Privacy Policy

1. Our Privacy Commitment

Lineflow Technologies recognizes that restaurant menus, ingredient ratios, prep SOPs, and employee rosters constitute highly confidential business assets. This Privacy Policy outlines our strict policies regarding the collection, processing, and protection of personal and proprietary culinary data across the MenuOps application.

2. Information We Collect

• Account Credentials: Work email address, full name, role (Admin, Manager, Staff), and Argon2id cryptographically salted password hashes.
• Restaurant Tenancy Data: Restaurant corporate name, physical address, kitchen station categories, brand logos, and billing records.
• Uploaded Culinary Content: PDF menus, high-resolution recipe photos, ingredient rosters, supplier spec sheets, and wine pairing notes.
• Training & Operational Telemetry: Quiz completion rates, staff allergen awareness scores, search query timestamps, and verification audit trails.

3. How We Process Your Data

We process tenant data exclusively to deliver and maintain the MenuOps platform:

• Extracting text, ingredients, and regulatory allergens using fine-tuned multimodal Gemini models.
• Generating vector embeddings stored in tenant-isolated PostgreSQL pgvector tables for real-time staff retrieval.
• Compiling staff training performance and automated quiz analytics for restaurant managers.
• Ensuring cryptographic audit verification logs for food safety inspections.

4. Data Roles Under UK & EU GDPR

Under the UK GDPR and EU General Data Protection Regulation (Regulation (EU) 2016/679):

• Subscriber as Data Controller: The subscribed restaurant entity acts as the Data Controller with respect to employee personal data (staff emails, quiz scores).
• Lineflow Technologies as Data Processor: Lineflow Technologies acts as the Data Processor, processing staff credentials and operational data solely on the documented instructions of the restaurant Subscriber.

5. Security & Cryptographic Isolation

We enforce multi-layered defense-in-depth security:

• All passwords hashed using Argon2id with unique cryptographic salts.
• Transport Layer Security (TLS 1.3) enforced for all browser connections and API calls.
• PostgreSQL multi-tenant row-level isolation ensuring zero cross-tenant vector leakage.
• Automated hourly snapshot backups stored in geographically distributed, encrypted vaults.

6. Data Subject Rights & Deletion

Restaurant managers and staff retain full rights under GDPR to access, rectify, or request the complete deletion of their account records. Upon subscription termination, all tenant menus, recipes, vector embeddings, and audit logs are permanently wiped from production databases within 30 days.

7. Contact Our Data Protection Officer (DPO)

If you have any questions, Data Subject Access Requests (DSAR), or privacy inquiries, contact our Data Protection Officer directly: