Privacy Policy

1. Who we are and what this Policy covers

This Privacy Policy explains how HEY! JAG INC, a Florida corporation located at 350 N Federal Hwy, Unit 715S, Boynton Beach, FL 33435, USA ("Hey JAG", "we", "us"), collects, uses and shares personal information in connection with Hey JAG POS: the website heyjagpos.com, the web and Android applications, our APIs and support (the "Service"). It applies to businesses in the United States and their staff, and to the patrons of those businesses whose information is entered into the Service.

Hey! JAG Food (www.heyjag.com) is a separate delivery platform with its own privacy policy.

Contact for privacy questions and requests: contact@HeyJag.com.

2. Our role: business or service provider

• For account holders and their staff (owners, managers, cashiers, waiters), and for visitors of our website, Hey JAG decides how and why the information is processed.
• For information about a restaurant's patrons and employees that the restaurant enters into the Service (orders, delivery addresses, phone numbers, time clock records), the restaurant is the business responsible for that data and Hey JAG acts as its service provider / processor: we process it only on the restaurant's instructions to provide the Service. Requests about that data should be addressed to the restaurant; we will help it respond.

3. Information we collect

• Account and staff information: name, email address, phone number, business name and address, role, password (stored as an irreversible hash), PIN codes (hashed), language and region preferences.
• Business data: menu, prices, tables, orders and sales, cash sessions, suppliers, purchases, recipes, inventory, reports, schedules and time clock entries of staff.
• Patron information entered by the restaurant: customer name, phone number, delivery address and order notes, for phone, counter and delivery orders, including orders received from delivery platforms.
• Documents: supplier invoices and menu files uploaded for automatic reading.
• Payment information: for subscriptions and for card payments accepted from patrons, we receive from Stripe transaction references, amounts, card brand and last four digits and payout status. We never receive or store full card numbers.
• Delivery information: when a restaurant requests an on-demand courier (DoorDash Drive, Uber Direct) or connects a delivery platform, the pickup and drop-off details, courier name, phone and location updates and tracking links returned by the provider.
• Device and usage information: IP address, browser and device type, operating system, application version, pages and features used, timestamps, error logs and, for the Android app on point-of-sale devices, the printer's local network address you configure.
• Local storage: the application stores data on your device (session tokens, cached menu, preferences and, in offline mode, sales waiting to be synchronized).
• Communications: emails, messages and support requests you send us.

We do not collect precise geolocation from your device, biometric data or Social Security numbers.

4. How we use information

• Provide, operate and secure the Service, including offline synchronization, printing, kitchen display and delivery features.
• Process subscriptions, billing and card payments through Stripe, and prevent fraud and abuse.
• Provide customer support and respond to your requests.
• Send service communications (security alerts, billing notices, changes to the Service or to these terms). We send marketing emails only with your consent or as permitted by law; you can opt out at any time using the link in each email.
• Read uploaded invoices and menus automatically to pre-fill data for your review (see Section 5).
• Analyze usage in aggregated form to improve reliability and features.
• Comply with legal obligations and enforce our Terms of Service.

We do not use personal information for automated decisions that produce legal or similarly significant effects on individuals.

5. Automated invoice and menu reading

Documents you upload are processed by an AI service provider to extract line items and prices. Every extraction is shown to you for validation before anything is saved. Documents remain attached to your account only, are not shared with other customers and are not used to train AI models.

6. How we share information

We do not sell personal information and we do not share it for cross-context behavioral advertising. We share information only:

• With service providers that process it on our behalf under contracts limiting their use: hosting and infrastructure (Hostinger, servers located in France), payment processing (Stripe), transactional email (Resend), AI document reading (Anthropic), cloud printing (SUNMI) when you register a cloud printer, and website analytics on our public pages only (Google Analytics, loaded only if you accept it in the cookie banner).
• With third-party services you choose to connect: Stripe (your own connected account), DoorDash and Uber (on-demand deliveries through your own accounts), Hey! JAG Food and delivery marketplaces when you enable an integration. Their use of the information is governed by their own privacy policies.
• With your own team: staff accounts see the data their role allows.
• For legal reasons: to comply with law, subpoenas or lawful requests, to protect the rights, safety and property of Hey JAG, our customers or the public, or to enforce our Terms.
• In a business transfer: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy.

Each restaurant's data is logically isolated; a restaurant can only access its own data.

7. International transfers

Our servers and backups are hosted in the European Union (France). Information you provide from the United States is therefore transferred to and stored in the EU, and may be accessed by our staff and service providers in the United States and the EU. We protect it with contractual, technical and organizational safeguards described below, and our EU-based hosting provider is subject to EU data protection law.

8. Security and retention

We use encryption in transit (HTTPS), hashed passwords and PINs, encryption at rest for integration secrets, role-based access controls, tenant isolation, logging and monitoring, and regular backups. No system is perfectly secure; you are responsible for keeping your devices and credentials safe and for limiting staff access appropriately.

We keep personal information for as long as your account is active. After account closure, we delete Customer Data within 30 days, except for information we must keep for legal, accounting, tax or security purposes (for example subscription invoices and payment records, kept for up to 7 years) and anonymized, aggregated statistics. Offline data stored on your device is removed when you sign out.

9. Your choices and privacy rights

• Access, correction and deletion. Account holders can update most information in Settings and export their data at any time, and can request access to, correction or deletion of their personal information by emailing contact@HeyJag.com. We will verify your identity (for example by confirming your account email) before acting, and we respond within 45 days. An authorized agent may submit a request on your behalf with written permission.
• Marketing. Unsubscribe from marketing emails using the link in each email. Service emails (billing, security) cannot be opted out of while you have an account.
• Cookies and analytics. The application uses only cookies and local storage strictly necessary to operate (session, preferences, offline sales). Analytics on our public website run only if you accept them in the cookie banner; they are off by default. You can also block cookies in your browser. We honor Global Privacy Control signals as an opt-out of any sale or sharing, which we do not perform.
• Patrons and employees of a restaurant. Please contact the restaurant, which controls that data; we assist it in responding.

US state privacy rights

Depending on where you live (for example California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida and other states with privacy laws), you may have the right to know what personal information we collect, use and share, to access it in a portable format, to correct or delete it, to opt out of the sale or sharing of personal information and of targeted advertising or profiling, and not to be discriminated against for exercising these rights. Hey JAG does not sell or share personal information for targeted advertising and does not engage in profiling with legal or similarly significant effects. We may not be subject to every state law, but we honor these requests for all US users. If we deny a request, you may appeal by replying to our decision; we will respond within 45 days, and you may then contact your state attorney general.

California notice at collection. In the preceding 12 months we collected the categories of personal information listed in Section 3 (identifiers, commercial information, internet or network activity, professional or employment-related information for staff accounts, and geolocation only at the level of the business address), for the purposes in Section 4, and disclosed them to the service providers in Section 6. We do not collect sensitive personal information other than account credentials, which we use only to authenticate you. We have not sold or shared personal information in the preceding 12 months.

10. Children

The Service is intended for businesses and their adult staff. We do not knowingly collect personal information from anyone under 18, and we do not direct the Service to children under 13 (COPPA). If you believe a child has provided us personal information, contact us and we will delete it.

11. Do Not Track

Our applications do not track users across third-party websites and therefore do not respond to browser "Do Not Track" signals, except that we treat Global Privacy Control signals as described in Section 9.

12. Changes to this Policy

We may update this Policy from time to time. The current version and its effective date are shown at the top of this page. For material changes we will notify you in the application or by email before they take effect.

13. Contact us

HEY! JAG INC · 350 N Federal Hwy, Unit 715S, Boynton Beach, FL 33435, USA · contact@HeyJag.com · www.heyjag.com