Privacy Policy
Version 1.0 · effective 25 October 2026
This Privacy Policy explains how personal data is processed in Margin Flow, an online service for restaurants and cafés. It covers the web account at app.marginflow.biz, the invoice intake Telegram bot @Invoiceinput_bot, the demo at demo.marginflow.biz and the website marginflow.biz. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
1. Who we are, and our two roles
Margin Flow is operated by DAILYCARE LTD, registered in Cyprus under number HE 457941, VAT number 60076698V, at Archiepiskopou Makariou III 232, Apollo Court, 6th floor, Office 602, 3030 Limassol, Cyprus ("we", "us"). Margin Flow is part of the MyHoReCa product line. Contact for all matters, including privacy: support@marginflow.biz.
A "Customer" is the restaurant, café or company that uses Margin Flow. A "User" is a person who logs in to a Customer's account, such as an owner, manager or employee. We act in two roles:
| Role | Whose data | Examples |
|---|---|---|
| Controller (we decide why and how) | people who send an enquiry from marginflow.biz; Users as account holders; contacts at our Customers | enquiries, logins, login and acceptance records, correspondence, our invoices |
| Processor (we act for the Customer) | people whose data appears in a Customer's account: its Users, its suppliers' contact persons, cashiers and other staff in its POS data | invoices, supplier records, POS data, the action log |
If you work for a Customer: the Customer is the controller of the data in its account. It decides what is uploaded and why, and we process that data on its behalf under a Data Processing Agreement. For that data, contact the Customer first. If you contact us, we will pass your request on and help the Customer answer (see section 8).
2. Data we process for Customers (processor role)
Most data in Margin Flow is commercial: invoices, suppliers, prices, purchases, stock, inventory counts, sales, recipes and costing. Some of it contains personal data:
| Category | Data |
|---|---|
| Users | name, login, email, role and permissions, venues a User can see, and an action log (who uploaded or changed what, and when) |
| Invoices and documents | photos, PDF and Excel files and the data read from them. They may show names, signatures and phone numbers of supplier contact persons or other people |
| Supplier records | supplier names and business contacts, which may include a contact person's name, email or phone |
| POS and back-office data | data loaded from the Customer's POS or back-office (for example Syrve or Tillo) on the Customer's instructions, including names of cashiers and other staff linked to voids, deletions and discounts, used to control those operations |
| Labour cost | if the Customer connects IzyShift: aggregated labour cost only, without personal details of staff |
| Telegram | if a User links the invoice bot: Telegram user ID, Telegram name, and the messages and invoice photos sent to the bot |
Special categories of personal data (Article 9 GDPR), such as health data, must not be uploaded.
3. Data we process as controller
| Category | Data | Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|---|---|
| Website enquiries | name, company, email, phone, number of venues, POS system, message | answering the enquiry. Enquiries reach our team by email and Telegram | (b) steps before a contract; (f) legitimate interest |
| User accounts | login, name, email, interface language, role and permissions, password hash, Telegram user ID and name if linked | running logins, authentication | (b) contract with the Customer; (f) legitimate interest in a secure service for the Customer and its Users |
| Login and acceptance records | time, IP address and browser user agent at login and at acceptance of the Terms; version accepted | security, preventing abuse, evidence of access and acceptance | (f) legitimate interest |
| Correspondence | emails and messages with us | support and service notices | (b) contract; (f) legitimate interest |
| Contracts and invoices | Customer contact persons, Orders, invoices, payment records | performing the contract, accounting | (b) contract; (c) legal obligation (tax and accounting law) |
| Product improvement | aggregated or de-identified information, such as invoice recognition quality, errors and speed | improving our products | (f) legitimate interest |
We do not rely on consent for any of the above.
We do not sell personal data, pass it to third parties except the providers in section 5, or use it for advertising. We do not use one Customer's data to serve another Customer. We make no decisions about people based solely on automated processing with legal or similarly significant effects.
Supplier directory. We maintain a directory of suppliers in Cyprus with publicly available information, such as supplier names and business contact details, and may show it to all Customers. A Customer's prices, volumes, terms and invoices are never shown to other Customers.
4. Where data comes from
- From you: enquiries, logins, use of the Service and the bot, messages to us.
- From the Customer: User accounts and uploaded documents.
- From systems the Customer connects: its POS or back-office and, if connected, IzyShift (aggregated labour cost only).
- From Telegram, if you link the bot: your Telegram user ID and profile name.
5. Recipients and sub-processors
Inside a Customer's account, data is visible according to the permissions set by the master account. Outside it, we use these providers (full details on the Sub-processors page):
- Hetzner Online GmbH: hosting on Hetzner Online GmbH servers in the EU (Germany and Finland);
- OpenAI: invoice recognition. Invoice images, PDF files and extracted text are sent to the OpenAI API to extract fields;
- Telegram: the invoice bot, only for Users who link it, and delivery of website enquiries to our team;
- Namecheap, Inc.: service emails such as password resets and email confirmations, and our mailbox;
- Google: storage of backups encrypted on our side, which Google cannot read.
We may also disclose data where the law requires it, or to protect our rights. If our business is transferred, data may pass to the successor under the same commitments. The Customer's POS provider (for example Syrve or Tillo) works for the Customer, not for us.
6. International transfers
Our application and database are hosted in the EU. OpenAI, Google and Namecheap may process data in the United States. For these transfers we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, on the EU–US Data Privacy Framework.
Telegram may process data outside the EEA under its own terms and does not offer data processing terms to bot operators. Linking the bot is optional: you can upload invoices through the web account, and then nothing about you is sent to Telegram.
7. How long we keep data
| Data | Retention |
|---|---|
| Customer Data (processor role) | while the Customer's account is active; then 90 days for a final export; then deleted or anonymised |
| User login | while the User has access. Deleted when the master account removes it, or on request to support@marginflow.biz |
| Login records | as long as needed for security and as evidence of access |
| Acceptance records | while the Customer's agreement is in force, and afterwards for the period in which claims may be brought |
| Website enquiries | as long as needed to answer the enquiry and any discussion that follows |
| Contracts, invoices, payment records | for the period required by Cyprus tax and accounting law |
| Encrypted backups | overwritten within up to 60 days |
8. Your rights
Under the GDPR you have the right to access, rectify and erase your personal data, to restrict its processing, to data portability, and to object to processing based on legitimate interests.
- Data in a Customer's account. Contact the Customer. If you write to us, we forward your request to the Customer and help it respond. We cannot decide for the Customer what records it must keep.
- Data we hold as controller. Write to support@marginflow.biz. We answer within one month, extendable by two months for complex requests, in which case we will tell you. We may ask you to confirm your identity.
- Deleting your login. Write to support@marginflow.biz or ask the Customer's master account.
You may lodge a complaint with the Commissioner for Personal Data Protection of Cyprus, 15 Kypranoros Street, 1061 Nicosia (postal address: P.O. Box 23378, 1682 Nicosia), www.dataprotection.gov.cy, commissioner@dataprotection.gov.cy, or with the authority in the EU country where you live or work.
9. Security and breaches
Our measures include TLS encryption in transit, hashed passwords, limits on login attempts, separation of each company's data, role permissions set by the master account, an action log, encrypted backups, server access by keys only, and hosting in the EU.
No system is perfectly secure. If a breach affects data we hold as controller, we notify the supervisory authority within 72 hours where Article 33 GDPR requires it, and affected individuals where Article 34 GDPR requires it. If a breach affects Customer Data, we notify the Customer as set out in the DPA.
10. Cookies
marginflow.biz sets no cookies. app.marginflow.biz uses only strictly necessary cookies:
| Cookie | Purpose |
|---|---|
| Session | keeps you logged in |
| Language | remembers the interface language |
| Venue / company | remembers the venue or company you selected |
| Demo session (demo.marginflow.biz only) | runs the view-only demo session |
There are no analytics or advertising cookies and no third-party trackers. Strictly necessary cookies do not require consent. If you block them, you cannot log in.
11. Changes
We may update this policy. Material changes are announced in the Service or by email at least 30 days in advance, unless the law requires a change sooner. The version and effective date are shown at the top.
12. Contact
DAILYCARE LTD, Archiepiskopou Makariou III 232, Apollo Court, 6th floor, Office 602, 3030 Limassol, Cyprus. Email: support@marginflow.biz.