1. Introduction

BistroOS ("we," "us," or "our") is operated by Hue Ky Company ("Hue Ky"), a company headquartered at 9719 Bolsa Ave, Westminster, CA 92683. This Privacy Policy explains how we collect, use, and protect information when you use the BistroOS platform, including our website, mobile ordering pages, and in-store kiosk interfaces.

By accessing or using BistroOS, you agree to the practices described in this policy. If you do not agree, please discontinue use of the platform.

2. Information We Collect

2.1 Order Information

When you place an order through BistroOS, we collect:

• Name (optional)
• Phone number (optional)
• Table number
• Order items and special requests
• Order total and payment method

2.2 Payment Information

Online payments are processed through Stripe. We do not store your full credit card number, CVV, or expiration date on our servers. Stripe handles all card data using PCI-DSS compliant tokenization.

In-store payments processed through the PAX A920 Pro terminal are handled entirely by the payment terminal and its payment processor. No card data is transmitted to or stored by BistroOS.

2.3 Device and Usage Information

We automatically collect:

• Browser type and version
• Device type (mobile, tablet, desktop)
• Pages visited and time spent
• IP address (used for security and geographic targeting only)

2.4 Cookies

BistroOS uses the following cookies:

• Session cookies — Required for authentication and order management.
• Table verification cookies — Cryptographically signed cookies used to verify that an order originated from a legitimate table visit. These cookies contain no personal data and are short-lived.

3. How We Use Your Information

We use the information we collect to:

• Process and fulfill your food orders
• Display real-time order status updates
• Send payment confirmations and receipts
• Improve the platform and user experience
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Data Storage and Security

All data is stored in Supabase, a cloud-hosted PostgreSQL database with row-level security enabled. Data is encrypted in transit (TLS 1.3) and at rest. We implement industry-standard security measures including role-based access control and tenant-level data isolation.

Our infrastructure is hosted on secure cloud servers located in the United States.

5. Third-Party Services

BistroOS integrates with the following third-party services:

• Stripe — Payment processing. Stripe Privacy Policy
• Supabase — Database hosting and real-time data synchronization. Supabase Privacy Policy
• PAX Technology — In-store payment terminal hardware. PAX Privacy Policy

These services have their own privacy policies. We encourage you to review them.

6. Data Retention

Order data is retained indefinitely for business and accounting purposes. If you wish to request deletion of your personal information, please contact us using the information below. We will respond to verified deletion requests within 30 days.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data
• Opt out of non-essential data collection

To exercise these rights, contact us at the details provided below.

8. Children's Privacy

BistroOS is not intended for use by children under the age of 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of BistroOS after changes are posted constitutes acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy, please contact:

Hue Ky Company
9719 Bolsa Ave, Westminster, CA 92683
Phone: 657-666-1268