Privacy Policy

Last updated: 6 July 2026

This Privacy Policy explains how A11yied AB ("Maitro", "we", "us") collects, uses, and protects personal data when you use the Maitro mobile app and related services (the "Service"). We are the data controller for the purposes of the EU General Data Protection Regulation (GDPR). Questions? Contact [email protected].

1. Who the Service is for

Maitro is a business tool for restaurant owners, managers, and staff. It is not directed at children. Accounts are created by restaurant owners, who invite their team members.

2. What data we collect

Account & identity — when you sign up or are invited, we (via our authentication provider, Clerk) collect your name, email address, and the credentials you use to sign in. Your role and the restaurant you belong to are stored to control access.

Restaurant operational data — data you or your team enter to run the restaurant: schedules and shifts, shift pickups and swaps, reservations, floor-plan layouts, opening hours, staff assignments, and messages sent within your restaurant.

Images you upload — photos and images you choose to upload (for example, menu items or your restaurant website).

Subscription & purchase data — when an owner subscribes, our payments partner RevenueCat records subscription status and purchase history, linked to an app user ID derived from your account ID. Payment card details are handled entirely by Apple or Google; we never receive or store them.

Push notification tokens — if you enable notifications, we store a device push token to deliver shift and team notifications.

Device & app data — your device language/region and basic technical data needed to operate and secure the Service.

We do not use analytics, advertising, or cross-app tracking, and we do not collect your location.

3. How we use your data and our legal bases

• To provide the Service (accounts, scheduling, reservations, messaging, notifications, your restaurant website) — legal basis: performance of a contract.
• To process subscriptions — performance of a contract.
• To send transactional emails (e.g. team invitations) via our provider Resend — legitimate interests.
• To secure the Service and prevent abuse — legitimate interests.
• Push notifications — delivered based on your device permission; you can turn them off in your device settings.

4. Who we share data with

We share data only with service providers that process it on our behalf, under contract. We do not sell your personal data.

5. International transfers

Some providers are located outside the EU/EEA (primarily the USA). Where data is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

6. Data retention

We keep your data for as long as your account and restaurant are active. If an account is deleted, we delete or anonymise associated personal data within a reasonable period, except where we must retain certain records (e.g. for accounting or legal obligations).

7. Security

We protect data with encryption in transit (HTTPS), scoped multi-tenant access controls so each restaurant only sees its own data, token-based authentication, and access controls on our infrastructure.

8. Your rights (GDPR)

You have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. To exercise these rights, contact [email protected]. You may also lodge a complaint with your local data protection authority — in Sweden, the Swedish Authority for Privacy Protection (IMY, imy.se).

9. Children

Maitro is intended for use by restaurant businesses and their staff and is not directed at children under 16. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "Last updated" date above.

11. Contact

A11yied AB
Email: [email protected]