Privacy Policy

The short version

• We collect what we need to run AGM for your restaurant: account details, the restaurant and employee information you enter or connect, and basic technical logs.
• We do not sell personal information.
• AGM never moves money or posts anything without an owner’s approval, and keeps a record of those approvals.
• We do not store your passwords for the services you connect. You sign in to them yourself in a browser session.
• A small set of companies help us run AGM (listed below). An optional AI model provider may see review text or questions, with secrets removed first.
• Each restaurant’s data is kept separate from every other restaurant’s. Employees have limited access.

What we collect

• Account information: your name, email address, restaurant name, role, and a password (stored only as a one-way hash, never in readable form).
• Restaurant information you enter or connect: sales, labor, schedules, bills and vendor information, inventory, menu and recipes, reviews, marketing content, targets and settings.
• Employee information entered by the restaurant: names, contact details, roles, availability, schedules, time punches, and pay rates. See “Employee information” below.
• Guest information the restaurant adds: for example email addresses or phone numbers and opt-in status for marketing messages.
• Approvals and activity records: who approved what, and when, plus audit trails for payments, edits and posts.
• Technical information: request logs (time, page, device/browser type, IP address and a request ID), kept for security and fixing problems. We scrub passwords and keys from logs.
• Messages and support: what you send us when you contact us, and records of the emails and texts AGM sends.

The marketing website does not load third-party trackers or advertising scripts. The app uses a cookie to keep you signed in.

How we use it

• To provide, secure and improve AGM: your brief, schedules, reports, reminders, drafts and approvals.
• To send emails and texts about your account and the things you ask AGM to send.
• To make backups, prevent abuse, and fix errors.
• To answer your questions and keep records we need for business and legal reasons.

We do not use your restaurant’s data to advertise to you or others, and we do not sell it.

Who helps us run AGM

We share information only with service providers who help us run AGM, and only as needed:

• Render — hosting and databases.
• Cloudflare R2 — storage of encrypted backups.
• Resend — sending email.
• Twilio — sending text messages.
• An optional third-party AI model provider — not used unless we turn it on. If we do, it may receive review text or the question you typed, plus the facts needed to answer, with passwords, keys and card-like numbers removed first. It does not receive your whole database or your connection credentials.

We may also share information if the law requires it, to protect people or our rights, or as part of a sale or reorganization of the business (we would tell you). We will update this list if the providers change.

Connecting your other accounts

When you connect a POS, scheduling tool, distributor, bank or other service, you sign in yourself in a browser session. AGM does not ask for and does not store those passwords. We keep the status of the connection and, where an integration needs a key or token, we store it encrypted with a key held separately from the data. AGM reads only what it needs for the features you use.

Employee information

Restaurants add information about their employees. For that information the restaurant is in charge of why and how it is used, and AGM acts on the restaurant’s behalf to store and process it. Employees see only their own schedule, time clock and inventory counts, not other people’s pay. Managers cannot see bills, payments, P&L, bank details or connections.

If you are an employee and want to see, correct or delete your information, please ask your employer first. You can also email us and we will pass your request to the restaurant or help as the law requires.

[Attorney: review roles (controller/service provider), employee notice duties, and any state-specific employee-data rules.]

How we protect information

• Connections to AGM use HTTPS.
• Connection credentials are encrypted. Passwords are stored only as one-way hashes.
• Each restaurant’s data is kept separate, and access depends on role.
• Backups are encrypted before they are stored.
• Logs are scrubbed of secrets.

No system is perfectly secure, and we cannot promise absolute security. We have not claimed any security certification or audit for AGM. If a breach affects your information, we will notify you as required by law, including Florida’s data-breach law.

How long we keep it

We keep your information while your account is active. After you cancel, you can ask for a copy of your data for 30 days; then we delete or de-identify it, except where we must keep records (for example billing, security or legal records) or it remains in backups until those backups expire.

[Attorney/owners: confirm retention periods, including backup expiry.]

Your choices and rights

You can ask to see, correct, export or delete your information, and you can opt out of texts by replying STOP or of marketing emails with the unsubscribe link. Email team@stirhospitality.com or call 1-800-858-2488.

California and other state privacy laws. Depending on where you live, you may have the right to know what we collect, to access, correct or delete it, and not to be treated unfairly for using these rights. We do not sell personal information and we do not share it for cross-context behavioral advertising. We handle restaurant, employee and guest data as a service provider for the restaurant. We will answer requests as the law requires and may need to confirm who you are first.

[Attorney: confirm which state privacy laws apply to AGM, whether a CCPA/CPRA notice at collection and a request process are required, and whether the Florida Digital Bill of Rights applies given our size and activities.]

Children

AGM is for businesses and is not meant for people under 18. We do not knowingly collect information from children.

Cookies

The AGM app uses a cookie that keeps you signed in. We do not use advertising cookies. The marketing website sets no tracking cookies.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before it takes effect, and we will update the date at the top.