Hospobook Privacy Policy

This Privacy Policy explains how Hospobook collects, uses, stores, and shares personal information when you use our hospitality operations software and related websites, apps, and kiosk experiences (together, the “Service”). We handle personal information in line with the New Zealand Privacy Act 2020.

Hospobook is operated by MOH Hospitality Limited. We provide venue operators with tools for sales, cash-up, stock/COGS, labour (rosters, timesheets, kiosk clock), reporting, and optional integrations.

If you use Hospobook through your employer or venue, your venue is typically the primary controller of staff and operational records entered into the Service. Hospobook processes that information to provide the Service.

Depending on how you use Hospobook, we may collect:

• Account and contact details — name, email address, phone number, role, password (stored hashed), and workspace/venue association.
• Venue and business details — business or trading name, sites, settings, and configuration you enter.
• Staff and labour data — staff profiles, roles, roster shifts, breaks, clock in/out times, timesheets, leave, and related cost figures entered by your venue.
• Operational and financial data — sales, budgets, cash-up and till records, invoices and line items (including inbound invoice email and OCR extracts where enabled), stock movements, and reports.
• Support and communications — messages you send us (including contact forms and support chat), and invite/notification emails we send.
• Technical data — IP address, device/browser type, approximate location derived from IP, cookies and session tokens needed to keep you signed in, and diagnostic/error logs (including optional error monitoring).
• Optional AI features — prompts, transcripts, or documents you submit when using Virtual GM / chat or similar features (only when those features are enabled for your environment).

We use personal information to:

• Provide, secure, and improve the Service (including authentication, authorisation, and audit logs).
• Operate venue workflows you request (rosters, timesheets, cash-up, invoices, stock, reporting).
• Send transactional emails (invites, password and roster notifications, system notices).
• Respond to support requests and investigate reliability or security issues.
• Comply with law and enforce our terms.

Under the Privacy Act 2020 we collect and use personal information for purposes connected with providing Hospobook to you or your venue, where collection is necessary for those purposes, or where you (or your venue) have authorised the collection. Where a feature is optional, we process related information only when that feature is used or enabled.

We share personal information only as needed to run Hospobook, including with trusted service providers who process data on our instructions, such as:

• Hosting and database providers that store application data.
• Email delivery providers for invites and notifications.
• Error monitoring / logging providers (when configured).
• Optional AI / OCR providers when those features are enabled (for example document extraction or chat assistance).
• POS or partner integrations you connect (for example sales ingest or webhooks you configure).

We use essential cookies and similar technologies for sign-in sessions, CSRF protection, and security. These are required for the Service to work. We do not use third-party advertising cookies as part of core Hospobook product pages.

We store information on infrastructure operated by our hosting providers. We apply access controls, encryption in transit, hashed passwords, and role-based permissions within venues. No method of transmission or storage is perfectly secure; please use a strong unique password and protect account access.

We retain personal information for as long as your workspace remains active and as needed to provide the Service, meet legal, accounting, or dispute requirements, and maintain security logs. Venue administrators may request deletion or export of workspace data by contacting us; some residual backups and logs may persist for a limited period.

Some processors may store or process data outside New Zealand. Where that happens, we take steps consistent with the Privacy Act 2020 so that information remains protected to a comparable standard.

You may request to:

• Access personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Ask us to delete information we no longer need (subject to legal and operational retention needs).
• Withdraw optional consents (for example by stopping use of optional AI features, or asking your venue admin to disable integrations).

Hospobook is built for hospitality businesses and their staff. It is not directed at children under 16. If you believe we hold information about a child without appropriate authority, contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. The effective date at the top will change when we do. Continued use of the Service after an update means you accept the revised policy, except where consent is required by law.

Privacy questions and requests:

• Email: support@hospobook.com
• Web: https://hospobook.com
• Operator: MOH Hospitality Limited, New Zealand