The short version: we collect what we need to run Zatila for your restaurant, we keep each restaurant's data separate, we don't sell it, and the Google and Meta cookies on our website load only if you allow them. Nothing inside the Zatila app, the admin or the kitchen tablets is tracked by Google or Meta. The details are below.
1. Who we are
Zatila is operated by Calode LLC ("Calode", "we", "us"). This Privacy Policy explains what personal information we collect through zatila.com and the Zatila service, how we use it, who we share it with and the choices you have.
Restaurants that use Zatila are our customers. For the information a restaurant puts into Zatila about its own team and kitchen, the restaurant decides what goes in and we process it on the restaurant's behalf. If you work at a restaurant that uses Zatila and have a question about your information, you can ask your employer or write to us.
2. Information we collect
| What | Examples |
|---|---|
| Account information | Name, email address, password (stored only as a secure hash), restaurant name and type, and the plan you're interested in. |
| Kitchen content | Menus, recipes, prep items, checklists, timers, photos, and the files you upload for Zatila setup. |
| Kitchen activity | Who checked a list, logged a temperature, reported the prep board or sent an alert, with times. Staff names or initials and roles, and staff PINs (stored only as a secure hash). |
| Billing information | Your plan, the number of open locations and your subscription status. Card details go to Lemon Squeezy and never to us. |
| Messages | What you send us through the contact form or by email, including your name, email, restaurant and number of locations. |
| Technical information | IP address, browser and device type, tablet names, and logs of sign-ins and requests, used to run and secure the service. For people with a Zatila account, we also record sign-in times, when the account was last active, the browser and device, and the country the sign-in came from, worked out from the IP address. We keep the country, not a new copy of the address. |
| Website measurement | If you allow it on our website (zatila.com, outside the app): the pages you visit, how you reached them, and whether you signed up, through Google Analytics, Google Ads and the Meta Pixel (section 6). |
3. How we use it
- To provide Zatila: run your kitchen screens and admin, sync your tablets, and send the emails the service needs (sign-up, password reset, billing and alerts you turn on).
- To set up your kitchen from the files you upload, when you ask us to (section 5).
- To translate your kitchen content into Spanish (or English) for your crew on the kitchen tablets, while that is turned on (section 5).
- To keep Zatila secure: stop abuse, limit repeated attempts and investigate problems.
- To bill you through Lemon Squeezy, and to answer your messages and support requests.
- To meet legal obligations and enforce our Terms.
We don't sell personal information for money, and we never use your kitchen content to advertise to you. On our marketing website only, and only if you allow it, Google and Meta cookies measure our ads and visits (section 6). Under some US state laws this can count as "sharing" for advertising; you can say no in the cookie banner or under Cookie settings at the bottom of every page.
4. Who we share it with
We share information only with service providers who process it for us, under contracts that limit their use of it, and when the law requires it:
- Lemon Squeezy, our merchant of record, for checkout, payments, invoices and tax.
- Hosting and backup providers, which run the servers and keep copies of our backups.
- Email delivery providers, which send the service's emails.
- Google (Google Analytics and Google Ads) and Meta (the Meta Pixel), on our website pages only and only if you allow them, to measure visits and our ads (section 6).
- Setup providers, which process the files you upload for Zatila setup and the kitchen text Zatila translates for your tablets (section 5).
- Tools you connect yourself, such as a Slack or Discord webhook for alerts.
- Authorities or others when the law requires it, to protect people's safety, or as part of a merger or sale of our business, in which case this policy continues to apply.
5. Files you upload for Zatila setup
When you use Zatila setup, the files you upload and the text in them are sent to third-party service providers, which process them on our behalf to prepare a draft of your kitchen content for you to review. Today these providers are Anthropic, PBC, and, as a backup, OpenAI, L.L.C.. They receive only what is needed to prepare the draft. Under their commercial terms they process this content to provide the service to us and do not use it to train their models.
Your uploaded files are stored in your restaurant's own space, are never published, and are deleted 30 days after the setup is applied or discarded, or at once if you delete it. Please don't upload files with information you don't need in your kitchen, such as staff ID numbers or customers' details.
Spanish on the kitchen tablets. So your crew can read the kitchen tablets in Spanish, the text of your menu, recipes, prep items, checklists, timers and notes is sent to the same providers, under the same terms, to translate it. Only that kitchen text is sent: not your staff, locations, logs or account details. You can turn this off under Settings, Kitchen language, "Zatila translates for you", and type the Spanish yourself.
6. Cookies and similar technology
In the Zatila app (the sign-in pages, the admin, the kitchen tablets and the control panel) we use only what Zatila needs to work. When you sign in, we set one session cookie that keeps you signed in. A paired tablet keeps its sign-in token and the kitchen's content on the device so it can work offline. There are no advertising or analytics cookies in the app, and no Google or Meta code runs there.
On our website (the home page, features, pricing, FAQ, about, contact, legal pages and the page you see after signing up) we use these, only after you allow them where the law asks us to:
| Service | What it does | Cookies (examples) |
|---|---|---|
| Google Analytics | Counts visits and shows which pages are useful, from information like the pages you view, your browser and your approximate area. | _ga, _ga_*, up to 2 years |
| Google Ads | Tells us whether a visit from one of our Google ads led to a sign-up, so we can measure and improve our ads. | _gcl_au, up to 90 days, and Google's own advertising cookies |
| Meta Pixel | Tells us whether a visit from one of our Facebook or Instagram ads led to a sign-up, and lets us show our ads to people who visited. | _fbp, up to 90 days, and Meta's own cookies |
Google and Meta receive this information as independent companies under their own privacy policies (Google, Meta). When you finish signing up, our website tells them that a sign-up happened; it never sends your name, email address or restaurant details.
Your cookie choices
- The cookie banner. Where the law requires consent first, including in the European Economic Area, the United Kingdom and Switzerland, and whenever we can't tell where you are, these cookies load only if you choose Accept. Decline is just as easy, and the website works the same either way.
- Change your mind at any time with Cookie settings at the bottom of every page. We remember your choice in your browser for 12 months, then ask again.
- Other ways to opt out: the Google Analytics opt-out add-on, Google's ad settings, Meta's ad preferences in your Facebook or Instagram settings, and your browser's settings for blocking or deleting cookies.
- Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a no to these cookies.
7. How long we keep it
- Account and kitchen data: while your account is active. If the account pauses, we keep the data for 90 days so you can come back. After that we may delete it; deleted data is removed from our systems within a further 30 days.
- Backups: nightly backups are kept for 14 days and then replaced.
- Setup files: deleted 30 days after the setup is applied or discarded.
- Emails we send: delivery records are deleted after 30 days.
- Billing records: billing events are kept for 180 days, and invoices as long as tax law requires.
- Messages to us: as long as needed to help you and keep a record of the conversation.
- Account sign-ins and activity: for people with a Zatila account, the country, device, browser and operating system of each sign-in, and which days the account was active, are kept for 13 months and then deleted. The country comes from IP Geolocation by DB-IP (db-ip.com, CC BY 4.0).
- Your cookie choice: kept in your browser for 12 months. Google and Meta keep what their cookies collect under their own policies (section 6).
8. Security
Each restaurant's data is kept in its own separate database. Connections are encrypted with HTTPS, passwords and PINs are stored only as secure hashes, and access inside Zatila follows the roles your owners set. Zatila staff reach customer accounts only for support and operations, through tools that keep an audit log. No system is perfectly secure, so please use a strong password and remove people and tablets that no longer need access. If we learn of a breach that affects your information, we'll tell you as the law requires.
9. Your choices and rights
Owners can view, change, export and delete their kitchen's content in the admin, and anyone can change their own account details. Depending on where you live, including in California and other US states, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to not be treated differently for using these rights. To use them, email support@zatila.com. We'll confirm the request comes from you, and if the information belongs to a restaurant customer, we may pass the request to that restaurant.
10. Where your information is processed
Zatila is run from the United States, and our service providers may process information in the United States and other countries. Where the law requires it, we use appropriate safeguards for those transfers.
11. Children
Zatila is a service for businesses and is not meant for children. We don't knowingly collect personal information from anyone under 16.
12. Changes to this policy
We may update this policy. If a change is material, we'll tell account owners by email or in the admin before it takes effect. The date at the top shows the latest version.
13. Contact
Questions or requests about privacy: support@zatila.com, or our contact page. Calode LLC operates Zatila.