Novaryq is used by restaurants to run their business, which means we handle personal information belonging to two groups: the people who work at the restaurant, and the guests it serves. This explains what is collected, where it goes, who else touches it and what you can ask us to do about it.
The restaurant decides what guest information to collect and why; it is the organization accountable for that information. Novaryq processes it on the restaurant’s behalf, under its instructions, to provide the service. For our own account and billing records, Novaryq is the accountable organization.
This matters when someone exercises a right: a guest asking what a restaurant knows about them is asking the restaurant, and we help the restaurant answer.
| Category | Examples | Why |
|---|---|---|
| Business account | Business name, addresses, contact details, plan and billing records | To open, bill and support the account |
| Staff | Names, roles, PINs (stored hashed), shifts, hours, tips, actions in the audit trail | To run the till, the schedule and payroll preparation |
| Guests | Name, contact details where given, order history, loyalty balances, marketing consent | To fulfil orders and run the restaurant’s own loyalty and marketing |
| Payments | Amounts, tokens, last four digits, card brand, settlement records | To take payment and reconcile it — never the full card number |
| Technical | Device identifiers, IP addresses, timestamps, error and access logs | To operate, secure and debug the service |
We do not sell personal information, we do not show third-party advertising in the product, and we do not use guest data from one restaurant to benefit another.
Platform data — orders, menus, staff records, guest profiles — is stored on servers in Boston, Massachusetts, United States, operated by Hostinger International (AS47583). Card processing is performed by Helcim in Canada, and the card number itself never reaches our systems.
Because that is a transfer outside Canada, information may be accessible to foreign authorities under the laws of that country. If your business is in Quebec, Law 25 requires you to assess a transfer of personal information outside the province before making it. We state this here, prominently, because you cannot assess a transfer you were never told about.
| Sub-processor | Purpose | Data | Region |
|---|---|---|---|
| Helcim | Card payment processing, in person and online | Card data (captured by Helcim, never by Novaryq), transaction amounts, tokens | Canada |
| Hostinger International | Application and database hosting | All platform data at rest and in processing | United States (Boston, MA) |
Optional services you switch on — email delivery, messaging, AI-assisted features — involve additional providers and are listed before activation rather than assumed. We will tell customers before adding a sub-processor that handles personal information.
Operational data is kept while the account is active, because a restaurant needs last year’s sales to run this year’s. When an account closes, business data is retained for a wind-down period so it can be exported, then deleted from active systems; encrypted backups age out on their own retention cycle.
Financial and tax records are kept as long as Canadian law requires, which can be longer than you might expect and longer than a deletion request can override. Ask us for the schedule that applies to your account before you need it.
Write to privacy@novaryq.com. If you are a guest of a restaurant that uses Novaryq, contact the restaurant — it holds the relationship, and we will support it in answering you.
If personal information is exposed in a way that creates a real risk of significant harm, we will notify the affected customers and the appropriate regulators as the law requires, describe what happened and what we did, and keep the record of the incident that Canadian law obliges us to keep.