Privacy Policy

This Privacy Policy describes how 2806939 Ontario Ltd., doing business as Bagel Technologies ("Bagel," "we," "us," or "our"), collects, uses, discloses, and protects your personal information when you use the Bagel platform ("Service"). We are committed to safeguarding your privacy in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

1. Information We Collect

a) Account Information

When you create an account, we collect your name, email address, phone number, restaurant or business name, and role within your organization.

b) Payment Information

All payment processing is handled exclusively by Stripe, Inc. We do not store your full credit card number, CVV, or banking details on our servers. Stripe collects and processes your payment information in accordance with Stripe's Privacy Policy. We receive only a tokenized reference, the last four digits of your card, and transaction confirmations.

c) Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, actions taken, frequency and duration of sessions, and performance metrics.

d) Device and Log Data

We collect device type, operating system, browser type and version, IP address, time zone, and diagnostic data including error logs and crash reports.

e) Business Data

In the course of using the Service, you may submit business data including but not limited to menu items, recipes, inventory records, employee schedules, sales transactions, and financial reports ("User Data"). This data is owned by you and processed by us solely to provide the Service.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service;
• Process transactions and send related information (confirmations, invoices);
• Create and manage your account;
• Send administrative communications (service updates, security alerts, support messages);
• Provide customer support and respond to inquiries;
• Generate aggregated, anonymized analytics to improve the Service;
• Detect, prevent, and address fraud, abuse, and technical issues;
• Comply with legal obligations.

3. Data Sharing and Third Parties

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

• Service Providers: We use trusted third-party providers to operate the Service, including Stripe for payment processing and cloud infrastructure providers for hosting. These providers are contractually obligated to protect your data and use it only as directed by us.
• Legal Requirements: We may disclose your information if required by law, subpoena, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
• With Your Consent: We may share information with third parties when you have given us explicit consent to do so.

4. Data Storage and Transfer

Bagel is operated by 2806939 Ontario Ltd., a Canadian corporation. Your data is stored and processed on servers located in the United States. By using the Service, you consent to the transfer of your information to the United States, where data protection laws may differ from those in your jurisdiction. We implement appropriate safeguards, including contractual protections with our hosting providers, to ensure your data receives an adequate level of protection.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Upon account termination, we will retain your data for a reasonable period (not exceeding twelve months) to comply with legal obligations, resolve disputes, and enforce our agreements. After the retention period, your data will be securely deleted or anonymized. You may request earlier deletion by contacting us at legal@withbagel.com.

6. Security Measures

We take the security of your data seriously and implement industry-standard measures to protect it, including:

• Encryption at rest using AES-256;
• Encryption in transit using TLS 1.3;
• Multifactor authentication (MFA) required on all user accounts;
• Regular security audits and vulnerability assessments;
• Access controls limiting employee access to personal data on a need-to-know basis;
• Incident response procedures to address data breaches promptly.

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

Under PIPEDA and applicable privacy laws, you have the right to:

• Access: Request a copy of the personal information we hold about you;
• Correction: Request that we correct inaccurate or incomplete personal information;
• Deletion: Request that we delete your personal information, subject to legal retention requirements;
• Withdrawal of Consent: Withdraw your consent to the processing of your personal information at any time, subject to legal or contractual restrictions;
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

To exercise any of these rights, please contact us at legal@withbagel.com. We will respond to your request within thirty (30) days.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service. The types of cookies we use include:

• Essential Cookies: Required for the Service to function properly (authentication, security, session management);
• Analytics Cookies: Help us understand how users interact with the Service so we can improve it;
• Preference Cookies: Remember your settings and preferences.

We do not use advertising or third-party tracking cookies. You can manage cookie preferences through your browser settings, but disabling essential cookies may impair the functionality of the Service.

9. Children's Privacy

The Service is not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a minor, we will take steps to delete it promptly. If you believe a minor has provided us with personal information, please contact us at legal@withbagel.com.

10. PIPEDA Compliance

As a Canadian corporation, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Our Privacy Officer can be reached at legal@withbagel.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated via email or through a prominent notice on the Service at least thirty (30) days before taking effect. Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

12. Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact us at:

2806939 Ontario Ltd.
d/b/a Bagel Technologies
Ontario, Canada
legal@withbagel.com