Legal
Terms of Service
These Terms of Service ("Terms") are a contract between Boldrope Inc. (incorporation pending in Ontario, Canada) ("we", "us"), and the business on whose behalf you accept them ("Customer", "you"). By creating a workspace or using margherita (the "Service") you confirm that you are authorized to bind that business. The Service is offered to businesses, not consumers.
1. The Service
margherita is a restaurant operations platform: ordering, inventory, invoicing with AI-assisted extraction, staff scheduling, recipe costing, and sales analytics. We may improve or modify features over time; we will not materially reduce the core functionality you pay for during a paid term without notice.
Use of the public site is also governed by our cookie practices, described in the Privacy Policy.
2. Accounts and your team
- The account owner (company admin) controls who on their team can access the workspace and what they can see. You are responsible for your team's use of the Service and for keeping credentials confidential.
- Notify us promptly of any unauthorized use of your workspace.
- Information you provide at signup must be accurate.
3. Trial and future plans
- New workspaces start with a 14-day free trial. No payment details are collected during the trial.
- margherita is currently offered as a free trial while paid plans are being finalized. No paid subscriptions, billing, or payment processing are available at this time.
- When paid plans are introduced, they will be billed in advance (monthly or annually) at published prices, plus applicable taxes. We will give at least 30 days' notice of pricing, and these Terms will be updated accordingly.
- Until payments launch, we may limit or end the trial period for any workspace with notice. Trial data is handled as described in §4 and the Privacy Policy.
4. Your data
- Business data you enter (orders, invoices, inventory, schedules, recipes, sales) remains yours. You grant us a limited licence to host and process it solely to provide the Service.
- You are responsible for having the right to upload the data you bring, including your employees' personal information; our Privacy Policy describes how we process it and the service providers we use.
- AI processing: documents you upload (e.g. supplier invoices) are processed by third-party AI models (Anthropic Claude) to extract data. Extraction is automated and may contain errors — you review and confirm results inside the product.
- You can request an export of your data; on closure we retain it for 90 days, then delete it (Privacy Policy §6).
5. Important: figures are decision support, not advice
Food-cost percentages, margins, labour costs, forecasts, AI-extracted invoice data and other analytics are calculated from the data you provide and are offered as decision-support tools only. They are not accounting, tax, employment or legal advice, and you should verify material figures before relying on them for business, payroll or pricing decisions.
6. Acceptable use, suspension and termination
- No unlawful use, no attempts to access other tenants' data or our infrastructure, no malicious code, no scraping or reselling the Service, no abuse of AI features.
- We may suspend or terminate workspaces that materially violate these Terms or create security or legal risk, with notice where practicable.
- You may close your workspace at any time; §4 governs what happens to your data.
7. Connected services
Connecting Gmail (invoice/report import) or Meta accounts (social posting) is optional and governed by those providers' terms. You can disconnect them at any time from Settings. Our use of Google API data follows the Google API Services User Data Policy, including Limited Use.
8. Availability
We target high availability but the Service is provided on a commercially-reasonable-efforts basis, without an uptime guarantee. Planned maintenance is announced where possible.
9. Warranties and liability
The Service is provided "as is". To the maximum extent permitted by applicable law: (a) we disclaim implied warranties; (b) neither party is liable for indirect, incidental, consequential or punitive damages, or lost profits; and (c) our total aggregate liability under these Terms is limited to the fees you paid us in the 12 months preceding the claim (during the free-trial period, aggregate liability is limited to CAD $50). Nothing in these Terms limits liability that cannot be limited by law.
10. Changes to these Terms
We may update these Terms. For material changes we will give account owners at least 30 days' email notice; continued use after the effective date constitutes acceptance. The current version is always at this page.
11. Governing law
These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. The courts of Ontario have exclusive jurisdiction, and each party irrevocably attorns to them.
12. Contact
Boldrope Inc. — questions about these Terms: legal@boldrope.com.
Privacy Policy
margherita is a restaurant management platform operated by Boldrope Inc. (incorporation pending in Ontario, Canada) ("we", "us", "our"). This policy explains what personal information we collect, why, who we share it with, and the rights you and the people whose data you bring onto the platform have under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Our two roles
We handle personal information in two distinct capacities:
- As the business you deal with directly — for your account data (email, password, login activity) and demo/lead submissions, we are responsible for the information.
- As a service provider to your restaurant — for the information your business enters about its employees and operations (names, contact details, wages, schedules, hours worked), your restaurant remains accountable under PIPEDA and we process it only to provide the service, on your instructions. Your staff should direct access or correction requests to their employer first; we assist the employer in fulfilling them.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email, hashed password, role, last login | You, at signup/login |
| Employee data | Names, personal emails, hourly wages, shifts, hours, time-off requests | Entered by your restaurant's managers |
| Business records | Supplier invoices, orders, inventory, recipes, sales reports | Uploaded or entered by your team; may incidentally contain personal data (e.g. a supplier rep's name) |
| Connected accounts | Gmail OAuth tokens (read-only invoice/report import), Meta tokens (social posting) | Only if you connect them |
| Technical data | IP address, timestamps, request logs, audit and impersonation logs | Automatic, for security |
| Demo leads | Name, email, restaurant name, IP | The public demo on our website |
We collect only what the service needs (PIPEDA limiting-collection principle). We use no advertising or cross-site tracking cookies — the cookies we do use are described in section 2a below.
2a. Cookies on our public pages
Before you have an account, our landing, demo and legal pages use two kinds of cookie:
- Strictly necessary — session and security cookies (e.g. keeping you logged in, CSRF protection). These are always on and don't require consent under PIPEDA.
- Analytics (visitor journey) — a single
visitor_idcookie, set only if you accept it in the cookie banner, that lets us see the path an anonymous visitor takes (viewed the landing page, clicked "Start free trial", completed or abandoned signup) and which site referred you here (for example a Facebook or Instagram link, including campaign tags in the link itself). It does not carry your name, email, or IP address, expires after 1 year, and is never sold or shared with advertisers. Declining it only turns off this journey view — the site works identically either way.
You can withdraw consent at any time by clearing your browser cookies for margherita or by contacting us (see section 10).
3. Why we use it
- Operating the platform: scheduling, costing, ordering, invoicing, analytics.
- Transactional email (purchase orders to suppliers, schedule notifications, password resets). These identify us as sender, per Canada's Anti-Spam Legislation (CASL).
- AI-assisted extraction: invoices and sales reports you upload are processed by Anthropic's Claude models to extract line items. They are used only to produce your results and are not used by us to train models.
- Security: rate limiting, audit logging of administrative actions (including any platform-staff impersonation of accounts, which is recorded).
- We do not sell or rent personal information, and we do not use it for third-party advertising.
4. Service providers (subprocessors)
We use a small set of providers to run the service. Some are located in the United States, which means information may be processed outside Canada and be subject to the laws of those jurisdictions:
| Provider | Purpose | Location |
|---|---|---|
| Render | Application hosting | USA |
| Supabase | Database & file storage | USA |
| Anthropic | AI document extraction | USA |
| Resend | Transactional email delivery | USA |
| Sentry | Error monitoring (technical error reports may include the account email of the affected user) | USA |
| Google / Meta | Only if you connect Gmail or social accounts | USA |
Payment processing is not currently integrated. When paid plans launch, the provider (e.g. Stripe) will be disclosed here and in the Terms.
5. Google API data
Our use of data obtained from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements:
- We request Gmail read-only scope solely to import vendor invoice attachments and POS reports you've configured rules for.
- We do not transfer Google user data to third parties except as necessary to provide the service, and never for advertising.
- You can revoke access at any time from your Google Account or from the platform's Settings page.
6. Retention and deletion
- We keep your data while your subscription or trial is active.
- After an account is closed, data is retained for 90 days (so you can change your mind or export), then deleted from production systems; encrypted backups age out on a rolling schedule thereafter.
- Records we are legally required to keep (e.g. tax records, where applicable under Canadian law) are retained for the required period.
7. Your rights
Under PIPEDA you may request access to, correction of, or deletion of your personal information, withdraw consent (which may limit the service we can provide), and ask questions about our practices. We respond within 30 days. Restaurant owners can also request a full export of their company's data or its deletion. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.
8. Security and breach notification
Passwords are hashed, connections are encrypted (HTTPS), administrative access is logged, and tenant data is isolated per company. If a breach of security safeguards creates a real risk of significant harm, we will notify the Privacy Commissioner and affected individuals as required by PIPEDA.
9. Changes
We will post updates here with a new date and version, and notify account owners by email of material changes at least 30 days before they take effect.
10. Privacy Officer & contact
Boldrope Inc. has designated a Privacy Officer responsible for PIPEDA compliance. For privacy questions, access requests, or complaints: privacy@boldrope.com.