Privacy Policy

1. Data We Collect

In providing the application and related services, we may collect:

• Account information: Full name, email address, profile picture, and role within the establishment.
• Establishment data: Restaurant/café name, address, daily revenue, expenses, inventory, and team records.
• Authentication data: Encrypted credentials and OAuth tokens (Apple, Google, Microsoft).

2. Loyalty Program Member Data (Mobile Application)

If you are a customer of a participating establishment and use the Minerva Flow mobile app (the "Guest Portal") to earn points or redeem rewards, we separately collect, distinct from the staff account information described in Section 1:

• Points history: Every visit, adjustment, and points redemption concerning you, with the associated date and amount.
• Reward redemptions: Rewards you have claimed and single-use codes generated to redeem them in-store.
• Visit history: Number of visits, total amount spent, and date of your last visit at each participating venue of which you are a member.
• Account preferences: Profile photo, favorite offers, and notification frequency preferences.
• Notification identifier: An Apple token on iOS or a Firebase installation identifier on Android can reach this device if you enable notifications. On Android, registration with this service stays off before your choice. Google Firebase Cloud Messaging receives this identifier, the internal account identifier and the content needed to deliver messages. No password or payment information is sent to it. You can turn notifications off in your device settings; the app then removes its registration the next time it opens. Signing out also removes the device from the account.

This information is used exclusively to operate your loyalty account (points calculation, displaying your visit history, and delivering authorized notifications) and is never used for external advertising. Access, correction, and deletion rights outlined in Section 7 apply fully to this data.

4. How We Use Data

We process your data exclusively to:

• Manage your account and ensure secure access to your restaurant’s dashboards.
• Generate financial analytics, revenue forecasts, and menu engineering recommendations.
• Send essential operational notifications (schedules, payroll summaries, inventory alerts).

5. Usage Analytics, Errors, and Session Replay (PostHog)

To understand usability challenges and diagnose errors, we utilize PostHog, a product analytics tool, across our website and mobile application. Data is transferred to PostHog (servers in the United States); on the web, requests proxy through our own domain.

• What is measured: Viewed pages and screens, key user actions (sign-up, ordering, campaign creation), encountered errors, language, and platform (web or ios).
• What is excluded in the mobile application: Email address, name, phone number, order details, or typed text inputs. Users are recognized by an opaque account ID, their role, and language.
• On the website: The signed-in account name (owner or staff) is associated with the identifier to assist support inquiries.
• Session replay: Screen reconstruction to reproduce customer issues. Typed form inputs are always masked and network request bodies are not recorded. On iOS all text and images are masked. On the web, text is masked on every page that can show customers, staff, suppliers, reviewers, billing or account details, and is readable only on pages without other people's data (for example the menu, the map, sign-in and the public site). On the web and in iOS (from build 31), session replay is on by default, but it only starts after a privacy notice has been shown on first use, and never if you refuse. The notice offers a one-tap refusal that turns off both usage measurement and replay, and you can change your choice at any time under Settings › Security (web) or Account › Privacy (iOS). On iOS an indicator shows for five seconds at the start of each session, and recording can be stopped at any time in the privacy settings. Android does not record sessions; it sends only usage events (screens and actions, tied to an opaque account identifier, never your name, email or orders) and has a switch to turn them off in Account.

How to opt out: In the app, navigate to Account › Privacy to stop analytics and session recording at any time. You can also write to privacy@minervaflow.app to request access to or deletion of your personal data. We never sell your data and do not use it for targeted advertising.

6. Subprocessors and Sharing

Your data is never commercialized. It is only shared with trusted technical service providers necessary for operating the Service (such as Supabase for secure cloud database hosting, Vercel for web infrastructure, Resend for transactional email delivery, Apple and Google Firebase Cloud Messaging for authorized notifications, Sentry for native crash reporting, PostHog for product analytics as described in Section 5, and TypeSafe AI, whose Jev decision model helps our operators sort support requests, prospects and review texts: only short text with email addresses, phone numbers and links removed is sent, never your account details), all bound by strict contractual confidentiality and data security obligations.

7. Rights and Privacy Officer (Law 25 & PIPEDA)

Pursuant to Quebec's Law 25 and applicable Canadian privacy legislation, you have the right to access, rectify, port, and delete your personal information.

To exercise your rights or for any questions regarding your personal information, please contact our Privacy Officer at: privacy@minervaflow.app or visit our Support page.