Privacy Notice

1. Who we are

Mohamed Ahmed Abdi, trading as Grizfy, is the seller and the data controller for personal data processed through the Grizfy platform and website. You can contact us about privacy at admin@notify.grizfy.com.

Where a restaurant using Grizfy collects data about its own guests through our tools, that restaurant is the controller of that guest data and we act as its processor.

2. Personal data we collect and why

• Account data (name, business name, email address, password credentials, staff roles) — to create and secure your account, provide the Service, and manage access. Legal basis: performance of a contract.
• Business content (menus, dish photos, logos, branch details, opening hours, social and website links) — to operate your digital menus, QR codes and designs. Legal basis: performance of a contract.
• Guest interaction data (orders, table service requests, feedback and reviews, and any contact details a guest chooses to provide) — to deliver ordering and engagement features on behalf of the restaurant. Legal basis: performance of a contract / legitimate interests of the restaurant.
• Usage and telemetry data (pages viewed, features used, QR scan counts, device type, browser, approximate location derived from IP, IP address, timestamps) — to run analytics dashboards, improve the product, and detect abuse. Legal basis: legitimate interests.
• Support and communications (support messages, emails, attachments) — to answer questions and resolve issues. Legal basis: legitimate interests.
• Marketing preferences (subscription status, email engagement) — to send product updates where permitted. Legal basis: consent or legitimate interests.
• Security and fraud signals (log-in attempts, audit logs) — to protect accounts. Legal basis: legitimate interests and legal obligation.

We do not deliberately collect special-category data. Please do not upload sensitive personal data into menus, designs or marketing content.

3. Who we share data with

• Service providers and subprocessors — cloud hosting and database providers, email delivery, AI content-generation providers, and analytics and support tooling, all acting on our instructions under contract.
• Paddle.com, our Merchant of Record, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal, accounting and audit advisers where necessary.
• Authorities — where we are required to disclose data by law or to establish or defend legal claims.
• Acquirers — in connection with a merger, acquisition or sale of assets.

We do not sell personal data.

4. International transfers

Grizfy serves restaurants worldwide and our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

5. Retention

We keep account and business content for as long as your account is active, and for up to 30 days after cancellation so you can export or restore it, after which it is deleted or anonymised. Aggregated analytics may be retained in anonymised form. Records required for tax, accounting or legal purposes are kept for the period required by law.

6. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent at any time. To exercise these rights email admin@notify.grizfy.com. We respond within one month.

If you are in the UK or EEA you also have the right to lodge a complaint with your local supervisory authority. In Kenya you may complain to the Office of the Data Protection Commissioner.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level access controls, role-based permissions and least-privilege access for our team. No system is completely secure, but we review our controls regularly and will notify you of a breach affecting your data as required by law.

8. Cookies

We use a small number of cookies and similar technologies:

• Essential — sign-in sessions, security and load handling. These are required for the site to work.
• Analytics — to understand feature usage and QR scan performance in aggregate.

You can block or delete cookies in your browser settings; essential cookies are needed to stay signed in. We do not use third-party advertising cookies.

9. Children

Grizfy is a business tool and is not directed at children. We do not knowingly collect data from children.

10. Changes to this notice

We may update this notice from time to time. Material changes will be announced by email or in-app notice.