Privacy policy

Last updated: 23 October 2026

This policy covers the Qavyo website (qavyo.com) and the Qavyo software: the back office, Qavyo POS (Android and web), Qavyo KDS (the kitchen display, Android and web), Qavyo Farm, the staff portal, and the online ordering websites Qavyo runs for businesses. In this policy, “Qavyo”, “we” and “us” means Qavyo, Bekamura, Kazirbazar, Moulvibazar 3200, Sylhet, Bangladesh.

Who is responsible for your data

Data about the businesses that use Qavyo (account owners and their account details): Qavyo decides how this is used, so we are the controller.
Data a business keeps in Qavyo about its own staff and customers (orders, customer details, staff records): the business decides why it is collected, so the business is the controller and Qavyo is its processor. If you are a customer or staff member of a business that uses Qavyo, contact that business first; we will help them answer you.
Website enquiries (contact, sales and 30-day forms): Qavyo is the controller.

What we collect

Whose data	What	Why
Business owners and managers	Name, email, phone, business name and address, sign-in details (passwords are stored only as a one-way hash), plan and billing records.	To run your account, sign you in, bill you and support you.
Staff of a business	Name, role, contact details the business enters, a 4-digit sign-in PIN (stored as a one-way hash), clock-in and clock-out times, a photo taken at clock-in when the business turns that on, shifts, leave, pay rates and payroll records.	To let staff use the till, record hours and pay people correctly, as the business decides.
Customers of a business	Name, phone, email, delivery address, orders, table, notes, loyalty points, ratings, and whether they agreed to marketing.	To take and deliver orders, run loyalty and send messages the customer agreed to.
Payments	Amount, method, time and a reference. Card payments are handled by our payment processor; Qavyo never sees or stores full card numbers.	To record sales and refunds and reconcile the till.
Devices	A device name and pairing key for each till, kitchen screen or print hub; push notification tokens; IP addresses and technical logs.	To keep each device signed in to the right branch, send alerts, and keep the service secure.
Website visitors	What you type into a form: name, work email, business name and type, number of locations, topic and message.	To reply to your enquiry. Nothing is sent until you submit.

How the apps use your device

The Qavyo Android apps ask only for what their features need:

Bluetooth and nearby devices (Qavyo POS): to find and print to receipt and kitchen printers. We do not use it to track your location.
Local network (Qavyo POS and Qavyo KDS): to print to network printers and, when the internet is down, to let kitchen screens read new orders from the till over the shop Wi-Fi.
Notifications: to alert you about new orders, printing problems and things that need attention.
Running in the background and keeping the screen or Wi-Fi awake: so tickets keep printing and the kitchen board keeps updating during service.
Camera: only for a clock-in photo, when the business has turned that on.
Location (staff portal): only if the business turns on location checks for clocking in; the location is checked at clock-in, not tracked.

When the internet is down, Qavyo POS keeps the sales it takes on the device until they reach our servers, and Qavyo KDS keeps the last kitchen board and the presses made on it. This data stays on the device and is sent to Qavyo as soon as the connection is back.

Qavyo Intelligence and AI features

Qavyo Intelligence (morning brief, weekly review, menu and pricing tips) and the Qavyo Farm advisor use an AI service to write their suggestions. For this we send business figures such as sales, stock, menu items and farm records to an AI provider through OpenRouter. We do not send customer contact details for this. The provider processes the request to return the suggestion. Suggestions are advice only: you decide what to do.

Who we share data with

We do not sell personal data and we do not use it for advertising. We share it only with the services that help us run Qavyo:

Hosting: the servers that run Qavyo and store its databases.
Stripe: card payments and subscriptions.
Google Firebase Cloud Messaging: push notifications to the Qavyo apps.
Resend: emails such as receipts, alerts and replies to enquiries.
Twilio, Telnyx and Infobip: text messages a business sends to its customers who agreed to receive them.
OpenRouter and the AI model providers it uses: the AI features above.
Open-Meteo: weather for Qavyo Farm, using only the farm’s area, never a person.

We may also share data when the law requires it, or to protect people, Qavyo or our customers from fraud or harm.

International transfers

Some of these services are based outside your country, including outside the European Economic Area. Where that happens we rely on the safeguards the law provides, such as the European Commission’s standard contractual clauses.

How long we keep data

Account and business data: while the account is active, then deleted or anonymised within 90 days of closing it, unless the law requires us to keep it longer.
Sales, payment and payroll records: as long as tax and accounting law requires (often 6 to 7 years), on behalf of the business.
Website enquiries: up to 24 months after our last contact with you.
Technical logs: up to 90 days.

Keeping data safe

Data is encrypted between your device and our servers. Passwords and PINs are stored only as one-way hashes. Each business’s data is kept apart, and every device and user can reach only the business and branch it belongs to. Access by our team is limited to what is needed to run and support the service.

Your rights

Depending on where you live (for example under the GDPR in Ireland and the EU), you can ask to access, correct, delete or export your personal data, object to or restrict how it is used, and withdraw consent at any time. Customers can stop marketing messages with the link or reply word in each message.

To use these rights, see delete your data or email ashraful@qavyo.com. If you are a customer or staff member of a business that uses Qavyo, the business handles your request and we help them. You can also complain to your data protection authority; in Ireland that is the Data Protection Commission.

Children

Qavyo is a tool for businesses and is not meant for children. We do not knowingly collect data from children under 16.

Cookies

This website does not use advertising or analytics cookies, and its fonts are served from our own server. The Qavyo apps store a sign-in token on your device so you stay signed in.

Changes

We will update this page when how we use data changes, and change the date at the top. For important changes we will tell account owners by email.

Contact

Qavyo, Bekamura, Kazirbazar, Moulvibazar 3200, Sylhet, Bangladesh. Privacy questions: ashraful@qavyo.com. Anything else: contact us.