Privacy Policy

1. Who this policy covers

This policy applies to the Jobtap website, application and related support services (the Service). The Service is operated by Manuel Moreno Aguilar, a sole trader registered in New Zealand (NZBN 9429053749222) (“Jobtap”, “we”, “us” or “our”).

We handle personal information under New Zealand’s Privacy Act 2020 and its information privacy principles. A restaurant or hospitality group using Jobtap is responsible for the information it chooses to add and for managing access for its team.

2. Information we collect

Account and team information

• Name, work email, account identifiers and authentication data.
• Business, site, job role, permissions and invitation status.
• Support messages and communications with us.

Kitchen and business information

• Recipes, methods, photographs, food bibles, plating standards, allergen declarations and acknowledgement records.
• Ingredients, supplier details, invoices, purchase prices, menus, sales reports, food costs, prep boards and stocktakes.
• Uploaded PDFs, images and spreadsheets and the information extracted from them.

Technical information

• Device, browser, IP address, login, security and application event information.
• Feature usage, error and performance data used to secure and improve the Service.

Google Play purchase information

• Product ID, Google Play order ID, purchase token, purchase time, test-purchase status, consumption status and refund or chargeback status for scan-pack purchases.
• We do not receive or store your full payment-card details. Google Play processes the payment.

3. How information reaches us

We usually collect information directly from you when you create an account, use the Service, upload a file or contact us. We may also receive information indirectly from:

• your employer or restaurant administrator when they invite you or manage your access;
• documents uploaded by authorised users, such as supplier invoices or staff acknowledgement records; and
• integrations you or your organisation choose to connect in the future.

Where the Privacy Act requires us to notify you about personal information collected indirectly, we will take reasonable steps to do so unless an applicable exception applies.

4. Why we use information

We use information where reasonably necessary to:

• provide, maintain and secure accounts and restaurant workspaces;
• control role-based access across businesses and restaurant sites;
• store recipes and standards and calculate food costs, yields, margins, stock values and operational alerts;
• extract draft information from documents at a user’s request;
• send service, security, invitation and account communications;
• provide support, troubleshoot errors and prevent misuse;
• improve the Service using aggregated or de-identified insights; and
• meet legal, tax, security and dispute-resolution obligations.

We do not sell personal information. We do not use a restaurant’s recipes, supplier prices or uploaded documents to advertise another business’s products.

5. AI-assisted extraction

When an authorised user chooses a scanning feature, relevant files and instructions may be sent to an AI service provider to create a draft extraction. We use that output only to provide the requested feature, operate the Service and address security or support issues.

AI output can be incomplete or wrong. Jobtap requires a user to review important information—particularly quantities, pack sizes, prices, allergens and tax treatment—before relying on or approving it.

6. Who we share information with

We may share information only as reasonably required with:

• authorised users within the same customer business, subject to their role and site permissions;
• hosting, database, authentication and storage providers, including Vercel and Supabase;
• AI processing providers, including OpenAI, when a scanning feature is deliberately used;
• Google Play, which processes Android scan-pack payments and sends us the purchase and refund information needed to provide credits;
• email, monitoring or analytics providers when those services are enabled;
• professional advisers, insurers or a purchaser of our business, subject to appropriate confidentiality protections; and
• regulators, courts or law-enforcement bodies where required or permitted by law.

Our service providers may process information outside New Zealand. Where personal information is disclosed overseas, we take reasonable steps required by Privacy Principle 12 to ensure appropriate privacy safeguards or another lawful basis applies.

7. Security and recipe confidentiality

We use access controls, authenticated accounts, tenant separation, encrypted network connections and managed infrastructure intended to protect information. Access inside a customer workspace is determined by the permissions selected by that customer’s authorised administrators.

No online system is completely risk-free. Customers should use strong unique passwords, remove departed team members promptly, grant only the access each person needs and contact us immediately about suspected unauthorised access.

8. Retention and deletion

We keep personal information for as long as it is reasonably needed to provide the Service, comply with law, resolve disputes and maintain security and audit records. The Owner of a restaurant workspace may remove users and operational records using available account tools.

When the Owner asks us to delete a workspace, or asks us to close the account, we delete its Customer Content and associated personal information. We normally verify and complete a deletion request within 30 days. Residual copies may remain in encrypted backups until they cycle out. We may retain limited records where legally required or necessary to establish, exercise or defend a legal claim. See the account deletion instructions to make a request.

9. Cookies and local storage

The Service uses essential browser storage and similar technologies to keep users signed in, remember settings such as location and theme, and protect the Service. We also use Google Analytics on this website to count visits and see which pages are used. It records the page address (without sign-in codes or invitation links), the type of device and browser, and the approximate location of the visit. It does not receive recipes, kitchen records or your account details, and we have turned off Google’s advertising features. If we introduce advertising technologies, we will provide any notice or choice required by law.

10. Access, correction and complaints

You may ask for access to or correction of personal information we hold about you. We may need to verify your identity and may withhold information only where the Privacy Act permits.

Email hello@mmios.dev with “Privacy request” in the subject. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner.

11. Privacy breaches

We investigate suspected privacy breaches and will notify affected people and the Office of the Privacy Commissioner when the Privacy Act requires it. Customers must promptly tell us if they become aware of compromised credentials or unauthorised workspace access.

12. Changes to this policy

We may update this policy as the Service or law changes. We will post the revised version here and, where a change is material, provide reasonable notice through the Service or by email.