Privacy Policy

What HAUS-SYNC Is, and Whose Data This Policy Covers

HAUS-SYNC ("we", "us") is restaurant food cost and margin intelligence focused on weekly cost and margin decisions. We work with restaurant businesses — owners, GMs, and chefs — not individual diners. We do not operate a guest loyalty program, table-side ordering, or consumer marketing product. The data we handle is restaurant and supplier data, not consumer profiles.

The product connects:

• Supplier documents — invoices, statements, and price lists you upload
• Menu and recipe data — ingredients, portions, yields, and cost assumptions
• Sales data — items sold, sales mix, and discounts, imported by CSV or synced read-only from your point of sale
• Basic account information — business name, contact details, users and roles

Data We Collect and Why

• Account data. Operator name, business contact details, user logins and roles. Credentials are managed by our authentication provider (Clerk) — we never see or store your password.
• Invoice and supplier data. The photos and PDFs you upload, and the structured data our AI extracts from them: supplier names, dates, line items, units, prices, and totals.
• Menu and recipe data. Dish names, components, ingredient mappings, yields, and the recipe costs and margins we compute from them.
• POS and sales data. Item-level sales, sales mix, and discounts, imported by CSV or connected through a read-only integration (currently Square). We only read — we cannot change anything in your POS.
• Product usage data. Interactions with the app (views, clicks, features used) via PostHog, and error reports via Sentry, to keep the product reliable and improve the operator experience.

We use this data to:

• Compute current ingredient and recipe costs from your invoices.
• Calculate recipe margin and menu performance each week.
• Generate dashboards and reports that show where food cost and margins stand.
• Maintain the security, support, and quality of the service.

We do not sell operator or supplier data to third parties, share your supplier pricing with other customers, or use your invoices for advertising. Ever.

How We Handle Operator and Supplier Data

Your data stays within the HAUS-SYNC environment except where you explicitly connect an integration or where a trusted infrastructure provider processes it on our behalf. Invoice files live in access-controlled cloud object storage; structured data lives in a managed PostgreSQL database. Everything is scoped to your organization — other customers cannot see it, and organization-level isolation is enforced on every request.

The AI service we use for invoice parsing is constrained to that use: documents are sent solely to extract line items, and we do not allow the provider to train public models on your data.

Our current subprocessors — each receives only what it needs to do its job:

• Clerk — authentication and account management
• OpenAI — AI parsing of invoice documents (no training on your data)
• Square — read-only sales sync, only if you connect it
• PostHog — product analytics
• Sentry — error monitoring
• Replit — application hosting, database, and file storage

These providers act as processors, not owners, of your data. We will keep this list reasonably current as it changes.

Operator Responsibilities

• Keep your credentials and devices secure.
• Make sure you have the right to share the supplier documents and POS data you bring to HAUS-SYNC.
• Treat operating views as one input into decisions — we do not guarantee any specific financial outcome.
• Comply with local labor, food safety, and financial regulations. HAUS-SYNC is an operating tool, not a legal advisor.

Data Retention and Deletion

We retain your organization's data while your account is active. After cancellation, data is retained for 30 days unless deletion is requested sooner, subject to applicable legal requirements. Backup copies may persist temporarily per our backup-retention schedule, after which the data is deleted or irreversibly anonymized. Certain derived metrics and anonymized aggregates may be retained to improve the product, but they are never tied back to a specific restaurant.

To request deletion of your organization's data — account, invoices, menus, recipes, sales, and POS connections — email hello@haus-sync.com from the address on your account. We will confirm and complete the deletion within 30 days, and confirm to you when it is done. An in-product deletion flow is on our roadmap; until it ships, this email channel is the deletion mechanism.

Data Export

Your data is yours, and you can take it with you. On request, we will provide a copy of your key data sets — invoice records, menu and recipe data, and core margin outputs — in a standard format such as CSV. Export covers your business data, not internal logs or system metadata. An in-product export mechanism is planned; we will document timing and format when it ships.

Where We Are in Our Compliance Journey

HAUS-SYNC is at an early, design-partner stage. We do not claim SOC 2 or other formal certifications, because we do not hold them yet. What we do have: authentication, per-organization data isolation, access-controlled storage, and regular dependency and code security scanning. We are building toward a stronger compliance and security posture, and this policy is the first version of that floor — it will get stronger, not weaker.

Your Rights

You can request a copy of your data, correct it, or have it deleted at any time by contacting us. If you operate in a jurisdiction with specific privacy rights (such as GDPR or CCPA), we will honor requests consistent with those laws.

Changes

If this policy changes in a way that matters, we will note it here with a new "last updated" date and, for significant changes, notify you by email.

Contact

Questions about this policy or your data: hello@haus-sync.com