Restozia Privacy and Data Policy
1. About this Policy and contact
This Policy explains data processing when visiting restozia.com, signing in to workspace.restozia.com, using Restozia features and contacting support. Restozia is a service for the technical processing and analysis of restaurant and café data, also known as Restozia / Restozia.
The Service Operator is sole proprietor Tarasova I.V. (Sole proprietor registered in Ukraine — Tarasova I.V.), the Provider identified in the public offer. The Provider’s details and correspondence address appear in its “Provider details and contacts” section. Contact for privacy and data matters: [email protected].
The Operator determines the purposes of processing account, security and support-request data. For data a business uploads to its workspace, the business determines its contents, lawful grounds and authorised users; the Operator processes it to provide Service features. This does not remove the Operator’s own duties under applicable law.
2. Data used
Sign-in and operation use your email address, name, account identifiers and technical authentication information. The authentication service may also receive available basic Google profile information, including a profile image. The Service stores information about acceptance of terms, workspace membership and permissions granted.
Users may upload venue files and data: sales, purchases, prices, recipes, expenses, staff information, comments and confirmations. Workspaces store processed values, import information, corrections and price history. Data-source information, including the file name and original row number, is also stored so that the origin of a price or another value can be checked.
Browser upload uses technical transfer identifiers and document-processing events. Support processes the sender’s address, correspondence and materials supplied voluntarily.
During visits and use, Service infrastructure may process technical connection, request and error information to deliver pages and prevent abuse. Provide only data needed for operation. Do not upload passwords, CVV codes, full payment-card details or unnecessary personal information.
3. Google sign-in
Restozia uses Google to verify identity at sign-in and Supabase for authentication and workspace access. The configured flow requests basic profile information and email. Google data is used to identify users, create and maintain their accounts, display their names, manage access and protect sessions.
This sign-in flow does not request access to Gmail messages, Google Drive files, calendars or contacts. Restozia does not receive your Google password: it is entered on Google’s side. Sign-in data is not sold or used for advertising profiling.
You can remove the Google sign-in connection to Restozia in your Google account settings. This does not delete Restozia data or automatically end a workspace session that is already open. Contact [email protected] about the processing of your data. A request does not mean automatic or immediate deletion of your account or all venue data.
4. Purposes and grounds for processing
Data is used for sign-in and access management, providing selected features, importing and checking documents, calculations based on supplied sources, user support, security and compliance with mandatory legal requirements. The Operator does not sell personal data or disclose it for third parties’ own marketing.
Depending on the data and applicable law, processing relies on steps requested by a user before entering into a contract and performance of a contract, legal obligations, appropriately justified legitimate interests in security and protection of rights, or consent where required. Acceptance of this Policy is not consent to advertising, automatic charges or unlimited use of data.
5. Files and browser upload
A file selected in the workspace is transmitted for technical processing; this does not mean it is processed only in the browser or never reaches a server. Further storage depends on the feature: extracted data, import information and source references may be retained.
Originals selected and uploaded by the user in the browser are stored in a private incoming area for processing, review and retries. Selecting a folder transfers selected files, not access to all computer files. The folder is not watched after the tab closes.
Restozia is not a permanent archive of original documents. Automatic deletion of originals based on a retention period is not currently enabled. Before it is enabled, retention periods and the consequences of deletion will be separately defined and communicated to users.
Deleting a server-side original does not delete extracted values, drafts, confirmed data, price history or the file on the user’s computer. Reopening or recognising a deleted original requires another upload. Keep your own original documents; recognised values need checking before confirmation.
6. Access and technical providers
Access to venue data is limited to members of the relevant workspace according to their permissions. Authorised technical personnel may have access necessary for support, security and recovery; the statement “only the user has access” does not apply to infrastructure administration.
Third-party technical providers are engaged for sign-in, data storage, website operation, protection and support correspondence. They may process data needed for their respective functions; this does not mean that every provider receives all venue data.
Providers used: Google — sign-in; Supabase — accounts and data; Hostpro and Cloudflare — website operation and protection; Zoho Mail — support email.
Using international providers may involve processing outside the user’s country. The main database region does not guarantee that all technical data is processed in one country only. Such processing is subject to the necessary legal requirements and the respective providers’ contractual terms. Data may be disclosed to competent authorities where legally required.
7. Retention and security
Account and workspace data is retained while the Service is used and afterwards only to the extent necessary for specified purposes, legal obligations and protection of rights. Retention of uploaded originals is described separately above. Ending access or a subscription does not itself delete data.
Deletion from the active workspace does not mean immediate erasure from every technical log and backup. Information may be retained to a limited extent where necessary for recovery, security, legal obligations or resolving a dispute; it must not be used for other incompatible purposes.
Access control, workspace separation and encrypted connections are used. Absolute security is not guaranteed. Users must protect their sign-in method, grant access only to authorised persons and report suspected unauthorised access to support. Originals uploaded in the browser may be stored separately from workspace rows in private storage. Deleting a document, business or account does not itself confirm removal of all these copies. To request removal of originals, contact [email protected]. Deletion from active systems does not mean immediate erasure from logs or backups; complete erasure from all provider backups is not guaranteed.
8. Technical browser storage
Technical session and browser-storage mechanisms may be used for the interface and sign-in. For example, the offer page saves the selected appearance theme in browser local storage. This does not constitute permission for advertising tracking. Restricting technical browser storage may affect certain features.
9. Your rights and requests
Under applicable law, you may request information about processing of your personal data, access, correction of inaccurate data, deletion where grounds exist, objection to or restriction of processing, and withdrawal of consent where consent is the processing ground. Other statutory rights are preserved. You may complain to the competent data-protection authority or a court.
Write to [email protected] from your account email address and describe your request. Proportionate verification of identity and business authority may be needed to prevent unauthorised access. Do not send passwords or full payment details. The presence or absence of an interface button does not remove statutory rights. Requests are handled according to mandatory legal deadlines and requirements; this Policy sets no additional voluntary deadline.
10. Adult users and changes
The Service is intended for adult users and authorised business representatives. Users must have lawful grounds for supplying other people’s data. This does not release the Operator from its own data-protection duties.
Material changes to this Policy are communicated to users before taking effect; new consent is requested separately where needed. The current version must be available on the website and in the workspace. Mandatory rights and safeguards under applicable law are not limited by this Policy.