Service Provider / Processor: GastroMais US processes and retains Customer Data exclusively on behalf of and pursuant to the documented instructions of the Merchant, as set forth in the Master SaaS Subscription Agreement and these Terms.

Note for Consumers: End-patrons who place orders on the restaurant storefront are directed to privacy.html for customer-facing privacy notices.

2. Categories of Data Processed

Under Merchant's instruction, the SaaS Platform processes the following categories of data:

• Merchant Administrative Data: Operator full name, business email address, physical restaurant address, store hours, tax identification, and corporate phone numbers.
• End-Consumer Order Data: Customer contact name, telephone number (formatted in E.164 international standard), physical delivery destination (street address, unit number, ZIP code), order items, prep instructions, table identifier, and payment method selection.
• Operational Telemetry: Anonymized server logs, IP addresses (first address extracted from proxy headers for fraud deterrence), user agent strings, and KDS preparation timestamps.

3. Permitted Business Purposes

GastroMais US collects and processes personal information strictly for the following operational business purposes:

1. Order Routing & Kitchen Execution: Dispatching order details to back-of-house kitchen display monitors (KDS) and generating customer receipts.
2. Order Fulfillment & Delivery: Enabling restaurant dispatchers and drivers to contact customers regarding order readiness, gate codes, or delivery arrival.
3. SMS Notifications (TCPA Compliance): Generating automated transactional order confirmations and status milestones to customers who have affirmatively opted in during checkout.
4. Merchant Analytics & CRM: Aggregating sales metrics, frequency analysis, and order reporting accessible exclusively by the authenticated Merchant.
5. Platform Security & Fraud Prevention: Defending endpoints against automated credential stuffing, distributed denial of service (DDoS), and spam injection.

GastroMais US shall not retain, use, or disclose personal information outside of the direct commercial relationship between Merchant and GastroMais US, nor combine consumer personal information across different merchants for behavioral profiling.

4. Information Security & Technical Safeguards

GastroMais US implements industry-standard administrative, physical, and technical safeguards:

• Encryption in Transit: All HTTP communications and WebSocket data streams are enforced via TLS 1.3 encryption.
• Database Row-Level Security (RLS): Multi-tenant isolation is enforced at the database kernel level in Supabase/PostgreSQL, preventing cross-tenant leakage.
• Minimal Exposure Architecture: Customer card numbers are never accepted, stored, or processed by platform servers (orders are settled via Zelle® or in-person pay-on-arrival terminals).
• Strict Content Security Policy (CSP): HTTP response headers enforce defensive CSP policies, frame-ancestor blocks, and anti-MIME sniffing protections.

5. Sub-processors & Infrastructure Partners

Merchant authorizes GastroMais US to engage trusted enterprise sub-processors to support cloud infrastructure operations:

• Supabase Inc. — Managed PostgreSQL database, authentication, and secure edge data storage.
• Vercel Inc. — Global serverless edge compute and Content Delivery Network (CDN) hosting.

All sub-processors are bound by written data protection agreements imposing security standards no less stringent than those established herein.

6. Consumer Privacy Rights Assistance

To the extent Merchant receives a verifiable consumer request under CCPA/CPRA, GDPR, or state privacy laws (including requests for access, data portability, correction, or deletion):

• GastroMais US provides Merchant with self-service administrative tools in the Merchant Admin to search, export, or redact customer profiles.
• Upon written notice from Merchant, GastroMais US will promptly execute data deletion requests across operational storage within thirty (30) business days.

7. Data Retention & Destruction

Consumer personal information is retained only for the duration necessary to satisfy the commercial purposes for which it was collected or to comply with applicable tax and legal recordkeeping requirements.

Upon termination of the Master SaaS Subscription Agreement, Merchant is provided a thirty (30) day export grace period. Following this window, all tenant-associated operational customer records will be irreversibly destroyed or sanitized from active database clusters.

8. Inquiries and Data Protection Officer

For inquiries regarding data privacy compliance, CCPA requests, or security audit documentation, please contact our Data Protection Team:

• Email: privacy@gastromais.com
• General Support: support@gastromais.com