Privacy Policy

1. Who is responsible

The controller is Atria Partners SRL, Rue Général Tombeur 81, bus 23, 1040 Etterbeek, Belgium, VAT BE 0890 275 106. You can reach us at contact@atriapartners.be.

For the business data a restaurant or supplier enters into the product (menus, ingredients, prices, orders, invoices), the customer decides what is stored and we act as processor on their behalf.

2. What we collect

We collect only what the product needs to work:

• Account data: name, email address, role, password (stored only as a hash) and two-factor settings.
• Business data you enter: restaurants, staff, suppliers, ingredients, recipes, orders, stock and the documents you upload, such as invoices and delivery notes.
• Billing data: handled by our payment provider; we keep the subscription status, not your card number.
• Technical data: the language you choose, the session cookie, and security logs such as sign-in attempts.

3. Why we use it and on what basis

• To provide the service and your account (performance of a contract).
• To send service emails: confirmations, invitations, security alerts, and orders you send to suppliers (performance of a contract).
• To keep the service secure and prevent abuse (legitimate interest).
• To meet accounting and legal duties (legal obligation).

4. Who else receives data

We use a small number of service providers who process data on our instructions:

• Payment processing: Stripe.
• Transactional email: Resend.
• AI document reading: when you upload an invoice or price list, its content is sent to an AI provider (OpenAI or Anthropic) only to extract the lines, through their business APIs, which by default do not use submitted data to train models.
• Hosting and database providers inside the European Economic Area where possible.

5. Transfers outside the EEA

Some providers are based in the United States. Where data leaves the EEA we rely on an adequacy decision or on the European Commission's standard contractual clauses.

6. How long we keep data

We keep account and business data while your account is active. After you delete your account we remove it, except what we must keep by law (for example billing records, up to seven years) and short-lived backups.

7. Your rights

You may ask to access, correct, export or delete your data, to restrict or object to its use, and to withdraw consent where we rely on it. You can export or delete your account data from the settings page, or write to us at contact@atriapartners.be. We answer within one month.

If you are not satisfied, you may complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), https://www.dataprotectionauthority.be.

8. Security

Data is encrypted in transit, passwords are hashed, sessions expire, and two-factor authentication is available. No system is perfectly secure; we will notify you and the authority of a breach where the law requires it.

9. Changes

We will update this page when our practices change and show the date of the latest version at the top.