● Legal

Privacy policy

Last updated · October 22, 2026

The Pass helps restaurants and coffee shops understand their numbers. This page explains, in plain words, what information we collect, why, where it is kept and how you can see, fix or delete it. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s Anti-Spam Legislation (CASL).

01Who we are

The Pass is a hospitality analytics service based in Toronto, Ontario, run by Julio Carneiro, who is responsible for privacy at The Pass.

Email hello@thepass.ca · Toronto, Ontario, Canada.

02What we collect

From the contact form: your name, email, business name, number of locations, type of business, POS system, the product you are interested in, your message, your language and whether you agreed to receive our emails.
From clients: business data you share or let us pull — POS sales, item sales, labour hours and cost by role, supplier invoices — and the email addresses of the people you invite to the portal.
We do not collect your guests’ names, emails or card numbers. Staff hours are loaded by role, not by name, unless you ask for it.
The website uses no advertising or tracking cookies. Your browser remembers your language and light/dark choice; our host keeps standard security logs.

03Why we use it

To reply to your request and run your free Data Health Check.
To provide the service: clean your data, build your dashboards, send the Weekly Pulse and your reviews, and bill you.
To send tips and offers by email — only if you said yes. Every email has an unsubscribe link, and we stop within 10 business days.
We never sell your information, and we never use one client’s data for another client.

04Where it is kept and who can see it

Database, logins and files: Supabase, Canada (Central) region. Each client can only see their own organisation’s data.
Website: Cloudflare (global network). Emails: Resend, which may process email addresses in the United States.
Only The Pass and the people you invite can see your numbers. Our service providers handle data only to run their service for us.
We share information with authorities only when the law requires it.

05How we protect it

Encrypted connections, encrypted storage, invite-only logins, per-organisation access rules, read-only access to your POS, and a confidentiality agreement signed before we see any numbers.

06How long we keep it

Leads who do not become clients: up to 24 months, then deleted.
Client data: while you are a client, then 90 days after you leave (so you can take a copy), then deleted.
Invoices and billing records: 6 years, as the Canada Revenue Agency requires.

07Your choices and rights

You can ask to see, correct or delete your information, or withdraw your consent, at any time: write to hello@thepass.ca. We answer within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

08Changes

If we change this policy we update the date below, and we tell clients by email before a change that affects them.