Privacy policy

Effective date: November 1, 2026

Fizzy (“Fizzy”, “we”, “us” or “our”) provides hospitality operating system software and related services to restaurants, bars and cafés. This Privacy Policy applies to our public websites, demo and contact forms, POS, administration tools, mobile-friendly views, customer support and related services (together, the “Services”).

This policy is written for Canadian businesses and is intended to be read with applicable privacy laws, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws where they apply. This policy is not legal advice.

1. Roles and scope

When a restaurant uses Fizzy to store its staff, customer or transaction information, the restaurant generally decides why that information is collected and how it is used. Fizzy processes that information to provide the Services on the restaurant’s instructions. Questions about a restaurant’s use of a customer’s data should normally be directed to that restaurant first.

For information collected directly through our website, sales process, support or account administration, Fizzy acts as the organization responsible for the information described in this policy.

2. Information we collect

Information provided directly

• Contact information such as name, email, phone number, role and business name.
• Business setup information such as brands, outlets, menus, operating schedules, tax settings and staff access requirements.
• Support, demo, onboarding, billing and other communications.
• Account credentials, permission settings and security information.

Information processed for a restaurant

• Customer names, phone numbers, email addresses, order history, visits and preferences entered by the restaurant.
• Staff names, roles, shifts, attendance, payroll-related inputs and permissions entered by the restaurant.
• Orders, items, modifiers, payments, refunds, discounts, day-end activity, expenses and reports.
• Voice-ordering or campaign information where those modules are enabled, including the information needed to complete an order or send a permitted communication.

Information collected automatically

• Device, browser, operating system, approximate location inferred from IP, log and diagnostic information.
• Website usage, pages viewed, referral information and consent preferences.
• Service events such as sign-in attempts, sync status, errors, audit activity and feature usage.

3. Purposes and legal basis

We use information to provide, secure, support and improve the Services; configure accounts and outlets; process and reconcile transactions; generate reports; respond to enquiries; communicate service updates; prevent fraud and misuse; administer billing; comply with legal obligations; and evaluate product reliability. Where consent is required, we request it and record it. Where permitted, we rely on contractual necessity, legitimate business purposes and legal obligations.

4. Marketing, WhatsApp and voice AI

A restaurant is responsible for having an appropriate legal basis and required consent before uploading customer contact information, sending marketing messages or enabling automated phone ordering. Fizzy does not authorize unsolicited communications. Marketing preferences, opt-outs and provider rules must be respected. Voice AI interactions may be processed by configured service providers to understand requests, complete an order and support quality or security; availability and retention depend on the enabled service configuration.

5. Service providers and disclosures

We may use providers for hosting, databases, authentication, payment-related services, email, messaging, analytics, customer support, voice processing, security and infrastructure. They receive only the information reasonably required for their service and are expected to protect it under contractual or other safeguards. We may disclose information where required by law, court order, regulator, emergency or to protect rights and security. We do not sell personal information.

6. Cross-border processing

Some providers or infrastructure may process information in Canada or other countries. Information processed outside your province or Canada may be subject to the laws of that jurisdiction. We use contractual, technical and organizational safeguards appropriate to the service and disclose material processing information where required.

7. Security and offline operation

We use access controls, authentication, logging, encryption in transit where supported, least-privilege practices and operational safeguards designed to reduce risk. POS applications may retain operational data locally to support offline operation and later synchronization. Businesses must secure their devices, staff credentials, local network and authorized users. No system can be guaranteed completely secure.

8. Retention and deletion

We retain information for as long as needed for the purposes described here, the customer relationship, financial and legal records, security, dispute resolution or legitimate business continuity. When information is no longer required, we delete, anonymize or securely isolate it subject to backups, legal retention and the restaurant’s instructions. Account closure and export timing are described in the applicable agreement and cancellation policy.

9. Access, correction and consent

Subject to legal exceptions, you may request access to or correction of personal information under our control, withdraw consent where applicable, ask about our practices or raise a concern. We may need to verify identity and clarify the request. If the information belongs to a restaurant’s customer or employee record, we may refer the request to that restaurant as the responsible organization.

10. Cookies and analytics

Our website may use essential storage and privacy-respecting analytics or similar technologies to operate the site, understand performance and remember preferences. You can manage cookies through browser controls. Blocking some technologies may affect functionality.

11. Children

The Services are for businesses and are not directed to children. We do not knowingly seek personal information from children.

12. Changes and contact

We may update this policy as the Services, law or providers change. We will update the effective date and provide additional notice where required. For privacy questions or requests, contact contact@fizzypos.com or call +1 587 434 0017.