This policy explains how MyRSO LLC ("My RSO", "we", "us") collects, uses, stores and deletes information when restaurant companies ("customers") and their staff use the My RSO back-office service, the web app (app.myrso.ai) and this website (myrso.ai).
1. Who this covers
The service is sold to businesses, not to individual consumers. A customer signs up, connects its own systems, and invites its owners, managers and staff as users. For the customer's business data, the customer decides what is processed and we process it on the customer's behalf. For the account information of our users and website visitors, we are responsible for it directly.
2. What we collect
Information the customer's systems send us
- Invoices, statements and bills from vendors, including the PDF files and the amounts, dates, items and store each one belongs to.
- Vendor email in the accounts-payable mailbox the customer connects: the message, its sender and recipients, and its attachments. We read it to find invoices and statements and to draft replies the customer reviews.
- Accounting data from the accounting system the customer connects (Intuit QuickBooks Online or Restaurant365): vendors, chart of accounts, bills, journal entries, payments and balances.
- Point-of-sale data from the POS the customer connects (for example Toast): daily sales, covers, labor and kitchen timing, by store.
- Payroll and delivery-platform files the customer uploads (for example payroll exports and DoorDash or Uber Eats payouts), to build accounting entries.
Information about users
- Account details: name, work email address, role (owner, admin or manager), the stores a user can see, and a hashed password. We never store a password in plain text.
- Activity and security logs: sign-ins, invites, password resets, and the actions a user takes (for example approving or sending a draft), with the time and the user.
Information from this website
- Contact and consultation forms: what you type in (name, company, email, phone, message).
- Analytics: this website uses Google Analytics and Google Ads tags to measure visits and form completions. A cookie notice on the site lets you accept or decline them; if you decline, these tags are not loaded.
We do not ask for, and ask customers not to send us, payment card numbers or bank account numbers through the service. Subscription payments are handled by Stripe (section 5); we do not see or store full card numbers.
3. How we use it
- To run the service for the customer: read invoices and statements, match them to vendors and stores, find missing invoices, enter bills and entries in the customer's accounting system when the customer has switched that on, and draft vendor emails for the customer to review.
- To show the customer's own reports and dashboards (sales, costs, labor, accounts payable).
- To keep the service secure, find and fix problems, and support users who ask for help.
- To bill the customer for its subscription.
- To reply to people who contact us through the website.
We do not sell personal information or customer data, and we do not share it for advertising. We do not use one customer's data to serve another customer, and we do not use customer data to train AI models (see Anthropic in section 5).
4. How we store and protect it
- The service runs on Microsoft Azure. Data is stored in Azure SQL Database and Azure Storage, encrypted at rest, and sent over encrypted connections (TLS). Hosting region: United States.
- Passwords, API keys and access tokens for connected systems are kept in Azure Key Vault or encrypted storage, never in the code.
- Each customer's data is kept separate from every other customer's, and a user sees only the stores and features their role allows. Every sign-in uses a session cookie that expires.
- Access by our own staff is limited to what is needed to run and support the service.
No system is perfectly secure. If we learn of a breach that affects a customer's data, we will tell the customer without undue delay and as the law requires.
5. Sub-processors
We use these service providers to run the service. Each one only receives what it needs for its job.
| Provider | What it does for us | Data it handles |
|---|---|---|
| Microsoft Azure | Hosting, database, file storage, key vault | All service data |
| Microsoft 365 (Graph) | Reading and sending the AP mailbox's email, when the customer connects it | Vendor email and attachments |
| Anthropic (Claude) | AI processing: reading invoice PDFs and emails, drafting replies, answering questions about the customer's own data | The documents and text sent for each request. Under Anthropic's commercial terms, API inputs and outputs are not used to train its models and are retained for up to 30 days for trust and safety, then deleted. |
| Intuit (QuickBooks Online) | The customer's accounting system, when the customer connects it | Vendors, accounts, bills and entries we read and write |
| Restaurant365 | The customer's accounting system, when the customer uses it | Same as QuickBooks |
| Stripe | Subscription billing | The customer's billing contact and payment details (held by Stripe) |
The customer's own POS (for example Toast) and delivery platforms send data to us at the customer's request; they are the customer's providers, not ours. We will update this list and email customers at least 30 days before adding a new sub-processor.
6. Retention and deletion
- We keep customer data for as long as the customer's subscription is active, so its history, reports and audit trail stay complete.
- When a customer leaves, it can export its data first (the offboarding export). We then delete the customer's data, its connections and its users' accounts within 30 days after the export, except what the law requires us to keep (for example billing records), which we keep only for that purpose and period.
- Backups roll off on their own schedule, within 35 days after deletion.
- A customer can ask us to delete a specific user or specific records earlier. A user can ask their company's owner, or us, to close their account.
- Website form submissions are kept for up to 12 months unless you become a customer.
7. Your choices and rights
Users can see and correct their own account details in the app. Depending on where you live, you may have the right to ask what personal information we hold about you, to correct it, or to delete it. For data we process for a customer, we will pass your request to that customer and help them answer it. Email us at the address below.
8. Children
The service is for businesses and is not directed to children under 16. We do not knowingly collect their information.
9. Changes
If we change this policy, we will post the new version here with a new date, and tell customers by email before a material change takes effect.
10. Contact
Questions or requests: support@myrso.ai
MyRSO LLC, 3826 S Himes Ave, Tampa, FL 33611