Draft ยท not effective
Privacy Policy
How the proposed Syrup service handles information across its website, management tools, and connected Fire TV player.
Document version: 2026-10-01-draft-1
Effective date: not yet set
Provider and scope
This draft concerns Syrup, a digital-menu service proposed to be operated by [PROVIDER FULL LEGAL NAME], an individual doing business as Syrup, at [BUSINESS MAILING ADDRESS], [STATE, COUNTRY]. Privacy contact: [MONITORED PRIVACY EMAIL]. These placeholders must be replaced before this notice becomes effective. Syrup is intended for adults acting for US businesses; a business-only audience does not eliminate privacy rights held by individual users.
Services covered
This notice covers the public website, account-management application, published menu pages, and Syrup Fire TV application, including the hosted player loaded by that application. Visitors who only view public menus may generate network and device information. Amazon, payment providers, connected POS providers, and other independently operated services have their own privacy notices for their own processing.
Account and organization information
When you register or use management features, we process information such as your name, email address, password in hashed form, email-verification status, authentication credentials, organization and venue membership, roles, and account settings. If you enable passkeys or two-factor authentication, authentication records are stored to operate those features. Organization administrators can manage access within their organizations. Do not share your password or recovery codes.
Menus, uploads, and public content
We process the menu text, prices, product details, venue information, images, videos, board designs, and other content you provide. Published menu links and their assets may be accessible to anyone with the link and may be copied or cached by others. A link is not a confidentiality control. Do not publish customer records, payment details, or other sensitive personal information. Private drafts and publicly published content have different access rules.
Connected screens and local storage
The Fire TV app processes pairing challenges, a device access credential, screen and venue identifiers, assignment information, app/device details, and connectivity information needed to pair and display a board. Internet requests also expose network information such as an IP address to receiving infrastructure. The app stores credentials and prepared menu/media copies locally for playback and recovery. The reviewed Android manifest requests Internet access; it does not request camera, microphone, contacts, or location permissions. A later release must be assessed independently.
Billing and transactions
Paid subscriptions are associated with the organization account. Stripe processes checkout, payment methods, and billing-portal interactions. Syrup stores subscription/customer identifiers, subscription state, and limited payment-method information such as type and last four digits; the application is not designed to store full card numbers or security codes. Transaction, invoice, and tax records may be retained to meet financial obligations. Confirm the final Stripe account configuration and retention practices before publication.
AI features
When you request AI-assisted board creation or refinement, the service may send your instructions, selected menu/business context, uploaded references, generated candidates, and board review images to configured AI providers. The repository supports OpenAI and other configurable providers; the actual production providers must be identified before publication. Conversations, generated results, evaluation traces, and selected review artifacts may be retained for service operation, debugging, and quality review. Do not submit sensitive personal information or content you are not authorized to share. This draft does not promise that providers never retain inputs or use them for training; their applicable contracts and settings must be verified.
POS connections
If an authorized operator connects a supported point-of-sale service, Syrup processes connection credentials and configured catalog, price, availability, and synchronization data to operate the integration. Provider APIs and the selected integration determine the information received. This notice does not represent that Syrup collects diner or cardholder data. Confirm actual production API scopes, payloads, and any retained webhook data before publication.
Usage, diagnostics, and cookies
Essential session and security cookies support login, CSRF protection, and account security. Browser storage also supports product preferences and identifiers. The code supports optional Mixpanel and Google Analytics event reporting and Sentry diagnostics when configured. Mixpanel is configured without automatic event capture or session replay and with its IP-enrichment option disabled; that does not mean network recipients never receive an IP address. Server analytics can report governed account and subscription events. Production activation, cookie lifetimes, vendor settings, applicable opt-out obligations, and privacy controls still require verification. No analytics preference interface is delivered by these drafts.
Purposes
We use information to provide accounts and digital menus; authenticate operators and devices; synchronize connected systems; deliver support and service messages; administer billing; investigate failures; protect against fraud and abuse; and comply with legal obligations. Any optional analytics or marketing use must be accurately disclosed and supported by the choices required by applicable law. Acknowledging this notice at signup is not consent to unrelated marketing or every form of data processing.
Recipients and disclosures
Information may be processed by hosting, database, storage/CDN, email, billing, diagnostics, analytics, and AI service providers to operate the service. Authorized organization users may access information within their roles. Public content is available to its audience. We may disclose information when reasonably necessary to comply with law, protect rights or safety, or in connection with a business transfer, subject to applicable protections. Confirm the production vendor inventory, contracts, processing locations, and any sale or cross-context advertising practices before making a no-sale or no-sharing representation.
Retention and deletion
Retain information only for the purposes described and for justified legal, accounting, security, or dispute needs. A final category-specific retention schedule is not yet approved. Repository defaults currently include 30 days for raw AI evaluation artifacts, 7 days for evaluation screenshots, and 30 days for delivered server analytics records; these are configured cleanup targets, not verified production deletion guarantees. Other records and vendor copies may have different lifetimes. Backup configuration can retain annual copies for two years and must be reviewed before promising shorter deletion timelines.
Your choices and requests
You can manage available profile and organization settings and cancel subscription renewal through the available billing workflow. Rights to access, correct, delete, obtain a copy, or limit certain processing depend on applicable law and may require proportionate identity verification. The final contact and request process will be published here. [MONITORED PRIVACY EMAIL] is a placeholder, not a working request channel. Self-service account deletion and a verified support deletion process are not yet implemented. Deleting a venue, disconnecting a screen, canceling billing, and deleting your login are separate actions.
Shared data and offline copies
Account deletion must account for shared organizations, ownership, billing, and personal information in service-provider systems. Information owned by an organization may remain for its authorized users after a member leaves, with personal attribution handled according to applicable requirements. Revoking a device credential cannot immediately erase an offline TV or copies already made by others. The future deletion workflow must explain any retained records, backup expiry, local reset steps, and completion status.
Security and processing locations
We use technical and organizational measures appropriate to the service, including authenticated access and access controls. No service can guarantee absolute security. Do not send passwords, active pairing codes, access tokens, or payment-card information in support messages. Production hosting locations, subprocessor safeguards, and any international processing must be confirmed and disclosed before this notice becomes effective; US-only marketing does not guarantee US-only storage.
Children
Syrup accounts are intended for people at least 18 years old who can act for a business. The account service is not directed to children under 13 and is not designed to solicit their personal information. If we learn that personal information was collected from a child in violation of applicable law, we will take appropriate action. A business may display public menus in places visited by children; that does not make those viewers account holders.
Changes and contact
The finalized notice will carry an effective date and version. Material changes will be communicated as required by law, and prior effective versions will remain available. The final provider identity, address, monitored privacy contact, applicable state-law disclosures, and request procedures must be completed before publication. This draft is not a statement that all privacy laws apply, or that the service has been certified compliant.