Privacy Policy

Effective date: October 20, 2026

Varastiq, Inc., a Florida corporation ("Varastiq," "we," "us," or "our") provides restaurant back-office software, including the owner portal at portal.varastiq.com, the Stiq mobile app at app.varastiq.com, the Vara AI copilot, our website at https://varastiq.com, and related features and support (together, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Service. It is posted at https://varastiq.com/legal/privacy and forms part of our Terms of Service.

"Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. Capitalized terms we don't define here, such as "Customer," "Customer Data," "Output," "Integration," and "User," have the meanings given in our Terms of Service.

Who this policy covers. It covers restaurant owners and businesses that subscribe to the Service ("Customers"), the people they authorize to use it (for example, Owner, Manager, and Counter roles) ("Users"), restaurant employees whose information is in Customer Data (for example, in inventory counts or POS data), and visitors to our website.

Business customers and their employees. When a Customer submits information about its employees or others, the Customer decides why that information is in the Service. We process it to provide the Service to that Customer and as described in this policy. If you are an employee of a Customer, contact your employer with questions about its practices. We will help the Customer respond to requests.

Jump to: AI features and model improvement · Your privacy rights · U.S. state disclosures

1. Information We Collect

1.1 Information you provide to us

• Account information. Name, business name, email address, phone number, role (Owner, Manager, or Counter), login credentials, and similar details you provide when you sign up, invite Users, or update your account.
• Business data. Menus, recipes, ingredients, inventory items, vendor and supplier information, item prices and costs, food cost, plate margin, prime cost, and other operating information you enter or that the Service calculates.
• Uploads. Photos, scans, and PDFs of supplier invoices and other documents you upload, and the data we extract from them (for example, vendor names, line items, quantities, and prices). Uploads may contain personal information, such as a sales representative's name or a signature.
• Inventory counts. Counts and related entries made in the Stiq app, including which User made the entry and when.
• Vara interactions. Prompts and requests you send to Vara, the suggestions Vara generates (Output), and what you do with them. See Section 5.
• Communications and support. Messages, support requests, survey responses, and other information you send us.

1.2 Information from Integrations you connect

When you connect an Integration, we receive data from it on your behalf as needed to provide the Service. Integrations are provided by third parties under their own terms and privacy policies.

• Point of sale (for example, Toast POS). Sales, menu item, modifier, order, and related data, which may include employee identifiers associated with transactions.

1.3 Information we collect automatically

• Usage data. Features used, pages and screens viewed, clicks, actions taken, timestamps, errors, and performance information.
• Device data. IP address, browser type, operating system, device type and identifiers, app version, and approximate location inferred from IP address.
• Cookies and similar technologies. We use only cookies and similar technologies that are necessary to keep you signed in and to secure the Service. We do not use advertising or retargeting cookies or trackers. We will update this policy before adding any analytics or advertising tools. You can control cookies through your browser settings, but the Service may not work without these necessary cookies.

1.4 Payment information

A payment card is required at signup. Payments are processed by Stripe, our third-party payment processor, which collects and processes your card details at signup. Varastiq does not store full card numbers. We may receive limited billing information from Stripe, such as your name, billing address, card brand, the last four digits, expiration date, and transaction and subscription status. Stripe's privacy policy applies to its processing of your payment information.

2. How We Use Information

We use information to:

• Provide the Service. For example, to create and manage accounts, capture and extract invoice data, calculate food cost, plate margin, and prime cost, manage menus, recipes, and inventory, sync Integrations, and generate Vara suggestions.
• Maintain, secure, and support the Service. For example, to troubleshoot, prevent fraud and abuse, monitor performance, and respond to support requests.
• Improve and develop the Service, including our AI features, as described in Section 5.
• Communicate with you. For example, to send service, billing, and security notices, and, where permitted, product updates and marketing. You can unsubscribe from marketing at any time.
• Process payments and manage subscriptions through Stripe.
• Comply with law and enforce our terms. For example, to respond to lawful requests, protect rights and safety, and enforce our Terms of Service.
• For other purposes we describe to you when we collect the information or with your consent.

3. How We Disclose Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as described below.

• Service providers. We work with vendors that help us operate the Service, such as hosting, data storage, document processing, customer support, communications, and AI model providers (Section 5.3). They may use information only to provide services to us, under contracts that require appropriate confidentiality and security.
• Payment processor. Stripe processes payments as described in Section 1.4.
• Integrations you connect. When you connect an Integration such as Toast POS, we exchange data with it on your behalf as you direct. The third party's own terms and privacy policy govern its handling of that data.
• Within your account. Information is visible to other Users in your account according to their roles and permissions.
• Legal and safety. We may disclose information if we believe in good faith that it is required by law or legal process, or needed to protect the rights, property, or safety of Varastiq, our Customers, or others.
• Business transfers. We may disclose information in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this policy's protections.
• With your consent or at your direction.

Cross-customer processing. We may use information derived from use of the Service across multiple Customers to generate aggregated analytics, benchmarks, security and fraud-prevention tools, and improvements to the Service and its AI models. This is done only in aggregated or de-identified form. We do not disclose one Customer's identifiable Customer Data, including recipes, item costs, vendor pricing, or sales, to another Customer, and we do not present aggregated insights in a form that could reasonably be used to reverse-engineer a specific Customer's recipes or operations.

4. De-identified and Aggregated Information

We may de-identify or aggregate information so that it cannot reasonably be used to identify, or be linked to, a particular individual or Customer. We use such information to operate, analyze, and improve the Service, including as described in Section 5. When we maintain de-identified information, we will keep and use it only in de-identified form and will not try to re-identify it, except to test whether our de-identification processes meet legal requirements. We contractually require anyone we share it with to do the same.

5. AI Features and Model Improvement

5.1 How Vara works

Vara, the AI copilot in the Service, uses Customer Data, such as your invoices, recipes, menus, inventory, sales, and costs, to draft recipes, flag issues, and suggest changes. Vara's suggestions are Output and are suggestions only. You decide whether to apply them. Other features, such as invoice capture, may also use machine learning.

5.2 What we use to train and improve our models

Unless your contract says otherwise (Section 5.5), Varastiq may use the following, only after it has been de-identified or aggregated, to train, evaluate, test, and improve the machine-learning and AI models that power the Service:

• Customer content, such as uploaded invoices and extracted data, recipes, menus, inventory items, and the prompts you send to Vara.
• Feedback and corrections on Vara's suggestions and other Output, including whether you accept, reject, or edit a suggestion, the edits you make, ratings (such as thumbs up or down), and corrections you make to extracted data (for example, fixing a misread invoice line).
• Usage data about how AI features are used and how they perform.

We use only de-identified or aggregated data for model training. Before any data is used to train, evaluate, or improve our models, we remove or mask direct identifiers (such as names, emails, and phone numbers) and business identifiers, or aggregate it, so that it does not identify you, your Users, or any individual. We do not train models on identifiable Customer Data or personal information. Separately, we process Customer Data, including through AI providers acting on our behalf, as needed to generate Output and provide AI features to you; this processing is service delivery, not model training.

What we do not do. We do not sell or license Customer Data, or models trained on it, to third parties. We do not make one Customer's identifiable Customer Data, including recipes and costs, available to other Customers through Vara or otherwise.

5.3 Third-party AI providers

Some AI features may be powered by third-party AI model providers we select from time to time. When we use a third-party provider, we send only the information needed to generate the requested Output. Our infrastructure and AI service providers process Customer Data only on our behalf to provide the Service and are not permitted to use it to train their own models.

5.4 Sensitive data

We do not use sensitive personal information (as defined by applicable law), such as government ID numbers or bank account or payment card numbers, for model training. Employee names and identifiers in inventory counts or sales data are removed or masked before any training use.

5.5 Enterprise and contract terms

If your organization has a signed agreement with Varastiq, such as an enterprise agreement, order form, or data processing addendum, that addresses use of Customer Data for AI training or model improvement, that agreement controls over this Section 5.

6. Data Retention and Deletion

We retain personal information and Customer Data for as long as your account is active and as needed to provide the Service, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When your Subscription ends, you may request an export of your Customer Data within 30 days by contacting support@varastiq.com. After that period, we delete Customer Data from our active systems within a reasonable time, except where we must keep it by law. Backup copies are deleted on our normal backup cycle. We may keep de-identified and aggregated information, and models trained before deletion, as permitted by law and Section 5.

7. Security

We use reasonable administrative, technical, and physical safeguards designed to protect information, such as access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and authorities as required by law. Please keep your login credentials confidential, and tell us promptly at support@varastiq.com if you suspect unauthorized access.

8. Data Location

The Service is intended for businesses located in the United States. The Service is hosted in the United States, and we store and process information in the United States.

9. Children

The Service is intended for businesses and for users 18 and older. It is not directed to children, and we do not knowingly collect personal information from children under 13 (or under 16 where applicable law sets a higher age). If you believe a child has provided us personal information, contact support@varastiq.com and we will delete it.

10. Your Privacy Rights and Choices

Depending on where you live, you may have the right to: - access or know what personal information we have about you and how we use and disclose it; - correct inaccurate personal information; - delete personal information; - receive a portable copy of personal information; - opt out of sale, sharing for targeted advertising, or certain profiling (we do not sell personal information or share it for targeted advertising); - withdraw consent where we rely on your consent; and - appeal our decision on your request.

How to make a request. Email support@varastiq.com with "Privacy Request" in the subject line, or write to us at 2883 Executive Park Drive #104, Weston, Florida 33331. We will verify your request using information associated with your account. You may use an authorized agent where the law allows. We will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our decision. If your request concerns Customer Data that a Customer controls (for example, as an employee), we may refer you to that Customer and help them respond.

Marketing. You can unsubscribe from marketing emails using the link in each email. We will still send service-related messages.

11. Third-Party Services

The Service links to and integrates with third-party services, such as Toast and Stripe. This policy does not cover their practices. Please review their privacy policies.

12. Changes to This Privacy Policy

We may update this policy. We will post the updated version at https://varastiq.com/legal/privacy and update the effective date. For material changes, we will notify you in advance by email or in the Service before the change takes effect.

13. Contact Us

Varastiq, Inc.
2883 Executive Park Drive #104, Weston, Florida 33331
Email: support@varastiq.com
Website: https://varastiq.com

14. Additional Disclosures for U.S. State Residents

This section applies to residents of California and other states with comprehensive privacy laws, and supplements the rest of this policy.

Notice at collection. In the past 12 months, we have collected the following categories of personal information, from the sources and for the purposes described in Sections 1 and 2:

Sale and sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16.

Sensitive personal information. We use sensitive personal information only to provide the Service and for other purposes permitted without a right to limit under the CCPA, and we do not use it for model training (Section 5.4).

Retention. See Section 6.

De-identified information. See Section 4.