Privacy

What we collect, and what we do with it.

Last updated 13 September 2026

This policy explains what Servatto collects, why, and what you can ask us to do about it. It is written plainly on purpose. If anything here is unclear, email [email protected] and we will explain it.

1. Who we are

Servatto is kitchen software for restaurants, operated by RS Foundations Pty Ltd (ABN 64 653 653 939), a company registered in Victoria, Australia. In this policy "we", "us" and "Servatto" mean that company. "You" means the business that holds a Servatto account, and the people who use it.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. What we collect

Information you give us

• Your name, your business name, your email address and a password. The password is never stored in a readable form.
• The shops (venues) you add, and which products you switch on at each one.
• The sign-in details you give us for your delivery order manager, so we can read your orders. These are encrypted before they are stored and are only ever used to fetch your own orders.
• Anything you send us by email.

Information that arrives with your orders

When you connect Square or your delivery accounts, order information flows into Servatto so it can appear on your kitchen screen. That includes items, quantities, notes, order times, order numbers, the platform the order came from, and the customer's first name where the platform provides it.

We do not receive or store your customers' card numbers, addresses or phone numbers, and the customer waiting screen shows first names only — never a surname and never what someone ordered.

Payment information

Card payments are handled entirely by Stripe. Card numbers are entered on Stripe's own pages and never reach our servers. We keep only what Stripe tells us: your subscription status, the last four digits and card brand, and your invoices.

Technical information

• A sign-in cookie, so you stay signed in. It is not used for tracking or advertising.
• Server logs — IP address, browser type, page or endpoint requested, time — kept for security and fault-finding.
• A record of significant actions in your account, so an owner can see who changed what.

We do not use advertising trackers, third-party analytics pixels or session recording on this website or in the app.

3. Why we use it

• To show your orders on your screens and print your tickets.
• To create and run your account, and to keep it secure.
• To bill you, chase failed payments and issue invoices.
• To answer you when you ask for help.
• To find and fix faults, and to keep the service standing up.
• To meet our legal and tax obligations.

We do not sell personal information, we do not share it for anyone else's marketing, and we do not use your order data to train models or to build anything we sell to another restaurant.

4. Who else touches it

We use a small number of service providers. Each one only gets what it needs to do its job.

• DigitalOcean — hosting and the database. Your data sits in their Sydney region.
• Cloudflare — this website and its network protection.
• Stripe — payments, invoices and the billing portal. Stripe is its own data controller for payment data.
• Square and your delivery order manager — the sources your orders come from. You authorise those connections yourself and can disconnect them at any time.
• Apple iCloud Mail — the mailbox behind [email protected].

Some of these providers operate overseas, so information may be handled outside Australia. We only use providers who are held to comparable privacy and security obligations.

We will also disclose information if the law requires it, or where it is needed to protect someone's safety or our legal rights.

5. Where it is kept, and for how long

Your account data and order records are stored in Australia (Sydney). Everything travels over encrypted connections. Passwords are hashed, and any credentials you give us for a third-party service are encrypted at rest with a key that is never stored beside the data.

We keep order records for as long as your account is open, because that is what your reports are built from. When you close your account we delete your account data within 90 days, except records we must keep for tax and accounting — invoices and payment records — which we keep for seven years as Australian law requires.

6. Your rights

• See it. Ask us for a copy of the personal information we hold about you.
• Fix it. Tell us if something is wrong and we will correct it.
• Delete it. Close your account and ask us to remove your data, subject to the records we must keep by law.
• Take it with you. Ask for your order history as a file.
• Complain. If you think we have mishandled your information, email us first — we take it seriously and will reply within 30 days.

Email [email protected] for any of these. If you are not satisfied with how we handle a complaint, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au.

7. Your own customers

Where Servatto handles information about your customers, we do it on your instructions, as your service provider. You remain responsible for telling your customers how their information is used. We will not contact your customers ourselves.

8. Security

Access to your data is limited to your own account. Every record is tied to your business, and a request that does not belong to you is refused. Access by our staff is limited to what is needed to support you or fix a fault. No system is perfect — if a breach ever affects you, we will tell you and the Commissioner as the Notifiable Data Breaches scheme requires.

9. Children

Servatto is a tool for businesses. It is not intended for anyone under 16 and we do not knowingly collect their information.

10. Changes

If we change this policy we will update the date at the top, and for anything significant we will email account owners before it takes effect.

11. Contact