Privacy Policy

4Labs PRO is a restaurant management platform operated in Costa Rica. This policy describes what personal data we collect when you use our services, how we use it, who we share it with and the rights you have over it.

We comply with Costa Rica's Law No. 8968 — Protection of the Individual with regard to the Processing of their Personal Data and follow practices aligned with the EU's General Data Protection Regulation (GDPR) for international customers.

We collect only what is necessary to operate the service:

• Order data: table, products, modifiers, special instructions, total, time, payment method.
• Customer data: optional name (“Couple A”), WhatsApp number for order-ready notifications (only if you provide it), delivery address for delivery orders.
• Billing data: tax ID, legal business name, email and address — only when you request an electronic invoice for the tax authority.
• Staff data: name, role, assigned branch, attendance records, payroll.
• Technical data: IP address, browser type, device session identifiers (to keep your cart in sync at your table).

We do not collect: full credit card numbers, third-party passwords, geolocation data outside the delivery flow, or biometric data.

• Process and deliver your orders.
• Notify you when your order is ready (WhatsApp).
• Issue an electronic invoice or receipt to the Ministry of Finance where applicable.
• Manage inventory, payroll and restaurant operations.
• Improve the service through aggregated, anonymous sales analysis.
• Meet legal obligations (retention of electronic documents for 5 years under Ministry of Finance regulations).

We work with trusted providers acting as data processors:

• Supabase — database and authentication (servers in the U.S.).
• Vercel — web application hosting (global network).
• Ministry of Finance of Costa Rica — receipt of electronic tax documents.
• Wasenderapi — sending WhatsApp notifications.
• Delivery platforms — Uber Eats, Rappi and similar, when you link your restaurant to those channels (order and status exchange).
• OpenAI / Anthropic — optional AI assistant features inside the admin panel.

We never sell personal data. We only share it with authorities when required by a court order or an explicit legal obligation.

• Orders and electronic tax documents: 5 years (tax authority requirement).
• Staff data: for the duration of employment + 4 years (CCSS / INS requirement).
• Customer data with no recent transactions: up to 2 years; anonymized afterwards.
• Technical logs and audit records: up to 90 days.

Under Law 8968 you have the right to access, rectify, delete, object to and port your personal data. To exercise them, write to us at soporte@4labspro.app. We respond within 5 business days.

You can also file a complaint with the Agency for the Protection of Residents' Data (PRODHAB): prodhab.go.cr.

We encrypt in transit (TLS 1.2+) and at rest. We use Row-Level Security policies in the database to isolate data between branches. Integration secrets are stored only in encrypted environment variables. Staff access requires multi-factor authentication.

We use strictly necessary cookies to keep your session and remember your table. We do not use advertising tracking cookies and do not share identifiers with ad networks.

The service is not directed at children under 13. We do not knowingly collect data from minors. If you discover that a minor provided data without their parent's or guardian's consent, contact us and we will delete it.

If we update this policy we will publish the new version at this same URL and change the “Last updated” date above. Significant changes will also be notified by email or within the application.

Data Protection Officer: soporte@4labspro.app