Privacy policy

Privacy Policy – Tech Sprints Pty Ltd trading as RestoGenius

Tech Sprints Pty Ltd (ABN 64 678 652 554), trading as RestoGenius (“RestoGenius”, “we”, “us”), is committed to handling personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy applies to venue operators who use our platform (“merchants”), customers who order through a RestoGenius-powered venue (“diners”), and visitors to restogenius.com and our apps.

1. Information we collect

We collect only the personal information reasonably necessary for our services. Depending on how you deal with us, this may include:

• Merchants: name, email, phone number, business name and address, ABN, billing references and account activity.
• Diners: name, contact details and order details provided when ordering at a venue, online or by QR code.
• Website visitors: details you enter in our forms and booking calendar (such as name, email, phone, venue name and location, preferred call time and message), and technical information such as IP address, browser and device type.
• Usage information: device type, IP address and how you use our apps and website. Google Analytics and Meta Pixel information is collected only if you accept cookies (section 4).
• Location: used to deliver the service. Location-based advertising requires your separate opt-in.

When you submit a website form, we also record campaign information about how you reached our website, whether or not you accept cookies (section 3).

We never store full card numbers or CVV codes. We do not intentionally collect sensitive information (such as health information).

We collect information directly from you, from venues when you order with them, from our payment and delivery partners, and automatically when you use our website or apps. You can browse our website without telling us who you are. If you do not provide information we need, we may not be able to provide a service, respond to an enquiry, or process an order.

2. How we use your information

We use personal information to:

• operate the point-of-sale system, online ordering and QR ordering;
• process and fulfil orders on behalf of venues;
• respond to enquiries, demo bookings and free trial requests sent through our website, and see which advertising campaigns led to them;
• provide account support and send service updates;
• improve our platform, using aggregated or de-identified data where practicable;
• measure website traffic and advertising performance using Google Analytics and the Meta Pixel, only where you have accepted cookies;
• send marketing communications where you have consented, which you can opt out of at any time; and
• meet our tax and legal obligations, including to the ATO.

We will not use or disclose your information for another purpose unless you consent, you would reasonably expect it and it is related to the original purpose, or the law requires or permits it.

3. Website forms

When you submit a form on our website (to contact us, book a demo, start a free trial or ask for help), the details you enter are sent by email to our team using Amazon Simple Email Service (Amazon SES), a service of Amazon Web Services located in the Asia Pacific (Sydney) region. We use those details only to respond to your request and, if you become a customer, to set up your account.

To protect our forms from spam and automated abuse, we use Cloudflare Turnstile. Before a form is sent, Turnstile checks that it is being submitted by a person rather than a bot. To do this, Cloudflare processes technical information about your browser and device, such as your IP address and browser characteristics. We use Turnstile only for security, so it runs whether or not you accept cookies. Cloudflare’s handling of this information is described in its own privacy policy.

When you submit a form, we also record campaign information from the link you used to reach our website: UTM tags, Google click identifiers (gclid) and Meta click identifiers (fbclid). This shows us which advertising led to your enquiry. We record this information whether or not you accept cookies, and we share the click identifiers with Google and Meta so they can report which of our ads led to enquiries.

After you book a demo, the thank-you page shows a booking calendar provided by Microsoft Bookings, embedded in our page. When the calendar loads, Microsoft receives technical information such as your IP address and browser details. If you choose a time, the details you enter (name, email, phone, venue name and location, and your chosen time) go directly to Microsoft and are stored in our Microsoft 365 account so we can schedule your call. Microsoft’s handling of this information is described in its own privacy statement.

We keep form submissions, including the emails our team receives, for 2 years.

4. Cookies and similar technologies

Our website uses cookies and similar technologies. Analytics and marketing tools load only after you choose to accept them.

Category	What it does	Tools	When it runs
Essential	Login, security and remembering your cookie choice	Our own cookies	Always; cannot be switched off
Analytics	Shows us how visitors use the website so we can improve it	Google Analytics	Only after you accept
Marketing	Measures the results of our advertising and helps show relevant ads	Meta Pixel	Only after you accept
Tag management	Loads our other website tools and applies your cookie choice	Google Tag Manager	Every visit

On your first visit we ask whether you accept analytics and marketing cookies. This is a single choice covering both categories. Until you accept, Google Analytics and the Meta Pixel do not load. We remember your choice for 12 months, then ask again.

Google Tag Manager loads on every visit so it can apply your cookie choice. It does not load Google Analytics or the Meta Pixel until you accept, but when it loads, Google receives technical information such as your IP address and browser details. Campaign information sent with our forms is not stored in cookies and is described in section 3.

You can change your choice at any time using the “Cookie settings” link at the bottom of every page. Withdrawing consent stops further collection; information already sent to Google or Meta is handled under their own policies and settings. You can also block cookies in your browser, although some parts of the website may then not work.

In our apps: location-based advertising needs a separate opt-in. Declining will not affect your access to the app.

5. Who we share information with

We share personal information only with service providers who help us run our services, and only as needed for that purpose.

Recipient	Purpose	Location
Tyro, Till Payments and Linkly	Payment processing (PCI DSS certified)	Australia
Uber Eats	Delivery integration	Australia and USA
Amazon Web Services	Platform hosting and storage	USA and Singapore
Amazon Web Services (Amazon SES)	Delivering website form emails to our team	Australia (Sydney)
Cloudflare	Spam and bot checks on website forms (Turnstile)	Global network, including USA
Google (Google Tag Manager, Google Analytics)	Loading website tools on every visit; website analytics only with your consent; receiving click identifiers from forms	USA and other countries
Meta Platforms (Meta Pixel)	Advertising measurement with your consent; receiving click identifiers from forms	USA and other countries
OpenAI and Anthropic	AI tools used for research and product development	USA
Microsoft (Microsoft Bookings)	Scheduling demo calls booked on our website	Australia

We may also disclose information to our professional advisers, or to regulators, courts and law enforcement where the law requires or permits it.

Where information is sent overseas, we take reasonable steps to make sure recipients handle it in line with the APPs, including through data processing agreements or equivalent contract terms with each recipient.

We never sell, rent or trade your personal information.

6. Payment security

Your card is tokenised at the point of payment, and we never store full card numbers or CVV codes. Payments are encrypted in transit using TLS 1.2 or higher and processed by PCI DSS-certified partners.

7. Online and QR ordering

When you order from a venue using RestoGenius, the venue is responsible for your order information. We handle it on the venue’s behalf to process your order.

• Your order information is visible only to the venue you ordered from; no other merchant can access it.
• We use your contact details only to fulfil your order, never for our own marketing.
• To access or delete your order information, contact the venue, or email us at legal@techsprints.com.au and we will help.

8. AI and automated decisions

We use AI tools from OpenAI and Anthropic, hosted in the USA, for research and product development.

We do not use computer programs, including AI tools, to make decisions about individuals, or to do anything substantially and directly related to making such decisions.

If this changes, we will update this policy before the new use begins.

9. Your rights

• Access: request a copy of your personal information, free of charge. We respond within 30 days.
• Correction: ask us to correct information that is inaccurate, out of date or incomplete. We respond within 30 days.
• Deletion: ask us to delete your information. We will do so within 30 days of acknowledging your request, unless we must keep it by law.
• Opt out: unsubscribe from marketing at any time with one click, and change cookie choices via “Cookie settings”.
• Complain: contact us first. We aim to respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC).

We may need to verify your identity before acting on a request.

Email: legal@techsprints.com.au · Phone: 1300 198 789

OAIC: www.oaic.gov.au · enquiries@oaic.gov.au · 1300 363 992

10. Security and data breaches

• Encryption in transit using TLS 1.2 or higher, and industry-standard encryption for stored data.
• Role-based access controls, so only authorised staff can access personal information.
• A tested data breach response plan.

If we suspect a data breach, we assess it within 30 days. If it is likely to result in serious harm, we notify you and the OAIC as soon as practicable, with details of what happened and steps you can take to protect yourself.

11. Data retention

Information	How long we keep it
Financial records	7 years (ATO requirement)
Account data	Account term plus 2 years
App analytics	12 months
Website form submissions	2 years
Google Analytics data	14 months
Cookie choice	12 months

When a merchant account is closed, we delete or de-identify the account’s data within 90 days, except records we must keep by law (such as financial records).

12. Changes to this policy

We will email account holders about material changes at least 14 days before they take effect, and publish the updated policy on our website with its effective date.

13. Governing law

This policy is governed by the laws of Queensland and the Commonwealth of Australia, including the Privacy Act 1988 (Cth).

14. Contact us

For privacy questions, requests or complaints, contact our Privacy Officer:

Email: legal@techsprints.com.au

Phone: 1300 198 789 (within Australia)

Address: Brisbane QLD 4000, Australia

For more about your privacy rights, visit the Office of the Australian Information Commissioner.