Privacy Policy

OpenRate is operated by Mammeri Growth Development Inc., a corporation, Québec enterprise number (NEQ) 1180954951. Business address: 6-4825 rue Ontario E, Montréal (Québec) H1V 1L8, Canada. This policy covers www.openrate.ca, app.openrate.ca and pay.openrate.ca.

Youva Mammeri, CEO of Mammeri Growth Development Inc., is the person in charge of the protection of personal information by default. Contact him at privacy@openrate.ca or to his attention at the business address above. Jason Greige receives and coordinates requests, support and complaints. To protect your information, limit your message to details relevant to your request and keep your credentials and card data confidential.

In this policy, “privacy officer” means the person in charge of the protection of personal information: the person who oversees the company’s privacy obligations and practices and ensures that personal information requests are handled. This role is held by the person with the highest authority in the company or the person to whom that role has been delegated in writing.

The restaurant is the merchant providing the meal and receiving funds in its own Square account. It determines bill information, team access and use of customer contacts. OpenRate supplies software and processes information needed for functions requested by the restaurant. OpenRate also manages its own user relationships, support and service security. Each party remains responsible for its obligations under applicable law.

Square processes payments and performs its own functions, including security and fraud prevention, under its terms and notices. Restaurants and external services have their own practices. Contact the restaurant about a bill, refund or message it sends you; OpenRate can help identify the processing involved.

Visitors and support: the contact details, restaurant concerned and content of requests you provide are used to respond. Hosting processes network and technical information, such as IP addresses, requests, errors and browser characteristics, to deliver pages, diagnose problems and protect the service. Website measurement is described under “Cookies and browser storage”.

Payers: the restaurant and connected systems provide table and bill references, available items and amounts, taxes and the balance. Your split, partial amount, tip and payment method choices, together with payment and refund references, dates and statuses returned by Square, support processing, reconciliation, history and transaction assistance.

Your name and email are requested for every payment to identify the payment and link your visits to the restaurant. With Apple Pay or Google Pay, these details may come from the wallet when it supplies them; manual entry is requested if they are missing or invalid. The contact is associated with the payment and recorded in the restaurant’s contacts after confirmation, even without an email receipt request or marketing consent.

This lets the restaurant view the payment history associated with your visits, including dates and amounts, and find the recorded transactions. Matching relies on the email declared within the establishment concerned. The history records payments: a visit may involve several payments, and only visits associated with a recorded payment appear. This use of history is separate from sending receipts and promotions.

Name and email are required fields in the current digital flow. The restaurant can explain other ways to settle your bill.

Square’s secure fields handle card information. OpenRate uses a token and transaction references; payment records in this flow do not contain the full card number or security code. Payment and wallet providers process information needed for their functions.

Accounts and staff: users, administrators and Clerk supply account identity, contact details, sign-in identifiers, invitations, organizations, establishments, roles and permissions to authenticate people and manage access. Service sessions, devices and assignments can be associated with bills, payments, tips, refunds and customer ratings to present operational statistics to the restaurant. Staff can ask their employer for details of its use of this information.

Ratings and feedback you choose to provide, their service context and review-link interactions are used to collect customer feedback and present results to the restaurant. Restaurants can upload menus, images and establishment information for display in the service.

Recording the contact and linking it to history accompany payment. An email receipt is sent only if you request it: the corresponding checkbox is optional and requests receipt delivery to the supplied address, not promotions. Delivery information and sending errors support receipt follow-up. A downloadable receipt may be offered after confirmation; keep its link private, as someone holding a valid link can access the receipt.

Restaurant promotions may only be sent to you with your separate, optional consent, which you can withdraw at any time. The checkbox is not selected by default. When you subscribe, we record consent status, date, source, language, the wording presented and its version as evidence. Paying, requesting a receipt or leaving feedback does not constitute marketing consent.

Leaving a marketing checkbox unselected creates no new consent and does not withdraw earlier consent. To unsubscribe, use the mechanism in a promotion you receive, contact the restaurant or write to privacy@openrate.ca with the restaurant and email address concerned. Withdrawal does not by itself delete transaction records that must be kept. Exporting contacts does not authorize promotions to people who have not subscribed.

Your name, email and associated history are accessible to authorized users of the restaurant concerned, according to their roles and the establishments they can access. History is not open to all restaurants or made public by simply entering an email address. Authorized people at OpenRate may also access this information for operations, support and security as needed for their duties. Providers involved in processing are described below.

The main providers in the Square flow are Square for merchant account connection, payments and refunds; Clerk for authentication; Google, optionally, for restaurant staff sign-in with a Google account, through Clerk; Supabase for the database, with the production database hosted in Canada (Montréal), and files such as menu images; Resend for service emails, including requested receipts; Sentry, in the United States, for server error monitoring, with personal information removed before sending (no names, emails or payment content); and Vercel for hosting and website measurement. Each receives information relevant to its functions. Disclosure may also be required by law or an applicable legal process.

Providers and their subprocessors may process or make information accessible outside Québec, including elsewhere in Canada and in the United States. This may involve hosting, authentication, emails, payments, support access, logs and backups. Local laws may allow authorities to access information. A database being located in Canada does not mean all copies and processing remain there. Ask the privacy officer for details about providers and processing involving your information.

Links to Google Reviews, Calendly and social networks open external services. When you use them, those services receive information about your visit under their own practices; this policy does not replace their notices.

The website integrates Vercel Web Analytics to measure traffic, pages viewed, visit sources and technical browsing characteristics. Vercel describes this tool as operating without cross-site identification cookies and processing technical browsing data. Microsoft Clarity loading has been removed for new visits. Previously collected data may remain with Microsoft.

The restaurant application uses Clerk’s session mechanisms, an establishment-selection cookie and, on applicable service devices, device and staff-session cookies. They support authentication, access control and continuity of work. A cookie expiring does not delete server data.

Payment uses browser session storage for language and the payment draft, including entered contact details and receipt and marketing choices, to resume the flow in the tab. The application also uses this storage temporarily for certain invitation and device-pairing flows. Square components and wallets may use their own technical mechanisms. The website’s theme component may read the local “theme” key, but the website currently forces the light theme.

You can restrict cookies or clear storage through browser settings. This may interrupt a sign-in, remove a draft or disrupt payment. Clearing the browser is not a request to delete server data. OpenRate does not currently offer a cookie preferences centre.

Our retention rule for a person’s name, email and associated payment history at a restaurant is seven years from their last payment at that restaurant. At the end of that period, destruction or anonymization meeting applicable requirements is handled manually. This rule applies to the history of the restaurant concerned.

This rule is applied manually and reviewed at least once a year. No automatic purge is in place. Deletion or anonymization requests are reviewed and receive a response within 30 days of receipt. This processing period announced by OpenRate covers reviewing the request and explaining the action taken and applicable limits.

Transaction records needed for accounting and tax obligations, including amounts, dates and payment references, are retained separately for the periods required by those obligations, without identifying the person where possible. Records needed for an outstanding transaction, refund or dispute receive a specific retention review.

You can ask the privacy officer to delete or anonymize your information before the seven-year period ends. Requests are handled within legal limits, taking account of the information concerned and applicable retention obligations. The response explains the action taken, information still retained and the reasons, with participation from the restaurant or relevant providers where needed.

Backups are renewed according to the relevant provider’s rotation schedule. Copies may remain until those backups are renewed. Request reviews include relevant copies in backups, logs, restaurant exports and provider systems; their status and applicable constraints are explained based on the information available for the case.

Service measures include authentication and permission controls, organization-scoped access and encryption of integration credentials. They are intended to reduce risks of unauthorized access, loss or disclosure and must reflect the sensitivity of the information and the risks.

If you suspect unauthorized access or disclosure, promptly contact the privacy officer with useful details, without sending payment secrets. Applicable incident obligations include reducing harm, preventing recurrence, keeping an incident register and, where a risk of serious injury exists, notifying affected people and Québec’s Commission d’accès à l’information. Other obligations may apply under relevant laws.

Subject to legal conditions and exceptions, you may request access, correction and communication of computerized information collected from you in a structured, commonly used technological format. You may withdraw consent and request deletion or cessation of dissemination where applicable law allows. Certain necessary or legally authorized processing may continue despite withdrawal; we must explain applicable limits.

To request access, correction or deletion of your information, write to Jason Greige at privacy@openrate.ca or the business address above with your request, the account or restaurant concerned and a way to reply. Jason receives and coordinates requests. The response explains the action taken, information retained and applicable reasons. Proportionate identity verification may be needed. For access or correction governed by Québec’s private-sector privacy law, the response period is 30 days from receipt. A refusal must explain the reasons and applicable remedies and time limits.

You may complain to the privacy officer and, within their respective jurisdictions, Québec’s Commission d’accès à l’information or the Office of the Privacy Commissioner of Canada. Your remedies remain available when you contact OpenRate.

The version date appears at the top of this policy. Material changes will be brought to your attention through an appropriate means as required. New consent will be sought where required; publishing new wording alone does not constitute consent to a new purpose.