Privacy Policy

Who we are and what this policy covers

Restaurant POS Studio is a trading name of SOHOON Technologies (“we”, “us”, “our”). We run this website and a hosted point-of-sale service for independent restaurants in the United States, the United Arab Emirates and Pakistan.

This policy covers two different kinds of personal information:

• Website data. Information about people who visit this website, fill in our contact or demo form, or start a free trial.
• Service data. Information that a restaurant (our customer, the “merchant”) puts into the POS, such as products, customers, sales and staff records.

We handle these two kinds of data in different roles, so we explain them separately below. If you have a question about this policy, contact us through the form on our contact page or the “Show email” button on that page.

What we collect on the website

When you fill in the contact or demo form, we collect what you type: your name, restaurant name, email address, phone or WhatsApp number, country, city, preferred language, number of seats, number of locations, your current POS and your message. The form also records the page you sent it from and any campaign parameters in the link you followed. These are the utm_* tags and click identifiers such as gclid, fbclid and msclkid. They tell us which advert, post or partner sent you, so we know what is working.

When you browse, our hosting and content delivery provider (Cloudflare) processes technical data that every website needs to work: your IP address, browser type, the page requested and the time. This is used to deliver the page and to protect the site from attacks.

Only if you agree in the cookie banner, we use Google Analytics 4 to measure visits: which pages are read, roughly where visitors come from and what device they use. If you do not agree, Google Analytics does not load.

Settings you choose on the site, such as light or dark theme, country and currency, monthly or annual pricing, and accessibility settings, are saved in your own browser. They are not sent to us. Our cookie policy lists every item by name.

We do not run advertising pixels from social networks or ad networks on this website today. If that changes, we will update this policy and ask for consent first where the law requires it.

How we use website data and why

We use website data to:

• reply to your enquiry, book and run your demo, and set up your trial;
• understand which pages, campaigns and partners bring restaurant owners to us;
• keep the site and the form secure and free of spam;
• meet legal, tax and accounting obligations.

Where a legal basis is required, we rely on your consent (for analytics and for marketing messages), on steps you ask us to take before a contract (answering your demo request), on our legitimate interest in running and protecting a business website, and on legal obligations.

We do not use your form details to build advertising profiles. We do not make decisions about you using automated processing that has legal or similarly significant effects.

Who receives website data

We use a small number of service providers. Each one receives only what it needs:

• GoHighLevel (CRM). Form submissions are stored in our customer relationship system so our team can follow up.
• Discord (team notifications). A short notice of each new enquiry is posted to a private team channel so someone replies quickly.
• Cloudflare (hosting, content delivery and Turnstile). Cloudflare serves the website and runs Turnstile, a check that tells people from spam bots before the form is sent.
• Google (Analytics 4). Only after you consent.

We may also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of the business, in which case the buyer must respect this policy.

We do not sell or share personal information

We do not sell personal information. We do not “share” personal information for cross-context behavioral advertising, as those words are used in California law. We have not done either in the past 12 months. Because we do not sell or share, there is no “Do Not Sell or Share” switch to turn off, but you can still contact us with any request described on our data request page.

Data inside the POS service

When a restaurant uses Restaurant POS Studio, it adds products, prices, customers, sales, bookings, staff and attendance records. For this data:

• The restaurant is in charge. The merchant is the “controller” or “business”. It decides what is collected and why.
• We act on its instructions. We are the “processor” or “service provider”. We process the data on our own servers only to provide the service, support the merchant and keep the service secure.
• We do not use merchant data for our own marketing and we do not sell it.
• Backups. We take daily backups of the service.
• Export. The merchant can export products, customers and sales to spreadsheets at any time.
• Card data stays with the merchant’s card processor. When a restaurant takes cards through its processor or acquiring bank, the full card number is handled by that processor, not stored on our servers.

If you are a diner or employee of a restaurant that uses our POS and you want to see or delete your data, please contact the restaurant first. It controls that data. We will help the restaurant respond.

How long we keep data

• Enquiries and trial sign-ups are kept while we are in contact with you and for up to 24 months after the last contact, then deleted or anonymized, unless you become a customer.
• Customer account and billing records are kept for as long as the account is open and then for the period tax and accounting law requires.
• Service data after cancellation. The account stays readable for 30 days so the merchant can export everything. We then delete it within a further 60 days, except where the law requires us to keep specific records.
• Analytics data is kept in Google Analytics for the retention period set in our account, which is no longer than 14 months.
• Browser storage stays in your browser until it expires or you clear it.

How we protect data

We use encrypted connections (HTTPS) for the website and the service, access controls that limit staff access to people who need it, spam and bot protection on forms, and daily backups. No system is perfectly secure. If we become aware of a breach that affects your personal information, we will notify you and the authorities where the law requires.

We do not claim any security certification for the service.

International transfers

We serve restaurants in the USA, UAE and Pakistan, and our service providers operate in several countries. Your information may therefore be processed outside the country where you live. Where the law requires it, we use contractual or other safeguards for these transfers.

Your rights in the United States

California residents have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). You may ask us to tell you what personal information we have collected about you, give you a copy, correct it, or delete it. You may also limit use of sensitive personal information, although we do not use any for purposes that require that right. We will not treat you differently for using these rights.

Residents of other states with privacy laws, such as Virginia, Colorado, Connecticut and Texas, have similar rights: to confirm whether we process your data, to access, correct and delete it, to get a portable copy, and to opt out of targeted advertising, sale and certain profiling. We do not sell data or use it for targeted advertising. If we refuse a request, you may appeal.

The categories of personal information we collect in the past 12 months are identifiers (name, email, phone), commercial information (restaurant details, plan interest), internet activity (pages viewed, campaign parameters, analytics after consent) and approximate location (country and city you give us).

Your rights in the UAE and Pakistan

UAE. Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you may ask for information about the processing of your data, access it, correct it, request deletion, restrict or stop processing in certain cases, and object to processing for direct marketing.

Pakistan. We follow the Prevention of Electronic Crimes Act 2016, which protects against unauthorized access to and misuse of data. A national personal data protection law has been proposed but is not yet in force. We will give Pakistani users the same access, correction and deletion options we give everyone else.

How to use your rights

Follow the steps on our data request page, or contact us through the form on our contact page or the “Show email” button. We will verify your identity before acting. Most requests are answered within 30 days. California requests are answered within 45 days, which the law allows us to extend once when needed.

Marketing messages

If you agree, we may send you updates about the product by email, SMS or WhatsApp. Every message tells you how to stop. You can also ask us through the contact form to stop all marketing at any time.

Children

This website and the service are made for restaurant businesses. They are not directed to anyone under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has sent us information, contact us and we will delete it.

Changes to this policy

We may update this policy when our practices or the law change. The date at the top shows the latest version. If a change is significant, we will show a notice on the website or tell customers inside the service before it takes effect.