Privacy policy
Version 2026-09-04
This Privacy Policy explains how Mad Monkey Trading Pty Ltd (ABN 42 658 372 037), trading as Mavos ("we", "us", "our"), collects, uses, stores and discloses personal information. We are bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) and we apply them to everything we hold, whether or not the Act requires it of us.
Mavos is software that hospitality venues and bookable businesses ("venues") use to take orders, payments and bookings, roster staff and run their websites. Most personal information on Mavos is collected by a venue, from its own customers and staff, and we hold it for that venue. The venue decides why it collects your information and is responsible for its own privacy policy; we are responsible for how the information is stored, secured and handled on our platform. Where this policy says "the venue", it means the business you dealt with.
1. Personal information we hold
Customers and diners of a venue. Name, email address, phone number, delivery or table details, order history and any notes you add to an order (for example dietary requirements — please only include what the kitchen needs), booking details and party size, loyalty balances, marketing preferences, gift-card recipient name and message, membership details, and where a venue asks you to sign an agreement, your typed name, signature image, the time, and the network address and browser used to sign.
Payment information. Card details are entered into Stripe's own forms or card readers and never reach our systems. We keep the last four digits, the card brand and a Stripe-issued identifier so the venue can recognise a returning card and reconcile payments.
Venue staff and operators. Name, email, phone, role, sign-in and security records (including multi-factor authentication settings and a hashed staff PIN), and the device, browser and network address used to sign in to the register.
Employees of venues that use the Staffing module. Employment details the venue records to roster and pay you: name, contact details, date of birth, address, emergency contact, employment type, pay rate or salary, award, availability and leave, qualifications, timesheets and clock-in and clock-out times. If the venue turns on location checking, the location of your device at the moment you clock in or out. Bank account and superannuation details, where a venue chooses to record them, are encrypted. Tax file numbers are not collected on Mavos.
Suppliers of a venue. Contact names, emails, phone numbers, account numbers and the contents of invoices a venue uploads or forwards.
Website and app visitors. When you use a venue's ordering page or website, we record page views and actions against a random visitor identifier set by our server. We do not store your IP address or browser fingerprint in those records; a hashed identifier is created only when the venue's consent settings allow it. We keep the full address of the page that referred you.
Form responses. Whatever a venue's form asks for. We store a truncated network address and browser type with each response.
Support and correspondence. Your name, email and messages when you contact us or raise a support ticket.
AI assistant transcripts. If a venue uses the built-in assistants, the questions its staff ask and the answers, including any of the venue's data the assistant looked up to answer, are kept as chat history for that venue.
2. How we use personal information
- To provide the features the venue has enabled: orders, payments, bookings, receipts, memberships, loyalty, staff rostering, kitchen displays, websites and forms.
- To send messages on the venue's behalf: receipts, booking and pickup reminders, sign-in codes, and, only where you have opted in with the venue, marketing. Every marketing email has an unsubscribe link and every marketing SMS accepts STOP.
- To keep the platform secure and working: sign-in protection, fraud and abuse detection, error monitoring, and usage analytics on staff screens.
- To meet legal obligations, including tax record-keeping.
- To produce aggregated, de-identified statistics across venues to improve the product. We never use personal information to train AI models.
3. Where information is stored and how it is protected
All platform data is stored and processed in Australia (Sydney) on Supabase and Vercel. Data is encrypted in transit and at rest. Each venue's data is isolated by row-level security so one venue cannot see another's. Integration credentials and sensitive employee fields are encrypted with a separate key. Privileged staff accounts require multi-factor authentication. Our own staff can only open venue data through an administration console that records who, why and for how long, and venues can ask to see that log.
Card payments are handled by Stripe; we hold SAQ-A scope under PCI DSS.
4. Who we share information with
4.1 Providers we use for every venue
We use a fixed set of providers to run the platform for every venue — database and hosting, payments, error monitoring, product analytics on staff screens, bot protection, push notifications, and the automation-device broker. The full list, with what each one sees and where it is located, is on our Sub-processors page.
4.2 Providers a venue may connect using its own account
A venue can turn on integrations such as AI assistants, email, SMS, accounting, kitchen displays, and marketing and advertising tools. When a venue turns one on, the venue is that provider's customer and we send the information the venue has asked us to. These are also listed on the Sub-processors page.
4.3 About the AI assistants
A venue can enable assistants that help its staff with reports, rostering, menus, website content and settings. To answer a question, an assistant may read the venue's records, including customer and employee details, and send what it reads to the venue's AI provider through OpenRouter. We do not hold a platform-wide AI account; the venue's own OpenRouter settings govern how long that provider keeps the data. Transcripts are stored in Australia with the venue's data and are visible to the venue's owners and administrators. We do not use them to train models.
4.4 Overseas disclosure
The providers marked outside Australia on the Sub-processors page receive personal information under this policy. Before disclosing, we take reasonable steps to ensure each provider handles it in a way consistent with the APPs, through their data-processing terms. You can ask us which of your information has been sent to which provider.
We do not sell personal information.
5. How long we keep information
| Information | Retention |
|---|---|
| Orders, payments, invoices | Seven years for tax law. Names, emails and phone numbers on old orders are removed automatically after the venue's retention period (default seven years; venues may shorten it). |
| Customer profiles | Until the venue or you ask for deletion, then de-identified. |
| Employee records | Seven years after employment ends, as employment law requires. |
| Website and ordering-page analytics | Six months of detailed events; longer as daily totals without identifiers. |
| Sign-in and device session records | Thirty days after the session ends. |
| Automation device readings | Ninety days. |
| Support tickets, AI transcripts, message logs | Two years. |
| Backups | Seven days of point-in-time recovery plus nightly copies; deleted data leaves backups on that cycle. |
6. Cookies, analytics and platform monitoring
What we collect, and whether you can switch it off, depends on which screen you are on. There are three cases.
6.1 Mavos staff and admin screens — a condition of using the platform
This covers the Mavos admin console and the Mavos point-of-sale register: the screens a venue's own staff use to run their business.
On these screens, error monitoring and product analytics run as a condition of using the platform, under the Terms of Service accepted at sign-up (version and date are recorded). They are not consent-based here, there is no cookie banner, and a venue cannot switch them off. We rely on them to keep the software working and to understand which parts of it are actually used.
What is collected is deliberately narrow: which pages and features are opened, the signed-in user's account identifier, the venue's account identifier, and error diagnostics. It does not include a venue's customers' names, contact details, order contents or payment details.
6.2 Venue-facing customer screens — a venue's website, QR ordering and kiosks
Error monitoring runs on these screens so that a broken ordering page can be found and fixed, and personal information is stripped from those error reports in the browser before they are sent to us. Mavos product analytics does not run on these screens — it is limited to the staff screens described in 6.1.
Any analytics or advertising tags on those pages — for example a venue's own website analytics — are configured by the venue, not by us, and are governed by the venue's consent banner and the venue's own privacy policy. Declining that banner stops those tags.
6.3 This marketing website — consent-based
We use cookies and similar technologies here for three purposes:
- Essential — required to operate the service (for example, to keep you signed in and to protect against cross-site request forgery). These cannot be turned off.
- Analytics — used to understand how this website is used so we can improve it. You can decline through the cookie banner, and we honour that.
- Session recording — a recording of how pages are used, to reproduce faults. This is currently switched off entirely and records nobody on any screen. If we ever enable it, it will still require your explicit consent through the banner. Error reporting is separate and is not a recording.
You can change your cookie preferences for this website at any time by clearing the cookie_consent cookie and refreshing the page, which will re-display the banner. This does not affect Section 6.1, which is not consent-based.
Some pages load fonts or scripts from third-party servers (Google Fonts on venue websites, content delivery networks for viewers and tools). Those servers see your network address when the page loads.
7. Your rights
- Access and correction. Ask the venue you dealt with; they can export your information from Mavos and correct it. If you ask us directly we will pass the request to the venue within five business days and help them respond.
- Deletion. Ask the venue. The venue can delete your profile and remove your identifying details from its records; totals and dates on financial records are kept as tax law requires. Your Mavos sign-in, if you created one, is deleted with your last venue profile.
- Marketing. Unsubscribe from any email, reply STOP to any SMS, or ask the venue. This does not stop transactional messages such as receipts.
- Employees. Ask your employer. Where the employer can no longer act, we will respond to you directly.
- Complaints. Contact us first at privacy@mavos.com.au, or write to Mad Monkey Trading Pty Ltd at 36 Lake Street, Cairns QLD 4870. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
8. Data breaches
We follow the Notifiable Data Breaches scheme. If a breach is likely to cause serious harm, we notify the affected people and the Commissioner as soon as practicable, and we notify affected venues within 24 hours of confirming a breach so they can meet their own obligations. Our internal procedure is maintained and tested.
9. Children
Mavos is not directed at children under 16 and we do not knowingly collect their personal information. Venues that sell age-restricted products or run children's activities are responsible for checking age and for obtaining a parent's or guardian's details where needed.
10. Changes
We keep every version of this policy. Material changes are announced to venue administrators by email and, where they affect customers, on the pages where information is collected.
11. Contact
Mad Monkey Trading Pty Ltd (ABN 42 658 372 037), trading as Mavos, 36 Lake Street, Cairns QLD 4870. Privacy contact: privacy@mavos.com.au.