Privacy Policy

1. Who This Privacy Policy Applies To

This Privacy Policy may apply to:

• restaurant owners and administrators;
• restaurant employees and staff using Gostarta Operator;
• customers placing or managing orders through a restaurant using Gostarta;
• people whose information is entered into Gostarta by restaurant staff, for example for takeaway or pre-orders; and
• people who contact Gostarta for support or other enquiries.

Restaurants using Gostarta may independently determine how and why certain customer and employee information is collected through their restaurant operations.

Depending on the circumstances and applicable law, the restaurant may be responsible for determining how certain personal information is used, while Gostarta processes that information to provide the Services.

2. Information We Collect

2.1 Account and Staff Information

When a restaurant owner, administrator, or staff member uses Gostarta, we may process information such as:

• name;
• email address;
• user or staff identifier;
• restaurant and location association;
• role and permissions;
• account status;
• authentication and session information; and
• work shift and staff activity information.

Passwords and PINs used for authentication are stored by our backend in hashed form rather than as readable passwords or PINs.

On supported devices, authentication tokens may also be stored securely on the device to maintain a signed-in session.

2.2 Customer Information

Restaurants may enter or receive customer information through Gostarta when required to provide restaurant services.

This may include:

• customer name;
• customer phone number;
• pickup or order timing information;
• order information; and
• information associated with takeaway, pre-order, dine-in, or QR ordering workflows.

Customer name and phone number are optional in relevant Operator workflows and may be stored with the restaurant order.

2.3 Order and Restaurant Transaction Information

We process information required to operate the restaurant and maintain restaurant records, including:

• orders and order items;
• menu items and quantities;
• tables and table sessions;
• guest counts;
• order timestamps and status;
• order and item notes;
• discounts;
• voids and cancellations;
• refunds and returns;
• payment method;
• payment amount and status;
• transaction or reference identifiers, where applicable;
• staff members associated with restaurant transactions;
• shifts and cash movements; and
• related restaurant operational records.

These records are used to provide restaurant operations, accounting, reconciliation, reporting, security, and audit functionality.

2.4 Payment Information

Gostarta Operator may record restaurant transaction information such as:

• payment method, such as cash or card;
• payment amount;
• payment status;
• transaction or reference identifier; and
• the staff member recording the transaction.

Gostarta Operator does not currently collect or store payment card numbers, PANs, CVV/CVC security codes, or customer bank account credentials.

Where card payments are made using a separate EFTPOS or payment terminal, Gostarta records the restaurant transaction status and related operational information rather than the customer’s underlying card credentials.

2.5 Notes and Other User-Provided Content

Restaurant staff may enter free-text information into Gostarta, including:

• order and item notes;
• discount reasons;
• void or cancellation reasons;
• refund or return reasons;
• cash movement notes; and
• other information required for restaurant operations.

Users should avoid entering unnecessary sensitive personal information into free-text fields.

2.6 Device, Printing and Operational Information

Where a restaurant uses Gostarta’s device connectivity and printing functionality, we may process operational information about connected restaurant systems, including:

• Device Agent identifiers;
• computer hostname;
• operating system information;
• Agent software version;
• printer identity or serial information;
• device status and health information;
• print commands and print jobs; and
• information required to route restaurant documents to the correct device.

Print jobs may contain restaurant transaction information and, where applicable, customer information such as a customer name.

2.7 Restaurant Information

We may process information about restaurants using Gostarta, including:

• restaurant name;
• restaurant address;
• business contact information;
• restaurant locations;
• tax or business information;
• restaurant configuration;
• menus and products;
• restaurant logos and images; and
• restaurant location information used to operate the restaurant.

Restaurant business information is different from the personal location information of an individual user.

3. Information We Do Not Currently Collect Through Gostarta Operator

Based on the current version of Gostarta Operator, the app does not collect for its operation:

• precise or coarse location of the Operator user;
• contacts from the user’s device;
• photos or videos from the user’s device;
• microphone recordings or audio data;
• browsing history;
• search history;
• advertising identifiers; or
• personal device identifiers for advertising or tracking.

Gostarta Operator does not currently use third-party advertising, attribution, analytics, or mobile crash-reporting SDKs.

Some software libraries included in the application may contain functionality that Gostarta Operator does not use. The presence of such library functionality does not mean that Gostarta collects the corresponding personal information.

4. How We Use Information

We use information processed through Gostarta to provide and operate the Services, including to:

• authenticate users and maintain accounts;
• provide restaurant ordering and point-of-sale functionality;
• manage dine-in, takeaway, pre-order, and QR orders;
• manage tables and restaurant sessions;
• process restaurant payment records;
• manage shifts and cash reconciliation;
• route orders to kitchens;
• generate and route receipts and kitchen print jobs;
• operate connected restaurant devices;
• maintain transaction and operational records;
• provide reports and audit records;
• manage staff roles and permissions;
• protect the security and integrity of the Services;
• troubleshoot and maintain the Services;
• communicate service-related information; and
• comply with applicable legal and regulatory obligations.

We do not use Gostarta Operator data for third-party advertising or cross-app advertising tracking.

5. Tracking and Advertising

Gostarta Operator does not currently use personal information to track users across apps or websites owned by other companies for advertising purposes.

We do not currently use advertising SDKs or advertising identifiers in Gostarta Operator.

We do not sell personal information for third-party advertising purposes.

Internal restaurant audit records, transaction histories, and security records are used to operate and protect the Services and are not used for cross-company advertising tracking.

6. How We Share Information

We may share or process information with service providers where necessary to operate Gostarta.

Amazon Web Services (AWS)

Gostarta uses AWS infrastructure for functions including application hosting, databases, caching, storage, email delivery, system configuration, and infrastructure monitoring.

Current Gostarta backend infrastructure includes AWS services hosted in the Singapore (ap-southeast-1) region for core backend services.

AWS services used by Gostarta may include EC2, Elastic Load Balancing, RDS, ElastiCache, S3, SES, CloudWatch, and Systems Manager Parameter Store.

Cloudflare

Gostarta uses Cloudflare for DNS and content delivery functionality, including delivery of certain restaurant images and other static content.

Restaurant Device Agents

Restaurant operational information and print jobs may be transmitted between Gostarta’s cloud services and a Device Agent operating on restaurant-controlled equipment where necessary to perform printing and connected-device functions.

We may also disclose information where reasonably necessary to:

• comply with applicable law or a valid legal request;
• protect users, restaurants, Gostarta, or others;
• investigate fraud, misuse, or security incidents; or
• support a merger, acquisition, financing, restructuring, or transfer of all or part of the business, subject to applicable legal requirements.

We do not permit service providers to use personal information for their own advertising purposes merely because they process information on our behalf.

7. International Data Processing

Gostarta operates technology services that may process information outside the country where a restaurant, staff member, or customer is located.

For example, Gostarta currently uses AWS infrastructure in Singapore for core backend services.

This means information relating to users in countries such as New Zealand or Vietnam may be transmitted to and processed in another country.

Where required by applicable law, we take reasonable steps to ensure that personal information transferred internationally is handled with appropriate protections.

8. Data Retention

We retain personal and operational information for as long as reasonably necessary to:

• provide and maintain the Services;
• maintain restaurant transaction and business records;
• provide audit and reconciliation functionality;
• maintain security and prevent misuse;
• resolve disputes;
• comply with legal, tax, accounting, or regulatory obligations; and
• establish, exercise, or defend legal claims.

Retention periods may differ depending on the type of information and the reason it is held.

Certain operational records may have defined automated retention periods. Other restaurant transaction and account records may be retained for longer periods where required for legitimate operational, business, or legal purposes.

When information is no longer reasonably required, we may delete or anonymise it where appropriate and subject to applicable law.

9. Data Security

We use technical and organisational measures intended to protect information processed through Gostarta.

These measures include controls such as:

• authenticated access;
• role-based permissions;
• restaurant and location access controls;
• secure authentication mechanisms;
• hashed storage of passwords and PINs; and
• controls intended to separate data belonging to different restaurants.

However, no internet transmission, computer system, or method of electronic storage can be guaranteed to be completely secure. Users and restaurants are also responsible for protecting their login credentials and devices.

10. Restaurants and Their Customers

Gostarta is a technology provider to restaurants.

When a restaurant collects customer information through Gostarta—for example, a name or phone number associated with a takeaway order—the restaurant may have its own privacy obligations toward that customer.

Restaurants are responsible for ensuring that they have an appropriate basis to collect and use customer information through the Services and for providing any notices required by applicable law.

Gostarta processes such information as necessary to provide the Services to the restaurant, subject to applicable law and our agreements with the restaurant.

11. Access, Correction and Deletion Requests

Depending on where you live and applicable privacy law, you may have rights concerning your personal information, which may include rights to:

• request access to personal information held about you;
• request correction of inaccurate information;
• request deletion of certain information;
• object to or restrict certain processing; or
• make a privacy complaint.

Some information may need to be retained where required by law or where reasonably necessary for legitimate business purposes such as transaction records, fraud prevention, security, dispute resolution, or legal compliance.

If your information was provided to Gostarta by a restaurant, you may also need to contact that restaurant directly because the restaurant may control how that information is used.

12. Children’s Privacy

Gostarta Operator is a business application intended for restaurant owners, administrators, and authorised restaurant staff. It is not designed as a service directed specifically at children.

Restaurant customers may nevertheless include people of different ages. Restaurants are responsible for complying with applicable requirements when collecting personal information from their customers through Gostarta.

If we become aware that personal information has been processed contrary to applicable requirements concerning children, we will take appropriate steps in accordance with applicable law.

13. Third-Party Services and Links

The Services may interact with third-party services, restaurant hardware, payment terminals, websites, or other systems.

Those third parties may have their own privacy practices and policies.

Where a restaurant uses a separate payment terminal or payment provider, the payment provider’s handling of cardholder information is governed by its own terms and privacy practices.

Gostarta is not responsible for the independent privacy practices of third parties that are not processing information on Gostarta’s behalf.

14. Changes to This Privacy Policy

We may update this Privacy Policy as Gostarta develops, our Services change, or legal and regulatory requirements evolve.

When we make changes, we will update the “Last updated” date at the top of this Privacy Policy.

Where required by applicable law, we may provide additional notice of material changes.

15. Contact Us

Gostarta
Website: gostarta.com

For restaurant-specific requests relating to an order or customer record, users may also contact the restaurant that collected the information.