Privacy Policy

This Privacy Policy explains how Vitabyte, Inc., a New York corporation with its principal office at 3525 30th Ave, Suite 306, Astoria, NY 11103 ("Vitabyte", "we", "us" or "our"), handles personal information in connection with the following products (together, the "Services"):

• Translink, our hub: Vitabyte ID sign-in, the payments portal for merchants, payment offices and agents, residuals, accounting, and the developer API;
• VITAPOS, our point-of-sale system: the Android till app, kitchen displays and the web back office;
• VitaRemote, our remote management product: agents installed on Windows, macOS, Linux and Android devices, and the web console;
• VITABYTE CRM;
• Angie and Angie Eats: guest online ordering and an AI restaurant assistant;
• F&B inventory: stock, purchasing and recipe tools for food and beverage businesses.

Some portals are presented under the name of a payment office, reseller or venue that works with us. This policy still applies to the personal information our Services hold for them. The organization whose name you see may also have its own privacy notice.

This policy does not cover the separate services of payment processors, banks, card networks or third-party apps that a customer chooses to connect. Their own policies apply to them.

Vitabyte is a software company. We are not a bank, a payment processor or a money transmitter. Payments made through the Services are processed and settled by the customer's chosen payment processor under that processor's agreements.

We handle personal information in two different capacities. Which one applies decides who answers your questions and requests.

When we act as a processor, we handle the information only on the customer's documented instructions and under our Data Processing Addendum. If you are a guest, an employee of one of our customers, or a person whose device is managed by one of our customers, the customer is usually the right first contact for questions and requests. If you contact us, we will pass your request to the customer and help it respond.

Account and identity (all Services)

• name, username, business email address, phone number, job title, role, and the businesses, locations and devices the account may see;
• Vitabyte ID sign-in information: password (stored only as a one-way hash), multi-factor and passkey settings, trusted devices, single sign-on links to providers such as Google or Microsoft, and the network address, time and browser of sign-ins;
• a record of the actions taken in the Services, kept in an audit trail;
• billing contacts and the products and plans an organization uses.

Merchants applying for an account (Translink)

When a business applies through our website or a partner's website, the application can include:

• business details: legal and trading name, address, contact details, business type, and expected volumes;
• details of up to four owners: name, contact details, date of birth and Social Security number;
• the business's federal tax ID (EIN) and the bank routing and account number for settlement;
• documents the applicant uploads, such as bank statements, voided checks and identity documents.

Social Security numbers, tax IDs, dates of birth and bank account numbers are encrypted separately from the rest of the application. The sender's network address is kept only as a one-way keyed hash.

Payments portal, residuals and accounting (Translink)

• merchant profiles, transactions, deposits, fees, disputes, statements, invoices, contracts and signatures, as entered by users or reported by the customer's processors;
• residual and commission figures for payment offices and agents;
• accounting records, including payees and payroll exports a customer creates;
• for developers: API keys (shown once and then stored only in a protected form), the applications registered, and logs of API requests.

Point of sale (VITAPOS)

On behalf of the venue:

• orders, checks, items, discounts, voids, refunds, tips and the payment record, including the card brand and last four digits, and the processor's reference or token;
• guest contact details given for an order, receipt, booking or delivery;
• devices, printers and kitchen displays registered to the venue, and their technical logs.

Employees and job applicants of our customers (VITAPOS and Translink labor tools)

When a customer uses our labor, scheduling and tip tools, we hold on the customer's behalf:

• profile details: name, email, phone, address, date of birth, preferred language, and certification expiry dates such as food-handler or alcohol-service cards;
• hiring records the employer collects through us: application details, résumés, tax and eligibility forms (such as W-4 and I-9), direct-deposit details and electronic signatures, which are encrypted;
• work records: schedules, clock-in and clock-out times, breaks, jobs, pay rates, tips, tip-pool shares, corrections and acknowledgments;
• a till PIN, stored only as a one-way digest;
• a photo or credential check at clock-in, only where the employer turns that on.

We do not track employees' location for clock-in.

Guests and diners (VITAPOS, Angie Eats, payment pages)

When you order from or pay a venue that uses our Services, the venue may hold through us:

• your order, check, tip and payment record, including card brand and last four digits, never the full card number;
• contact details you give for an order, receipt, booking or delivery: name, phone, email, delivery address and instructions;
• if the venue keeps a customer list: your name, contact details, visits, loyalty reference, birthday, and preferences such as dietary notes, and the marketing consents you have given or withdrawn;
• if you call a venue that uses caller ID or an automated phone assistant: your phone number, the caller-ID name, your order, and what you say to the assistant, converted to text. Remembering a caller's past orders is off unless the venue turns it on;
• text-message consents and opt-outs (STOP and START);
• gift cards, memberships and wallet passes you hold, and the device token your phone's wallet uses to receive updates.

When you open a payment link, we record that it was opened and when.

Conversations with Angie and Chat (AI features)

• the questions you type or speak to Angie, our in-portal assistant (Chat) or set-up assistance, and the answers given;
• files you attach to a conversation;
• for guests talking with Angie on a venue's page: the conversation, the venue, and any order it leads to.

Angie and Chat answer only from data the person asking is permitted to see. Guest conversations are held for the venue as its processor. See "AI features" below.

Managed devices (VitaRemote)

When a customer installs the VitaRemote agent on a device it manages, we collect on the customer's behalf:

• device inventory: device name, manufacturer, model, serial number, operating system and version, installed software and versions, hardware components, network adapters and addresses, and the signed-in user name;
• telemetry: processor, memory and disk use, uptime, battery and health status, security status such as disk encryption and antivirus state, and agent events;
• remote sessions: who started a session, when, on which device, and how long it lasted. Where the customer turns on session recording, the recording is also kept;
• commands and scripts: commands a technician runs, their output, files transferred and the result.

A remote session can show whatever is on the device's screen, which may include personal information of the device's user. The customer that manages the device decides when sessions happen, whether the user is prompted, and whether sessions are recorded. Device users should contact the organization that manages their device about these choices.

CRM (VITABYTE CRM)

On behalf of the customer: contacts, companies, deals, notes, tasks, messages, call and email logs, and other records the customer's users enter or import.

F&B inventory

Suppliers, purchase orders, receipts of goods, stock counts, recipes, costs, and the names of the staff who record them.

Acceptance and signature records

When you accept one of our legal documents, the Services record:

• the document, its version and a SHA-256 hash of the exact text you were shown;
• whether you ticked the acceptance box;
• for an organization administrator, the name and title you typed as your electronic signature, and the organization you signed for;
• the date and time, your network address, and your browser's user agent.

These records are append-only: they are never edited or deleted in the ordinary course. They are personal information, and we keep them as evidence that the agreement was formed and on what terms.

Payment card data

Card numbers, expiry dates and security codes are entered into fields or terminals served by the payment processor, not by us. They do not reach our servers, our logs or our database. We keep only the card brand, the last four digits and the processor's reference or token. If you ask a venue to keep your card on file, the processor keeps the card and we store only the processor's token, encrypted.

Device and website information

Terminals, kiosks, handhelds, kitchen displays and VitaRemote agents send technical logs so we can support them. Card numbers and card track data are removed from those logs before they are stored. Our websites and portals record the network address, browser type and pages requested in server logs for security and troubleshooting.

• from you, when you create an account, apply, place an order, talk with Angie, or contact us;
• from our customers, who enter or import information about their own guests, employees, contacts and devices;
• from devices running our software, including VitaRemote agents and POS terminals;
• from payment processors and other services a customer connects, such as transaction and settlement reports, delivery orders, loyalty and accounting services;
• from identity providers you choose for sign-in, such as Google or Microsoft;
• from identity verification and fraud screening during a merchant application.

• to provide, operate and support the Services a customer has chosen;
• to create and secure accounts, authenticate users through Vitabyte ID, and keep the audit trail of who did what;
• to review merchant applications, verify identity, and meet the requirements of payment processors, card networks and anti-money-laundering rules;
• to pass payments to the payment processor the customer has chosen;
• to calculate and report sales, deposits, fees, tips, pay, residuals and accounting figures;
• to send messages you or the customer request: receipts, sign-in codes, notifications and, with consent, a venue's marketing;
• to answer questions through Angie and Chat using only data the person asking may see;
• to manage and support devices as the customer directs, through VitaRemote;
• to detect, prevent and investigate fraud, abuse, security incidents and violations of our Acceptable Use Policy;
• to maintain and improve the reliability, performance and security of the Services;
• to record acceptance of our agreements and enforce them;
• to meet legal obligations and respond to lawful requests.

When we act as a processor, we use customer data only for the customer's purposes and as our Data Processing Addendum allows.

Some Services include AI features: Angie, the in-portal assistant Chat, and set-up assistance that prepares suggestions such as a menu from a link.

• Permitted data only. An answer is built from data the person asking is already allowed to see, under the same tier, capability and business limits that apply to the rest of the Services.
• Model providers are processors. The language-model provider used for these features is configured by a Vitabyte super administrator. It is not fixed in the product. Each provider we use acts as our processor or service provider, under terms that restrict its use of the data to providing the feature.
• No training of third-party models. We do not allow customer data, guest conversations or employee data to be used to train third-party foundation models. We choose provider terms and settings that exclude this.
• Answers can be wrong. AI output may be incomplete or mistaken. It is not legal, tax, financial, medical or other professional advice. Guests should confirm allergen and ingredient information directly with the venue.
• Actions need permission. Where Angie can take an action, such as changing a setting, the action runs under the requesting person's permissions and any approval the customer requires, and it is recorded in the audit trail.
• Do not share sensitive information in a conversation unless the feature asks for it. Conversations are stored as described in "How long we keep information" below.

We share personal information only to provide the Services, at a customer's direction, with your consent, or where the law requires it. The categories of recipients are:

Payment processors' fields may run the processor's own fraud checks, which can read information about your device under the processor's own policy. A current list of our sub-processors is available on request in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103, and is referenced in our Data Processing Addendum.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We place no third-party advertising or analytics trackers on the Services.

We use our own cookies and browser storage that are needed to keep you signed in, keep the Services secure and remember your display settings. We do not set advertising cookies or third-party analytics cookies.

Cookie names and periods may change as the Services change; the purposes above will not expand to advertising or tracking without an update to this policy. Your browser's local storage also remembers display choices such as light or dark mode. Guest payment pages set no cookies. On pages that use reCAPTCHA, Google may set its own cookies under Google's privacy policy.

Because we do not use cookies for advertising or cross-site tracking, there is nothing to switch off for those purposes. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, which we do not do in any case.

• A venue may send you marketing text messages or email only if you have agreed. Consent is not a condition of purchase.
• You can stop text messages at any time by replying STOP, and restart them by replying START. Message and data rates may apply.
• Transactional messages, such as a receipt or a sign-in code, are sent because you or the customer asked for them.
• We send account holders service and security notices that cannot be turned off while the account is open. Any Vitabyte marketing email includes an unsubscribe link.

We maintain a written information security program with administrative, technical and physical safeguards appropriate to our size, the nature of the Services and the sensitivity of the information, as the New York SHIELD Act requires. Our safeguards include:

• encryption: information travels over HTTPS (TLS). Social Security numbers, tax IDs, bank details, hiring documents, Chat files and stored processor tokens are additionally encrypted with AES-256-GCM;
• sign-in: passwords are stored as one-way hashes; Vitabyte ID supports multi-factor authentication and passkeys; sessions expire after inactivity;
• access control: every account sees only the businesses, locations and devices it is bound to, and each screen, query and change checks that again on the server;
• audit: every change made through the Services is written to an append-only audit trail that cannot be edited or deleted and is sealed so tampering shows;
• people: access to production systems is limited to personnel who need it, under confidentiality obligations;
• operations: logging and monitoring, backups, vulnerability management, and a documented incident response plan;
• vendors: we select providers capable of protecting information and bind them by contract to do so;
• disposal: information is deleted or rendered unreadable when it is no longer needed under our retention schedule.

No system is perfectly secure. If a breach of security affects your personal information, we will notify you, the affected customer and the authorities as the law requires. For data we hold as a processor, we notify the customer as our Data Processing Addendum provides.

Each kind of record has its own period, set out in our Data Retention and Deletion Policy. In short:

• financial, payment, labor, tax and audit records are kept for years, because the law and the integrity of the books require it;
• acceptance and signature records are kept for as long as the agreement is in force and for the period afterwards in which a claim about it could be brought;
• device technical logs are kept for 90 days;
• VitaRemote inventory and telemetry are kept while the device is enrolled and for a limited period afterwards, as the Data Retention and Deletion Policy and the customer's settings provide;
• conversation records with Angie and Chat are kept as the retention schedule and the customer's settings provide;
• full card numbers are never kept.

When a customer leaves, we delete or return its customer data as our agreement with it provides, except for records we must keep by law or as evidence.

Depending on where you live, you may have the right to:

• know what personal information we hold about you, how we use it and who we disclose it to, and receive a copy in a portable format;
• correct inaccurate information;
• delete information, subject to the records we must keep by law or to complete a transaction, secure the Services or defend legal claims;
• opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. We do none of these;
• limit the use of sensitive personal information. We use sensitive information, such as Social Security numbers, bank account numbers and account credentials, only to provide the Services, verify identity, prevent fraud and meet legal obligations;
• appeal a decision we make on your request;
• not be discriminated against for using these rights.

California

California residents, including job applicants, employees and business contacts, have the rights above under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. In the past 12 months we have collected the categories described in "Information we collect" above: identifiers; customer records; commercial information; internet and device activity; audio, where you call a venue that uses a phone assistant; professional and employment information; sensitive personal information as listed above; and inferences limited to answering your own questions in Angie or Chat. We collected them from the sources, for the purposes and disclosed them to the categories of recipients described in this policy. We have not sold or shared personal information, and we have no actual knowledge of selling or sharing information of anyone under 16. We do not use sensitive personal information to infer characteristics about anyone.

Other states

Residents of other states with consumer privacy laws, among them Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia, have similar rights, including the right to appeal. If we decline your request, you may appeal by replying to our decision. If you remain unsatisfied with the outcome of an appeal, you may contact your state attorney general.

Nevada

We do not sell covered information as Nevada law defines it.

• Send your request in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103, or, if you have an account, use the privacy request form in your account (Profile › Legal file). Name the Service it concerns.
• We will verify your identity before acting, usually by matching information we already hold or by asking you to confirm through your signed-in account. We ask for no more than we need.
• An authorized agent may make a request for you with your signed permission. We may ask you to confirm your identity directly.
• We respond within 45 days. If we need more time, we will tell you why, and the total will not exceed what the law allows.
• We will explain what we cannot do and why, for example where we must keep a record by law.
• If we hold your information as a processor for a customer, such as a venue where you ordered, your employer, or the organization that manages your device, we will pass your request to that customer and help it respond.

Requests are free of charge unless they are manifestly unfounded or excessive.

The Services are for businesses, their staff and their adult guests. They are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Guests under 18 should use the ordering and payment pages only with a parent or guardian's involvement. If you believe a child has given us personal information, write to us by mail (certified mail or courier) at the address below, and we will delete it.

We provide the Services from the United States, and our primary servers and storage are located in the United States. If you use the Services from outside the United States, your information will be transferred to, stored in and processed in the United States, where privacy law may differ from yours. Where the law of your country requires a transfer safeguard, such as the European Commission's Standard Contractual Clauses, we put that safeguard in place, including in our Data Processing Addendum.

We will post any change on this page with a new version number and date. If a change materially affects how we use information we already hold, we will notify account holders before it takes effect, and where the law requires consent we will ask for it. The Services record which version of this policy was shown when you accepted it.

Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103

Privacy questions and requests, legal notices and the data protection contact: in writing by mail (certified mail or courier) to the address above. If you have an account, you may also use the privacy request form in your account (Profile › Legal file).

Our Terms of Service, Acceptable Use Policy, Data Processing Addendum and Data Retention and Deletion Policy also apply to your use of the Services.