Privacy Policy

1. Who is responsible

[MIZO legal name] Inc., [Registered office address], [City], Québec [Postal code], Canada. Our person in charge of the protection of personal information is [Name of the person in charge of the protection of personal information]. You can reach them at privacy@mizo.solutions.

2. Two roles: our own information, and our clients’

For the people who use MIZO on behalf of a restaurant (owners, managers, staff with an account) and for visitors to our website, MIZO decides how their information is used and is responsible for it under this policy.

Restaurants also enter information about their own employees (for example names, phone numbers, pay, hours worked and time clock records). For that information, the restaurant decides what is collected and why; MIZO stores and processes it only to provide the service, under the restaurant’s instructions and our Subscription Agreement. Employees who want to see or correct that information should ask their employer, and we will help the restaurant answer.

3. What we collect

• Account information: your name, email address, role, language and appearance preferences, and an optional profile photo.
• Business information you enter: your restaurant’s details, suppliers, items, recipes, prices, sales, orders, invoices and photos of supplier invoices, finances and notes.
• Employee information the restaurant enters (see section 2). Time clock PINs are stored only in scrambled (hashed) form.
• Agreement records: which version of our terms you accepted, and when.
• Technical information: the date and time of requests, IP address, browser type and error logs, kept to run and secure the service.
• Payment information, once paid plans start: collected and stored by our payment processor, not by MIZO. We only keep the plan, amounts and payment status.

4. Why we use it

• To provide MIZO: sign you in, save and show your data, run the calculations, send the alerts and emails you set up.
• To run the AI features you choose to use (Assistant, invoice scanning, setting up automations in plain words).
• To support you, bill you, keep the service secure, prevent abuse and meet our legal obligations.
• To improve MIZO using aggregated, de-identified statistics. We do not sell personal information, and we do not use your restaurant’s data to advertise to you or to anyone else.

5. Consent

We ask for your consent when you create an account, and we use your information only for the purposes above or for purposes compatible with them. You can withdraw consent at any time by closing your account; some information may be kept as required by law (see section 8).

6. Service providers and where data is stored

Your restaurant’s data is stored in a database hosted in Canada (Montréal region). We use the following service providers, who may only use the information to provide their service to us and must protect it:

• Supabase: database and sign-in (data stored in Canada).
• Vercel: website and application hosting (may process requests outside Canada, including the United States).
• Resend: sending sign-in and alert emails (United States).
• Anthropic: the AI model behind MIZO’s AI features. When you use them, the question, invoice image or business figures needed to answer are sent to Anthropic for processing (United States). Anthropic does not use this data to train its models.

7. Transfers outside Québec

Some providers above process information outside Québec. Before doing so we assessed the privacy risks, including the sensitivity of the information, the purpose, the protection measures and the legal framework of the place it goes, and we have written agreements requiring adequate protection.

8. How long we keep it

We keep information while your account is open. When a restaurant closes its account, its data can be exported for 30 days and is then deleted from the live system; backups are overwritten within 90 days. We keep billing and agreement records as long as tax and corporate law require (generally 6 years in Québec).

9. How we protect it

• Encryption in transit (HTTPS) and at rest.
• Each restaurant can only see its own data, enforced inside the database; within a restaurant, roles limit who sees pay and finances.
• Passwordless sign-in by email link, hashed time clock PINs with lockouts, and limited staff access to production systems.

10. Confidentiality incidents

If an incident involving personal information presents a risk of serious injury, we will promptly notify the Commission d’accès à l’information and the people concerned, take steps to reduce the risk, and keep a register of incidents as the law requires. If the incident involves a restaurant’s employee information, we will tell the restaurant without delay.

11. Your rights

You can ask to access your personal information, have it corrected, receive it in a structured, commonly used technological format, withdraw your consent, or ask that it stop being disseminated. Write to privacy@mizo.solutions. We answer within 30 days and may ask you to confirm your identity. If you are not satisfied, you can complain to the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

12. Cookies and similar technology

MIZO uses only what it needs to work: a sign-in cookie, and settings saved in your browser (language, theme, demo data). We do not use advertising or tracking cookies. If we ever add analytics, they will be off until you turn them on.

13. Children

MIZO is a business tool and is not intended for anyone under 14. Restaurants must not create accounts for minors under 14; their time clock records may be kept by the restaurant as an employer.

14. Changes

We will post any change here with a new version date, and tell account holders by email or in MIZO at least 30 days before a significant change takes effect.