Privacy Policy

Version: 1.1|Effective Date: March 1, 2026|Last Updated: August 22, 2026

Privacy Principles

Your data belongs to you. Pedestal does not sell merchant, employee, or customer information. We collect only the information reasonably necessary to provide the Services.

Introduction

This Privacy Policy applies to Pedestal Business Suite, including Pedestal POS, CFD, KDS, Back Office, Online Ordering, related websites, APIs, and mobile applications operated by Pedestal Studios Inc.

Policy Review

Pedestal reviews this Privacy Policy and related privacy practices at least annually and when material product, vendor, legal, infrastructure, or data-processing changes occur.

Information We Collect

Pedestal may collect merchant account information, employee information, customer information, order information, support information, device information, and merchant billing information necessary to provide the Services. Merchant data remains owned by the merchant.

Payment Processing

Pedestal is software and is not a payment processor, acquiring bank, payment facilitator, money transmitter, lender, or funds custodian. Full card numbers, CVV, PINs, magnetic stripe data, and EMV authentication data are not intentionally stored by Pedestal. Payment authorization, approval, processing, settlement, ACH billing, and related payment activity are handled by third-party processors, gateways, banks, or billing platforms.

Security

Pedestal uses HTTPS/TLS, authentication, role-based permissions, audit logging, device provisioning, merchant data isolation, secure synchronization, and offline-capable local storage. Additional security practices are summarized in the Security Statement.

See the Security Statement for information about access controls, MFA, data protection, incident response, funds-transfer validation, customer responsibilities, and reporting security issues.

Third-Party Services

Pedestal may utilize trusted providers including Supabase, Vercel, Sentry, Apple Push Notification service, payment processors, gateways, app stores, email providers, billing platforms, and supported integrations. These providers process information only as needed to support the Services or customer-requested functionality.

Data Ownership

Merchants retain ownership of Merchant Data. Pedestal stores and processes it to provide, secure, support, troubleshoot, maintain, and improve the Services, and to comply with applicable legal, billing, security, and operational requirements.

Customer Content

Merchants are responsible for content they upload, import, publish, or ask Pedestal to publish, including logos, menu images, product descriptions, online ordering content, and customer-facing text. See the Content & Takedown Policy.

Retention

Merchant data may be archived after approximately ninety (90) days following account closure or prolonged inactivity unless deletion is requested and permitted by law, contract, payment rules, tax requirements, dispute handling, security needs, or operational obligations.

Rights

Applicable privacy rights under U.S. law, CCPA/CPRA, GDPR, and other relevant privacy laws are honored where applicable. Pedestal is not intended for processing protected health information under HIPAA unless Pedestal has expressly agreed in writing to a supported healthcare-specific arrangement.