Privacy Policy

AnoSayo is operated by Buting Software Development Services.

We collect information needed to create and manage restaurant menu pages, including merchant account details, email addresses, display names, restaurant names, branch names, restaurant addresses when provided, menu content, prices, item availability, uploaded logos or menu item images, and QR poster activity.

We also collect authentication information through Supabase Auth, invite details for restaurant team access, and plan and trial status. Merchant activity logs record account identifiers, actions, affected restaurant records, and timestamps for security and support.

When you use the contact form, we store your name, email address, optional business name, message, and submission time. Menu-visit analytics store randomly generated visitor and session identifiers, the restaurant visited, entry source (QR code, link, or direct), and visit time. These identifiers distinguish repeat visits without requiring a customer account.

We use IP addresses or signed-in user identifiers to limit abusive requests. These identifiers may be processed by Upstash when shared rate limiting is enabled.

We use this information to support merchant onboarding, publish menu pages, activate public menu and QR access, keep the product reliable, troubleshoot issues, prevent misuse, and provide account, billing, and service support. Contact inquiries help us respond to questions; menu-visit information provides restaurants with counts of visits, unique visitors, sessions, and entry sources.

AnoSayo is designed to stay lightweight. Public menu usage should not require customer names, phone numbers, delivery addresses, or payment details for the QR-to-cashier flow.

Temporary order preparation is session-based and may use browser storage to preserve the in-progress summary on the same device.

AnoSayo uses essential cookies and browser storage for merchant sign-in and in-progress order summaries. Separate menu-visit cookies help count visits and distinguish visitors and sessions on the same device.

AnoSayo uses cookies for authentication sessions and session storage for lightweight flows such as in-progress order summaries, onboarding drafts, menu import drafts, and password reset email reminders.

The menu-visit visitor cookie lasts one year, the session cookie lasts 30 minutes, and the QR/link entry-source cookie lasts 30 seconds. These lifetimes restart when the corresponding cookie is written again. In-progress order summaries use session storage in your browser; they are not stored as orders on AnoSayo servers.

If you block these essential cookies or storage features, parts of AnoSayo may not work as expected. This MVP does not yet provide a separate cookie preference center.

We may also rely on third-party providers for hosting, authentication, storage, logging, and AI-assisted menu extraction when merchants use those features.

AnoSayo uses third-party providers to operate the service, including Supabase for authentication, database, and storage; Vercel or similar hosting providers for application hosting; Google Maps/Places for merchant location assistance; Google Gemini for AI-assisted menu extraction when used; and Upstash for shared abuse-prevention rate limiting when enabled.

PayMongo is intended for future merchant subscription payments and is not currently used to collect subscription payments. AnoSayo does not collect or store card details. Payment-data handling will be described here before paid subscriptions are enabled.

AnoSayo uses access controls, authentication, and service-provider security features to protect information. No online service can guarantee absolute security.

We do not sell personal information. We share information only with service providers needed to run AnoSayo, comply with legal obligations, prevent misuse, or resolve account, billing, and service issues.

We retain information for as long as reasonably necessary to operate the service, maintain merchant accounts and public menu pages, meet legal obligations, and resolve disputes.

Cookie expiry or clearing browser storage does not delete server-side visit records, contact inquiries, or merchant activity logs. There is no automatic deletion schedule for those records in the current service; contact support to request review or deletion.

For account or restaurant deletion requests, contact support. We may verify ownership before processing deletion.

You may request access, correction, or deletion of your personal information by contacting hello@anosayo.app or use the contact page.

AnoSayo aims to handle personal information in line with applicable Philippine privacy laws, including the Data Privacy Act of 2012.