Privacy Policy

[COMPANY LEGAL NAME] ("UltraSVGs", "we") provides an AI-powered business operating platform for restaurants. Contact: support@ultrasvgs.com, [POSTAL ADDRESS]. The service is offered to businesses in the United States. Use of the service is also governed by our Terms of Service.

Account information (you provide it): name, email address, phone number (optional), password (stored only as a salted hash by our authentication provider), and your role at your restaurant.

Inquiry information (you provide it): if you contact us through the form on our website before you have an account, we collect what you enter there -- your name, email address, restaurant name, and, if you choose to give them, a phone number, the number of locations you operate, and your message -- along with your browser type.

Customer business data (your restaurant provides it while using the service): vendor and contract records, invoices and documents you upload, inventory records and counts, sales and cost figures and targets, employee records (names, positions, pay rates, schedules and hours worked, tips, availability and time-off requests), tasks, team log entries, messages exchanged in team chat, and reports generated from them. This data belongs to your restaurant; we process it to provide the service. Team chat messages are visible only to the members of your restaurant who are part of the conversation, and a profile photo you add is visible to your restaurant's members. If you report a message or a person in team chat, a copy of the message, your note and both people's names go to UltraSVGs support, who review the report, and to your restaurant's owner unless the report is about them; the person reported is not told. If you block someone, your restaurant's owner can see that you did; the person blocked is not told. Uploaded documents, questions you ask our UltraAI assistant, and the business records needed to answer them or to write a summary are processed by an AI subprocessor (Amazon Bedrock) to extract fields, answer, and summarize. AI output is labeled as such, and a change it proposes takes effect only when a person confirms it.

Usage and log data (collected automatically): IP address, browser type, pages accessed, timestamps, and an audit trail of actions taken in your account. We use only strictly-necessary cookies (session authentication); we do not use advertising or cross-site tracking cookies.

To provide, secure, and improve the service; to authenticate you; to send transactional messages (invitations, alerts, receipts); to respond to support requests and to inquiries about the service; and to comply with law. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Only with the service providers that run the platform — Amazon Web Services (hosting, database, file storage, sign-in, and AI processing through Amazon Bedrock), Google Workspace (email delivery), Expo (delivery of push notifications to the mobile app) and Stripe (subscription payments) — under contracts limiting their use of the data to providing their service to us; with services your restaurant chooses to connect, such as a point-of-sale, bank or calendar account, which exchange only what that connection needs; with your restaurant's account owner and administrators, who control the account your data sits in; and where required by law. Our own staff access a restaurant's account only to operate and support the service.

The UltraSVGs mobile app collects the same categories described above, plus, only when you use the feature: photos and scans of business documents (such as contracts and invoices) that you take with the camera, choose from your photo library, or pick from your files, which are uploaded to your restaurant's account. The app asks for camera access the first time you scan or photograph a document, never accesses the camera in the background, and does not request your location. A file you pick is uploaded as it is, so a photo that already carries location information from your camera keeps it.

You can ask our UltraAI assistant a question by voice. The app asks for microphone and speech recognition access the first time you use the microphone button, and listens only while you are using it. Your speech is turned into text by your phone's own speech recognition — on the device where the phone supports it, otherwise by the phone maker's speech service (Apple's on iPhone) — and only the resulting text is sent to us, as if you had typed it. We do not receive, record or keep audio.

Session credentials are stored in the device's secure keychain/keystore and can be removed by signing out or deleting the app. The app contains no advertising SDKs, no third-party analytics, and no cross-app tracking, and does not request the iOS advertising identifier.

If you allow notifications, the app registers a push token for your device. We store it with your account and use it only to send you the notifications you have not turned off in Settings, which are delivered through Expo's push service. Signing out removes the token.

Accounts are provisioned by your restaurant's owner or manager, not created in the app. To delete your account and associated personal data, choose Settings > Delete account in the app, ask your account owner, or email support@ultrasvgs.com. We delete the account within 30 days of the request. Records your restaurant keeps for its own business, such as past schedules, remain with the restaurant.

Access, correction, deletion, export: email support@ultrasvgs.com. We honor verified requests within 30 days. For data your restaurant controls, we may redirect the request to the account owner, who administers that account. Every marketing message includes an unsubscribe link; transactional messages are sent as part of operating the service. We do not track users across third-party sites.

Data is encrypted in transit (TLS) and at rest. Access is restricted by role-based permissions and database-level row security scoped to your restaurant. We retain account and business data for as long as the account is active and for [RETENTION PERIOD] after termination to allow export, after which it is deleted. We will notify affected customers of a data breach as required by applicable state breach-notification laws.

The service is for businesses and their staff; it is not directed to children under 16, and we do not knowingly collect their information.

We will post changes here with a new effective date, and for material changes we will notify account owners by email before they take effect. Contact: [COMPANY LEGAL NAME] · [POSTAL ADDRESS] · support@ultrasvgs.com.