The principles
This policy is published by Vitabyte, Inc. ("Vitabyte", "we") and covers the records the Vitabyte platform (Translink, VITAPOS, VitaRemote, VITABYTE CRM, Angie, Angie Eats and F&B inventory) holds.
- Keep what the law, the books or security require — and say how long. Each kind of record below has its period and the reason for it.
- Never store what we do not need. Card numbers, expiry dates and security codes never reach the platform at all.
- Permanent records are permanent on purpose. The audit trail, labor records and financial records cannot be edited or deleted by anyone, including us. A correction is a new record beside the old one. That is what makes them evidence.
- Deletion is a reviewed decision. Except where this policy names an automatic deletion, records are removed only by a reviewed request, never silently.
Periods by kind of record
| Kind of record | What it includes | How long | Why |
|---|---|---|---|
| Card data | Card number, expiry date, security code | Never stored | Typed only into the payment provider's fields |
| Card references | Card brand, last four digits, the provider's reference or token | As long as the payment record | Receipts, refunds and disputes |
| Merchant applications | Business and owner details, documents, and encrypted Social Security numbers, tax IDs, dates of birth and bank details | The life of the merchant relationship and at least five years after it ends, or after a declined or withdrawn application | Processor, card network and anti-money-laundering record-keeping |
| Merchant and partner accounts | Names, contact details, roles, access | While the account is open, then as long as the records it made are kept | Who did what must stay answerable |
| Financial records | Transactions, deposits, fees, disputes, residuals, invoices, accounting entries, guest charges and tips | At least seven years | Tax, accounting and processor requirements |
| Employee and payroll records | Profiles, hiring forms, schedules, punches, timecards, pay rates, tips, tip pools, corrections, acknowledgments | At least six years — in practice permanently | Wage and tip-record laws (the longest names six years); these records cannot be edited or deleted |
| Guest records a venue keeps | Customer list, contact details, delivery addresses, visits, preferences, caller ID | While the venue keeps its account, unless the venue removes them sooner | The venue's own service to its guests |
| Marketing consents | Email and text consents, STOP and START | As long as the contact is kept, and the record of an opt-out permanently | Proof of consent and of opt-out |
| Phone-order memory | Past orders remembered for a returning caller | 30 days by default (the venue may set 1 to 365); off unless the venue turns it on; deleted when the venue turns it off | Convenience, only with the caller's agreement |
| Receipts | Receipt sent by email or text, and its link | The link works for 90 days; the payment record is kept as a financial record | A guest can fetch a receipt |
| Audit trail | Who did what, when, from which network address, before and after | Permanently | Integrity: it is the record that proves every other record, so it cannot be edited or deleted and is sealed so that tampering shows |
| Sign-in records | Sessions, trusted devices, sign-in attempts | Sessions end after 2 hours idle and 12 hours at most; the record of the sign-in is part of the audit trail | Security |
| Chat | Conversations, attached files, remembered notes | While the account is open; removing a file hides it rather than erasing it | Chat answers from the account's own history; the record of what was asked stays answerable |
| Device logs | Technical logs from terminals, kiosks, handhelds and TV screens, with card data removed before storage | 90 days, then deleted automatically | Support and diagnosis |
| Legal acceptance and signature records | Which version of which agreement a person accepted or signed, the exact text shown (stored with its SHA-256 hash), the acceptance screen as shown, the typed name and title, the time, network address and browser, and the evidence packs exported from them, with who exported them and why | At least seven years after the account or engagement closes, and longer while a legal hold applies | Proof of the contract; these records cannot be edited or deleted |
| Face templates | The encrypted face template of a staff member who chose face sign-in at a venue's terminals — a list of numbers, never a picture | Until the person asks for it to be deleted or stops working at the venue, and at most 365 days after they last used it; a venue may set a shorter period | Recognising a venue's own staff at its terminals, only with each person's written agreement |
| Payment-link opens | That a link was opened, and when — no network address or browser | As long as the link's payment record | Show a venue that its link was used |
| Fingerprint templates | The encrypted fingerprint template of a staff member who chose fingerprint sign-in at a venue's terminals — the positions of ridge features, never an image of the finger | Until the person asks for it to be deleted or stops working at the venue, and at most 365 days after they last used it; a venue may set a shorter period | Recognising a venue's own staff at its terminals, only with each person's written agreement |
Fingerprint templates (biometric information)
A venue may offer its staff fingerprint sign-in at its terminals. It is optional for every person, it is never a condition of being hired or of keeping a job, and a PIN always works.
- What is kept. Only a fingerprint template: the positions and directions of the ridge endings and splits on a finger, worked out by the reader on the terminal. No image of the finger is stored or sent. The template is encrypted, held for the venue that employs the person, and copied only to that venue's own terminals.
- Why. To recognise the venue's own staff when they sign in and when they clock in or out. It never approves a void, a refund, a discount, a tip or the cash drawer; those always need a PIN. It is used for nothing else, is never sold, leased, traded or shared, and is never used to identify guests.
- Agreement first. Nothing is read until the person has read and signed a written consent on the terminal that states the purpose and how long the template is kept. The signed consent is kept as a record; it contains no fingerprint data.
- When it is destroyed. A template is permanently deleted from our servers when the first of these happens: the person asks, on the terminal or through a manager; the person stops working at the venue or is made inactive; the template has not been used for the venue's retention period, which is never more than 365 days and is shortened where the law for the venue's location sets a shorter limit; or the venue stops using fingerprint sign-in, in which case templates are deleted within 7 days. Each terminal deletes its own copy the next time it connects, and at once when fingerprint sign-in is turned off for it.
- How. Deletion removes the template itself, not a marker over it. The record that a deletion happened, and why, is kept in the audit trail without any fingerprint data.
Face templates (biometric information)
A venue may offer its staff face sign-in at its terminals. It is optional for every person, and a PIN always works.
- What is kept. Only a face template: a list of numbers worked out on the terminal from a few pictures of the person's face. The pictures are never stored and never leave the terminal. The template is encrypted, held for the venue that employs the person, and copied only to that venue's own terminals.
- Why. To recognise the venue's own staff when they clock in or out, sign in, or confirm a manager's PIN. It is used for nothing else, is never sold, leased, traded or shared, and is never used to identify guests.
- Agreement first. Nothing is captured until the person has read and signed a written consent on the terminal that states the purpose and how long the template is kept. The signed consent is kept as a record; it contains no face data.
- When it is destroyed. A template is permanently deleted from our servers when the first of these happens: the person asks, on the terminal or through a manager; the person stops working at the venue or is made inactive; the template has not been used for the venue's retention period, which is never more than 365 days and is shortened where the law for the venue's location sets a shorter limit; or the venue stops using face sign-in, in which case templates are deleted within 7 days. Each terminal deletes its own copy the next time it connects, and at once when face sign-in is turned off for it.
- How. Deletion removes the template itself, not a marker over it. The record that a deletion happened, and why, is kept in the audit trail without any face data.
Deleting information
You can ask us to delete personal information as described in our Privacy Policy, in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103, or, if you have an account, through the privacy request form in your account (Profile › Legal file). We will:
- confirm who you are;
- delete what we are free to delete;
- tell you which records we must keep, why and for how long — for example a payment record, a payroll record or the audit trail — and keep them only for those purposes.
If we hold the information for a merchant — you are a guest or an employee of a venue — we pass the request to that merchant, which decides, and we carry out its decision within the limits above.
When a merchant or partner closes its account, its records are kept for the periods above and then removed through the same reviewed process.
Legal holds and deletion requests together
A legal hold stops deletion of the records it covers while a dispute, claim or investigation is pending or reasonably expected. When you ask us to delete personal information and a hold or a legal-claims exception applies, we keep only what the proof needs — the agreement text, the acceptance record and the access records that show who did what — restrict it to that purpose, delete or de-identify the rest, and tell you what we kept and why. These exceptions are the ones privacy laws allow for establishing, exercising or defending legal claims and for complying with legal obligations.
Changes
We will post any change here with a new version number and date.
