Privacy

What we collect, and what we do with it.

Last revised: 14 October 2026

This policy explains what Servatto collects, why, who else handles it, and what you can ask us to do about it. It is written plainly on purpose. If anything here is unclear, email [email protected] and we will explain it.

1. Who we are

Servatto is software for cafés and restaurants, operated by RS Foundations Pty Ltd (ABN 64 653 653 939), a company registered in Victoria, Australia. In this policy "we", "us" and "Servatto" mean that company. A "business" means a business that holds a Servatto account.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy covers servatto.com, app.servatto.com and the Servatto apps (Register, Kitchen, Kiosk, Screen, Back Office, Manager, Crew and Rewards). The Crew app notice and the Kiosk app notice add detail for those apps.

2. Two roles: our own customers, and theirs

For the people who sign up for and run a Servatto account, we decide what we collect and why. For a business's staff and its customers, we collect and store information on that business's behalf and on its instructions, as its service provider. The business decides what it collects about its staff and customers and what it does with it, and is responsible for telling them. If you are a café's customer or employee, the café is usually the best first contact — but you can always contact us too (section 10).

3. What we collect

People who run a Servatto account

• Your name, email address and a password. The password is never stored in a readable form — it is hashed (scrypt, with a unique salt).
• Your business name, the shops you add (name, address, timezone and map location), and which products you switch on at each one.
• One-time sign-in codes we email you, and, if you tick "trust this browser", a signed cookie so we ask for a code less often.
• The details you give us to connect other services — the access tokens for your Square connection, the email and password for your Otter account, and the secret for an outside rewards provider. These are encrypted before they are stored (section 8). A Zeller terminal is paired on your own device; we do not hold Zeller sign-in details.
• A record of significant actions in your account (who changed what, and when), so an owner can see it.
• Anything you send us by email.

A business's staff

• Name, mobile number, job title, which shops they work at, what they are allowed to do on the till, and the pay rate the business enters.
• Till PINs. The server keeps only a one-way check of each PIN, never the PIN itself.
• Rosters, clock-ins, breaks, timecards, leave and availability, and requests such as shift swaps.
• In the Crew app: sign-in by a code texted to their mobile; team chat messages; checklist entries, including photos taken for a checklist; stock orders; and a push notification token for their phone.
• Location, from the Crew app, only at the moment someone clocks in or out or starts or ends a break, and only to check they are at the shop. We store the distance from the shop with the clock event, not the location itself, and the app does not track anyone in the background.

A business's customers

• Orders from the till, the kiosk, phone orders, the business's own website or app, Square and delivery platforms: items, notes, times, order numbers, amounts, how it was paid, and the customer's name where one is given.
• Phone numbers, where a customer gives one for a phone order, an SMS receipt or Rewards, or where a delivery platform includes one. Delivery orders can also include the courier's name and a contact number the platform provides.
• Email addresses, where a customer asks for an e-receipt or gives one to Rewards.
• Rewards members: mobile number, name, email and birthday if given, points, visits, spend, vouchers, favourite items, order ratings, and whether — and when and where — they agreed to receive marketing messages.
• Opt-outs: numbers that have replied STOP, so we do not text them again.

We do not receive or store full card numbers or security codes. Card payments are handled by the business's own Square or Zeller account; we keep what those services report back, such as the payment status, a transaction reference, the card brand and a masked card number. The customer screen shows first names or order numbers only.

Billing information

Subscriptions are paid through Stripe. Card numbers are entered on Stripe's own pages and never reach our servers. We keep what Stripe tells us: subscription status, trial dates and the identifiers we need to match payments to your account. Stripe holds the billing name, address, ABN, card details and invoices.

Devices and technical information

• For each paired tablet, till or TV: its name, the shop it belongs to, the app version and a pairing credential.
• Push notification tokens for the Manager and Crew apps.
• Server logs — IP address, browser or device type, the address requested and the time — kept for security, to limit abuse such as repeated sign-in attempts, and to find faults.

4. Why we use it

• To run the service: put orders on the till, kitchen screen and TV, take payments through the business's payment provider, print tickets and receipts, run rosters and timecards, and keep Rewards balances.
• To send messages the business has switched on: texts confirming a phone order and saying it is ready, SMS and email receipts, Google review requests, roster notices, Crew invitations and sign-in codes, and push notifications.
• To create and secure accounts, and to support and fix problems when asked.
• To bill businesses, send trial reminders, and chase failed payments.
• To meet our legal and tax obligations.

We do not sell personal information, we do not share it for anyone else's marketing, we do not send marketing to a business's customers on our own account, and we do not use any business's data to train models or to build anything for another business.

Review request texts go only to Rewards members recorded as having agreed to messages, no more than once a month per number, and each one says how to opt out. A business must switch this on for each shop.

5. Who else handles it

We use these service providers. Each only gets what it needs to do its job.

• DigitalOcean — our servers and database, in its Sydney region. Photos and files uploaded to Servatto are stored in the same database.
• Cloudflare — the servatto.com website, network protection and performance measurement. See Cloudflare Web Analytics.
• Stripe — subscription payments, invoices and the billing portal.
• Twilio — sending text messages: the mobile number and the message.
• Our email provider — sending sign-in codes, invitations, trial reminders and e-receipts.
• Apple and Google (Firebase Cloud Messaging) — delivering push notifications to iPhones and Android phones: a device token and the notification text.
• Google — finding a shop's Google listing (from the shop's name and address) so review requests link to it.
• Whapi — sending WhatsApp messages, such as stock orders to suppliers and shop groups, where the business switches this on.
• Square, Zeller and Otter — the business's own accounts, connected at its request. Orders, payments and menus pass between them and Servatto. Each is responsible for the information it holds under its own privacy policy.
• A business's own rewards provider, website or app — where the business connects one, Rewards information passes to and from it.
• GitHub — hosts the Android app files that tablets download when they install or update. Downloading one shares the device's IP address with GitHub.

We will also disclose information if the law requires it, or where it is needed to protect someone's safety or our legal rights. Our own staff access a business's data only to support it or fix a fault.

6. Information that leaves Australia

Our database and servers are in Sydney. Some of the providers above are based overseas or may handle information outside Australia, including in the United States: Stripe, Twilio, Cloudflare, Apple, Google, GitHub, Square, Zeller, Otter, Whapi and our email provider. Before we disclose personal information to an overseas recipient, we take reasonable steps to make sure it handles that information consistently with the Australian Privacy Principles, as APP 8 requires — through its contract and privacy terms with us, and by sending it only what it needs.

7. How long we keep it

• Account and order records — while the account is open, because that is what reports are built from. When a business asks us to close its account, we delete its data within 90 days of the request.
• Timecards and pay records — for as long as the business needs them to meet Australian record-keeping rules (generally seven years), or until the business closes its account.
• Invoices and payment records — seven years, as Australian tax law requires.
• Sign-in codes — a day at most. Server logs — for a limited period, for security.
• Crew data — as described in the Crew app notice. Staff can ask for their details to be deleted when they leave.
• Rewards members — until the member or the business asks for them to be removed, or the business closes its account.

8. Security

Every record is tied to a business, and a request for anything that does not belong to the signed-in business is refused. Everything travels over encrypted connections, and the database connection is verified. Passwords are hashed with scrypt; till PINs, session tokens and menu API keys are stored only as one-way checks. The credentials a business gives us for Square, Otter or a rewards provider are encrypted at rest (AES-256-GCM) with a key that is kept apart from the database. Card numbers never reach us.

No system is perfect. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires, and we will tell any business whose staff or customers are affected.

9. Cookies

We use a small number of cookies, all needed for the service to work, and none for advertising or tracking:

• a sign-in cookie, so you stay signed in to Back Office;
• a "trusted browser" cookie, if you choose it, so you are asked for a sign-in code once a month on that browser; and
• a device cookie for a till running in Chrome or a kitchen screen, so it stays paired to its shop.

The apps also keep settings and their pairing on the device. The website uses Cloudflare delivery, security and performance measurement, including its analytics beacon. We do not use advertising trackers, third-party analytics, pixels or session recording in the apps.

10. Your rights

• See it. Ask us for a copy of the personal information we hold about you.
• Fix it. Tell us if something is wrong and we will correct it.
• Delete it. Ask us to remove your information, subject to the records we or the business must keep by law. Account holders can also ask to delete their account from the Manager app.
• Take it with you. Businesses can export their customer list and timecards from Back Office, and ask us for their order history as a file.
• Stop messages. Reply STOP to a review request text, or ask the business or us.
• Complain. If you think we have mishandled your information, email us first — we take it seriously and will reply within 30 days.

Email [email protected] for any of these. If your information was collected by a business that uses Servatto, we may pass your request to that business, or check with it, because it decides what happens to that information. You can deal with us anonymously or by a pseudonym where that is practical, but we will need enough to find your records. If you are not satisfied with how we handle a complaint, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

11. Children

Servatto is a tool for businesses. It is not directed at children. A business's customers may include young people; the business is responsible for what it collects about them.

12. Changes

If we change this policy we will update the date at the top, and for anything significant we will email account owners before it takes effect.

13. Contact