Juuret Labs Oy ("we", "us", "the Provider") operates the Invis Wise SaaS platform for restaurant inventory management. This Privacy Policy explains how we collect, use, store, and protect personal data in connection with the platform.

In the context of GDPR, the Provider acts as a data processor on behalf of the restaurant operator (the data controller). The restaurant operator is responsible for the lawfulness of the processing of their staff's data. This policy also covers the Provider's own data controller activities (e.g. billing contacts, service communications).

The following categories of personal data are processed by Juuret Labs Oy in connection with the Invis Wise platform and the inviswise.fi website:

Invis Wise is a Progressive Web App (PWA) designed to work offline. To enable offline functionality, the app stores data in your browser's localStorage and IndexedDB. No third-party tracking cookies are used.

All locally stored data is controlled by you and cleared when you log out or uninstall the app. None of this data is shared with advertising networks or analytics providers.

Under the Finnish Act on Electronic Communications Services (Sähköisen viestinnän palvelulaki), storage of data strictly necessary for a service explicitly requested by the user does not require separate consent. All items listed above fall under this exemption.

We use the following sub-processors to operate the platform. All sub-processors are bound by GDPR-compliant data processing agreements.

As a data subject, you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate data. Profile name and email can be updated directly within the app.
• Right to erasure (Art. 17): You may request deletion of your account and associated personal data. This is carried out by your restaurant administrator or by contacting us directly.
• Right to restriction (Art. 18): You may request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): Restaurant operators may export all inventory data (sessions, counts, products, users) at any time from the admin panel in machine-readable CSV format.
• Right to object (Art. 21): You may object to processing based on legitimate interests. We will assess the objection and cease processing if your interests override ours.

We apply the following technical and organisational security measures to protect your data:

• Encryption in transit: All communication uses TLS (HTTPS). HSTS with preload is enforced at the infrastructure level.
• Encryption at rest: All data is stored on Supabase servers in Ireland, which apply encryption at rest by default.
• Access control: Row Level Security (RLS) is enabled on all database tables. Each user can only access data belonging to their assigned restaurant(s). Cross-tenant data access is technically prevented at the database level.
• Authentication: JWT-based authentication with token expiry and refresh rotation. Passwords are hashed by Supabase Auth (bcrypt) and never stored or transmitted in plaintext.
• HTTP security headers: Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Strict-Transport-Security are applied to all responses.
• Admin access: Administrative operations (user creation/deletion, password reset) are gated behind Supabase Edge Functions that verify admin role on every request.
• XSS protection: All user-supplied strings rendered in the UI are sanitised through a dedicated sanitize() function before insertion into the DOM.
• Audit trail: All sensitive administrative actions, plus self-service catalog imports performed by restaurant users, are logged immutably in the audit_log table. The log is readable only by admin users; a restaurant user's database permissions let them log solely their own action, never read the log or attribute an entry to anyone else.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will:

• Notify the affected client organisation(s) without undue delay and within 72 hours of becoming aware of the breach.
• Provide the nature of the breach, the categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.
• Notify the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) where required by GDPR Art. 33.
• Notify affected individuals directly if the breach is likely to result in a high risk to their rights (GDPR Art. 34).

We may update this Privacy Policy from time to time. When we make material changes, we will notify active users via the application and/or email at least 14 days before the changes take effect. The updated policy will always be accessible at /docs/privacy-policy.html within the platform.

Continued use of the platform after the effective date constitutes acceptance of the updated policy.

This platform is operated under Finnish law and subject to GDPR. The competent supervisory authority is:

You have the right to lodge a complaint with this authority at any time if you believe that the processing of your personal data violates GDPR.