Privacy Policy

1. Who this policy covers

Ybarra Hospitality Group ("we," "us," or "our") operates Ybarra KPIS at https://ybarrakpis.netlify.app/. This policy describes information handled through the app, including information about authorized employees, managers, reviewers, suppliers, and service technicians.

This policy concerns this app. Other company websites, employment records held outside the app, and services you visit separately may have their own notices. The app is intended for authorized business use and is not directed to children under 13.

2. Information handled

• Account and access details: names, approved phone numbers, contact details provided to us, roles, restaurant assignments, access permissions, and sign-in records.
• Business records: uploaded invoices, receipts, credits, supporting images and PDFs, supplier details, sales and labor reports, employee or payroll information present in those reports, inventory, budgets, and review or approval history.
• Maintenance and messages: repair descriptions, photos, assigned technicians, contact numbers, message contents, replies, delivery status, and opt-out preferences.
• Connected-service information: authorized company or account identifiers, vendors, accounting accounts, transactions, source reports, export receipts, and authorization tokens needed for the enabled connection.
• Technical information: session information, browser-stored drafts and preferences, request and error logs, and information such as IP address and browser details that hosting or service providers receive when handling requests.

Information comes from users, authorized administrators, uploaded documents, and enabled integrations. Imported public review information may include reviewer names and review text. Please avoid including personal information that is not needed for the task.

3. How we use it

We use information to verify access, enforce location permissions, prepare reports, scan and review documents, maintain business records, coordinate repairs, send requested operational messages, and perform authorized accounting and document-filing workflows. We also use it to investigate errors, protect accounts, and support audit and recordkeeping needs.

Document scanning sends the uploaded originals and relevant product rules to the configured AI provider to propose extracted information and check source values. Automated results require human review and do not themselves approve an invoice.

4. Sharing and service providers

Information is available to authorized personnel according to their roles and store access. Features may also share the information necessary for their operation with these providers:

• Netlify: application hosting, private storage, and server processing.
• Twilio: phone verification and operational text delivery, replies, and delivery or opt-out records.
• OpenAI: invoice and document interpretation when AI scanning is enabled, including the uploaded originals and relevant instructions or product rules.
• Dropbox: original documents, filenames, folder paths, and filing metadata when document archiving is connected.
• Intuit QuickBooks: the company, vendor, account, transaction, and attachment information needed for the authorized accounting connection. Approved invoice exports create bills or vendor credits in the selected company.
• Toast and Google services: authorized sales or labor imports and public review information for enabled reporting features.

Each provider processes information under its applicable service terms and privacy practices. Connections and features determine which providers receive information; not every provider receives every record. People who receive an authorized export or message can retain their own copy.

We may disclose information when legally required or as necessary to investigate misuse and protect the app, its users, or others. This app does not provide advertising or data-sale features.

5. Storage, browser data, and security

The app's current server processing and private storage are hosted through Netlify in the United States. Connected providers may process information in other locations under their own arrangements.

The app uses a secure sign-in cookie and browser storage for operational purposes such as sessions, preferences, local workspaces, and unfinished drafts. Clearing browser data can remove unsaved work; it does not erase server records or provider copies.

Safeguards include HTTPS, server-enforced account and store permissions, and encrypted storage for invoice QuickBooks authorization tokens. No system can guarantee complete security. Protect your devices and report suspected unauthorized access promptly.

6. Record retention

We retain information for the business, accounting, audit, security, and legal purposes for which it is needed. Retention depends on the record and applicable obligations; this app does not apply a single automatic deletion period to all records.

Deleting an invoice draft or maintenance message from the app's ordinary views may preserve the original record, deletion marker, and history. Disconnecting QuickBooks or Dropbox does not automatically erase documents or transactions already saved there. A privacy deletion request is a separate process from these app controls.

7. Your choices and requests

Contact us below to request access to, correction of, or deletion of personal information, or to ask about its use. We may need to verify your identity and authority. We assess requests under applicable law and may retain information required for accounting, legal obligations, security, or the rights of others. Where applicable law provides additional rights or an appeal, you may request them through the same contact.

Ask your administrator to change app access or assignments. The authorized owner can manage the invoice accounting connection at QuickBooks setup by selecting the restaurant and choosing Disconnect. An authorized provider administrator can also manage access in the connected provider account.

Sign-in text consent is separate from optional maintenance alerts. Reply STOP to stop maintenance texts or contact us for help. Your carrier's message and data rates may apply. Stopping texts does not delete past messages or records.

8. Contact and policy updates

We will post policy updates here with a revised effective date and provide additional notice or seek consent when required. You can also read our End User License Agreement.