Privacy Policy

Ziggi's Salisbury #153 · Draft v0.2 — pending owner review

Draft. This policy has been prepared for owner review and is not yet in effect. Wording, the security contact, and the effective date are pending sign-off.

This application is the internal operations and book-of-record system for Ziggi's Salisbury #153 and its affiliated property entity, Ziggi's Salisbury PropCo (Land). It is used by our employees, managers, and authorized advisors to run the restaurant and keep both sets of books. It is a business system, not a consumer service: accounts are created by invitation and every data surface sits behind sign-in and an administrator approval step.

Information we collect

Account and sign-in data

Your name, work email address, role and permissions, and sign-in records. Sign-in is via Google, Microsoft, or an email/password account. If you hold a privileged role and sign in with a password, you must also enroll a two-factor authenticator before you can reach any data.

Business and financial data

The company's own accounting records: journal entries, bills, payments, deposits, vendor and customer details, payroll postings, tax filings, and point-of-sale sales data. Where a company bank account has been connected, we also hold bank account metadata and transaction history for that account (see "Bank connections and Plaid" below). Where the accounting system is connected, we hold the accounting records and bank lines synced from it.

Employee and operational data

Employment information staff provide for work purposes: name, contact details (including mobile number when voluntarily provided), work location, positions and pay rates, availability, schedules, time punches, and the payroll and tax information required by law. Sensitive identifiers used for payroll and tax are held only where the law requires us to hold them.

System and audit data

Every change to a record is written to an audit log capturing who made it, what changed, and when. We also keep standard application and platform logs (request, error, and job diagnostics) needed to run and secure the service.

How we use it

• To run the restaurant: scheduling, time and attendance, payroll, purchasing, onboarding, and reporting.
• To keep an accurate set of books and to corroborate recorded cash against the bank.
• To meet legal, tax, and employment obligations.
• With recorded consent, to send SMS and email notifications about your work (see "SMS notifications" below).
• To secure the service — authentication, authorization, audit, and incident investigation.

We do not sell personal information, and we do not use it for advertising or share it with third parties for their own marketing. We share data only with the service providers listed below and where the law requires it.

Bank connections and Plaid

When an administrator connects one of the company's own bank accounts, the connection is made through Plaid Link, operated by Plaid Inc. Plaid Link is offered only on administrator-gated pages inside this application; it is never shown to consumers or to the public.

• Bank credentials are entered directly into Plaid Link and are never seen, transmitted, or stored by this application. We never ask for, and have no way to receive, your online banking username or password.
• From Plaid we receive an access token for the accounts you authorize, account metadata (institution, account name and type, and a masked last four digits), and transaction records (date, description, merchant, amount, and pending status). We use them for one purpose: corroborating the company's recorded cash against the bank and surfacing bank activity for review.
• The Plaid access token is encrypted at rest under a dedicated key, and the account number itself is never stored — only the masked last four digits are displayed.
• We currently use Plaid only for transaction data. We do not use Plaid to move money and we do not collect employee bank account details today. A direct-deposit enrollment flow has been designed but is not built; if and when it ships, we will capture a separate written direct-deposit authorization before any payment is made to an employee account.
• Plaid's own handling of the data is governed by its end-user privacy policy: plaid.com/legal.
• You may withdraw a bank connection at any time by asking us to disconnect it. On request we delete the stored access token, which ends all further access to the institution. (An in-app disconnect control is planned; today this is handled by request.)

Service providers

We use the following processors. Each is bound by its own agreement and used only for the purpose shown.

• Microsoft Azure — hosting, database, storage, key management, and backups.
• Plaid Inc. — bank account connection and transaction data, as described above.
• Xero — accounting records and bank lines, where the accounting integration is connected.
• Azure Communication Services (Microsoft) — delivery of SMS and email notifications.
• Google and Microsoft identity services — sign-in, where you choose that option.
• Microsoft 365 / Microsoft Graph — reading a designated vendor-invoice mailbox, where that intake is connected.
• Anthropic — assisted document extraction and finance assistance, where the AI features are enabled.
• NCR Voyix (NCR Aloha) — point-of-sale. Sales, time-clock and menu data are read from NCR's cloud service once the store's access keys are connected, or imported by file export from the point-of-sale console.
• TaxBandits (SPAN Enterprises) — electronic filing of federal payroll tax returns, when that filing path is enabled.

Where your data is held

Application data is stored in Microsoft Azure data centers in the United States (Azure SQL Database and Azure Blob Storage). Our processors may process data in other locations under their own terms; Plaid's locations are described in its privacy policy linked above.

How long we keep it

Retention windows differ by class of record — financial records are kept for the life of the books, while consent and authorization records follow the applicable regulatory minimum. See the Data Retention & Deletion Policy.

How we protect it

Access is role-based and least-privilege, every account is individual, two-factor authentication is required for privileged accounts, traffic is encrypted in transit, and the database is encrypted at rest. The full control set is in our Information Security Policy.

Your choices and rights

• Ask what personal information we hold about you, and ask us to correct it if it is wrong.
• Withdraw SMS consent at any time (below).
• Ask us to delete personal information. We honor deletion requests except where a record must be retained by law or to keep the books accurate — the Data Retention & Deletion Policy explains which is which and how a request is handled.
• Ask us to disconnect a bank connection.

Raise any of these with management, or contact the security and privacy contact: [OWNER TO SET — monitored security alias, e.g. security@example.com].

SMS notifications

We send text messages only to our own employees who have opted in. Messages cover work-schedule notifications, payroll and onboarding notices, and one-time sign-in verification codes. This is not a marketing program, and mobile numbers are never sold, rented, or shared with third parties other than the provider that delivers the message.

• Consent is given in the employee app by confirming a code sent to the number; we record who consented, to what wording, and when. Without a recorded, confirmed consent the system refuses to send to a number.
• Message frequency varies with your work schedule. Message and data rates may apply.
• Reply STOP at any time to opt out; reply HELP for help. You can also withdraw consent in the employee app or by telling a manager.
• Carriers are not liable for delayed or undelivered messages.

Full program details are on the SMS Program page.

Children

This system is not directed to children. Where we employ a minor, their information is handled as employment information under the same terms as any other employee record, with the additional protections applicable law requires.

Changes to this policy

We review this policy at least annually, and before enabling any new Plaid product or adding a processor. We also update it whenever our data practices change. Each version carries the version number and effective date shown at the top of this page.

Draft v0.2 — pending owner review · Information Security Policy · Data Retention & Deletion Policy · Terms & Conditions · SMS Program