Privacy

What I keep, and what I do with it.

A restaurant trusts me with its schedules, its numbers and its employees' files. Here's what that means, without jargon. Last updated: September 29, 2026.

Who is in charge

Bonjour Gus is a product of Pista Studio, Québec City (Canada). The person in charge of the protection of personal information is the president of Pista Studio, reachable at bonjour@bonjourgus.com. They answer requests for access, correction and erasure, on weekdays, within the following days.

What I keep

For the client business: the location's name, the email and name of the owner and the managers, their password (hashed, never readable), the state of the subscription. The payment itself is at Stripe; I never see the card number.

For the team, what the manager enters: name, position, phone, email, hourly rate, schedules, availability, vacations, the manager's notes, and the employee file if the restaurant uses it (date of birth, address, emergency contact, social insurance number, bank account for payroll, signed documents). That file exists because an employer in Quebec has to keep one; it's encrypted at rest with a key specific to each location, masked on screen, and every reveal of a SIN or a bank account is logged with the name of the person signed in.

For the restaurant: sales, transactions, hours worked, inventory, decisions and the handbook. That's the client's data; I compute it, I sell it to nobody and I don't compare it between restaurants.

Technically: the IP address and the browser at login, sign-up and on forms (to slow down abuse), and a log of management actions (the "black box") so the owner knows who changed what.

Where it's hosted

The site runs at Vercel and the database at Neon (Postgres), both in the Washington region, in the United States, with data encrypted at rest and in transit. Emails go out through Resend, payment goes through Stripe, in the United States too. Employee files are encrypted before they get there, with a key specific to each location, and hosting outside Quebec went through a privacy impact assessment, as Quebec privacy law requires. For a location in the European Union, the transfer to the United States rests on the safeguards the GDPR provides for, through the data processing agreements of these providers. The Security page details everything. No other third party receives data from your location. No resale.

The site's only trackers are the Meta pixel and the Google tag (Google Ads and Google Analytics, audience measurement), on the sales pages only, and only if you say yes (see Cookies). On those same pages, Vercel counts visits (page views, country, device) with no cookie and without identifying you. None of this runs in your location's app.

"Ask Gus", the chat on the site and in the Back Office, goes through Anthropic (Claude): the question and, in the Back Office, a summary of the restaurant's numbers (sales, hours, verdicts, the team's first names and positions) are sent to it to produce the answer; never the SIN, banking details, addresses or disciplinary files. Anthropic doesn't use these exchanges to train its models. On our side, the first message of a conversation on the site is logged (its first 120 characters), and up to six messages are kept when you leave a contact request in the chat, so we know what you were talking about when we call you back. Nothing else is kept beyond your browser.

Who has access

The owner and the managers they invite, according to their role (the manager sees neither the cost settings, nor the subscription, nor the black box, and can't delete an employee). The team sees the schedule, their availability and the handbook with the team code, never the numbers or the files. Pista Studio only enters a location at the owner's request, for support, and it shows in the black box.

For how long

As long as the subscription is active, plus 30 days after the account is closed, the time to export. Then everything is erased: the location, the files, the logs. Archived employees stay as long as the restaurant keeps its account, because an employer's obligations last after someone leaves. The black box keeps two years of management actions, and five years for anything touching employee files, because that is the trail that says who opened what. An encrypted backup of each location is taken every night and kept fourteen days (Monday's, three months): a deleted account therefore also leaves the backups at most three months after deletion. The database restore history at Neon is short-lived (a few hours with the current plan).

Your rights

An employee can ask to see what their employer entered about them, have it corrected or erased: the request goes first through the restaurant, which holds the file; if it gets stuck, write to us and we help. An owner exports everything as CSV or JSON whenever they want (Settings, Exports), and closes their account themselves (My account). Anyone can write to us to know what we hold about them. In case of disagreement, the Commission d'accès à l'information du Québec can be called on. If your location is outside Quebec, the privacy law of your province, state or country applies as well, and nothing here takes those rights away: elsewhere in Canada, the Office of the Privacy Commissioner of Canada or your province's commissioner; in the European Union, your national data protection authority.

If something happens

If an incident affects personal information, we notify the owner of every location concerned, and the Commission when the law requires it, saying what happened and what we did. The incident register is kept by the person in charge.

Cookies

The necessary ones, set by me, with no tracker: gus_session (your management session, 30 days or until you sign out), gus_team (the team code on the phone, 6 months), gus_lang and gus_variant (the chosen language and the site variant, 180 days), gus_ref (the referral code from an /r link, 30 days), gus_utm (where you came from: the campaign, the keyword and the ad click ID, to know which campaign led to the sign-up, 30 days). Your answer to the cookie question lives in the browser (gus-consent, localStorage), which also keeps a few local preferences (open tab, guided tour seen). Advertising cookies, optional: the Meta pixel (Facebook and Instagram) and the Google tag (Google Ads and Google Analytics), on the bonjourgus.com sales pages only, never in the Back Office or on the team side. They tell us whether our ads brought you here and whether you signed up; the Meta pixel only loads after your "OK" in the little bar at the bottom of the page; the Google tag loads in "consent denied" mode (no cookie, no personal data, an anonymous signal only) and only sets its cookies after your "OK", and "No thanks" is respected for good. To change your mind either way: the "Cookies" link at the bottom of every page of the site reopens the question. If you withdraw your consent, both stop sending and their cookies (_fbp, _fbc, _gcl_*) are erased on the spot.

The terms of use say the rest: what we promise, what we don't, and how we part ways.