This Privacy Policy explains how S25 Studio Pty Ltd (ABN 30 683 814 904), trading as Foogital (Foogital, we, us) handles personal information. We are based in Australia and comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, we comply with them too.

1. Who this policy covers

  • Restaurant customers — the owners and team members who use the Foogital dashboard. For their account information, Foogital is the controller.
  • Visitors to foogital.com, people who join our waitlist or contact us, and photographers who apply to our network. Foogital is the controller.
  • Guests of restaurants — people who visit a restaurant website built with Foogital, make a booking or send a message. For that information the restaurant is the controller and Foogital is its processor under our Data Processing Agreement. Please read the restaurant’s own privacy policy and contact the restaurant first about your information.

2. What we collect

  • Account information: name, email address, password (stored hashed) or Google sign-in identifier, two-factor settings, role, language and appearance preferences.
  • Business information: restaurant name, address, phone, opening hours, menus, photos and other content you add, and details you import from Google.
  • Billing information: plan, invoices, billing address and tax ID. Card details are collected and stored by Stripe; we see only the card brand, last four digits and expiry.
  • Usage information: pages and features used in the dashboard, device and browser type, IP address, and approximate location derived from it, collected through PostHog without analytics cookies.
  • Communications: messages, feature requests and support conversations, and records of when you accepted our legal documents (including IP address and browser).
  • Marketing site: pages visited and how you arrived, and details you submit through forms (such as the waitlist).
  • Photographer applications: name, contact details, location, portfolio and the information you choose to publish.

If you sign in with Google

If you choose to sign up or sign in with your Google account, Google shares with us only your name, email address and profile picture. We do not ask for access to your Gmail, Google Drive, Calendar, contacts or any other Google data.

  • How we use it: only to create your Foogital account, sign you in, and show your name and picture in the dashboard.
  • How we share it: we do not sell it, use it for advertising, or use it to train AI models. It is stored by Supabase, our authentication and database provider (see section 5), and is not shared with anyone else except where the law requires.
  • How to remove it: you can disconnect Foogital at any time at myaccount.google.com/permissions, and ask us to delete your account and its data as described in section 10.

3. How we use it

  • To provide, secure and support the Services, including signing you in and, at your request, letting our support team view your dashboard as you.
  • To bill you and keep financial records.
  • To communicate with you about your account, changes to the Services and these documents.
  • To understand and improve the Services, using aggregated usage information.
  • To send product news, where you have agreed or the law otherwise allows. You can opt out at any time.
  • To comply with the law and enforce our terms.

Under the GDPR, our legal bases are: performance of our contract with you; our legitimate interests in running, securing and improving a business service (balanced against your rights); your consent, where we ask for it; and compliance with legal obligations.

4. AI features

When you use an AI feature, the relevant content (for example menu photos or website text) is sent to Google’s Gemini API on a paid plan. Under Google’s terms for paid use, inputs are not used to train Google’s models. We do not use your content to train AI models.

5. Who we share it with

We do not sell personal information. We share it with service providers who process it for us under contract:

  • Vercel — hosting of the dashboard, marketing site and restaurant websites (global edge network; United States).
  • Supabase — databases and file storage: the Platform database in Tokyo, Japan, and the Company database in Sydney, Australia.
  • Stripe — payments and subscriptions (United States and other regions).
  • Resend — sending email (United States).
  • PostHog — product analytics (United States for our dashboard and marketing site; European Union for restaurant website statistics).
  • Google — Places (business import and address lookup), Maps, Translate and Gemini AI (United States and other regions).

We may also disclose information to professional advisers, to a buyer of our business, or where the law requires it.

6. International transfers

Because our providers operate in several countries, your information may be stored or processed outside the country where you live, including in Australia, Japan, the United States and the European Union. Where the GDPR or UK GDPR applies, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses (with the UK Addendum) and take reasonable steps so that recipients protect the information to the standard of the Australian Privacy Principles.

7. Cookies

The dashboard uses only cookies needed to keep you signed in, remember your language, and secure support sessions. Its analytics keep no cookies. The marketing site may use analytics as described in its cookie notice. Restaurant websites ask visitors for consent before loading statistics.

8. How long we keep it

We keep account and business information while your account is open. After you close it, we delete or anonymise it within 90 days, except backups (deleted on their normal cycle, within 35 days) and records we must keep by law, such as invoices (generally 7 years in Australia) and records of consent.

9. Security

We protect information with encryption in transit and at rest, access controls including row-level security, two-factor authentication for our team and optionally for yours, and time-limited support access. No system is perfectly secure; if a data breach is likely to cause serious harm, we will notify you and the regulator as the law requires.

10. Your rights

You can ask to access or correct your personal information, and much of it can be edited in the dashboard directly. Where the GDPR or UK GDPR applies, you may also ask us to delete it, restrict or object to its use, or provide it in a portable format, and withdraw consent at any time. Contact us at hey@foogital.com; we will respond within 30 days.

If you are unhappy with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), or, in the EU or UK, to your local data protection authority or the UK Information Commissioner’s Office.

11. Children

The Services are for businesses and are not directed at children under 16.

12. Changes

We will publish any update here with its effective date. If it materially changes how we handle your information, we will tell you in the dashboard and ask you to accept it.

13. Contact

S25 Studio Pty Ltd, trading as Foogital, Suite 1501, Level 15, 9–13 Castlereagh Street, Sydney NSW 2000, Australia — hey@foogital.com.