Effective October 29, 2026

Privacy notice

Garvold is software for food businesses. The customers are chefs and caterers, mainly small businesses in Nigeria, and some in the United States. This notice is about personal data. Recipes and prices are your business data. They are covered because they sit in the same account as names, emails, and staff records.

Who we are

The company responsible for this notice is Chef Nylah's LLC, a Florida limited liability company, Orlando, FL. There is no street address. Garvold is a brand under Chef Nylah's LLC. Privacy, support, and legal questions go to support@garvold.com. Security reports go to security@garvold.com.

What we collect

• Account data: email address, business name, and the people you invite.
• What you type into the product: clients, events, invoices, suppliers, recipes, prices, and notes. A note can contain whatever you put there, including something sensitive. Do not put medical records in a note.
• Food-safety temperatures and the name of the recipe they belong to.
• Photos of delivery notes, if you attach them.
• Application data, if you ask to join: email, business name, and any optional details you add.
• Support messages you send from inside the product.

We do not ask for a card number. There is no card form in the product today. Paid billing is not live. The current pilot is free and invite-only.

Why

Where a law requires a legal basis, we use these:

• Running the workspace you asked for, and keeping one business's rows away from another's: contract.
• Sending an invitation or a reply to an application, when email is configured: contract.
• Answering a support message: contract.
• Keeping the service secure, including the record of access changes, invoice voids, and billing-status changes: legitimate interest.
• Marketing email: consent. The product does not send marketing email today. If it is added, it needs its own opt-in, separate from creating an account, and a way to stop.
• Billing and tax records: legal obligation.

We do not run advertising analytics. The public page does not load a third-party tracker. If we later measure how the product is used, the basis is legitimate interest, and this notice changes first.

Who else sees it

• Supabase, for the database, login, files, and the functions. Data is hosted on Supabase, which runs on Amazon Web Services, and may be stored outside your country.
• Vercel, for the web pages.
• Resend, for invitation and application email, when email is turned on. If email is off, that mail is not sent.
• An operator of the platform can open the application queue and the workspace list. That access is limited to named people.
• We do not sell personal information. There is no advertising tracker on the public page.

The list, and what we tell a customer about a new vendor, is on Subprocessors.

We do not send your recipes or invoices to a model provider. The product does not call one. If that changes, this notice has to change first.

How long

Account data is kept while the workspace is active. An owner or admin can export the workspace from the product. Receipt photos are not in that file today.

After a closure request, we delete or return the workspace data within 30 days, except the records below. Deletion is a request to us, not a button.

• Food-safety logs and the audit trail are kept when a law or a real dispute requires it. Journal and other accounting entries are kept for the same reason. We will say which, rather than delete them silently or keep them without a reason.
• Billing records are kept as tax law requires, typically 7 years.
• Host and application logs are kept for 90 days or less. The audit trail is kept longer. It is the record of access changes, and it is not deleted on that timer.
• Host backups roll off within about 30 days. A restore can bring a deleted row back until that window ends.

Your requests

Email support@garvold.com from the address on the account, or have the owner of the workspace write. We will ask enough to know it is you. We do not take action from a forwarded screenshot alone. A security report goes to security@garvold.com.

• A copy of the workspace is the export in the product, for an owner or admin. Receipt photos are not in that file today.
• Correction is editing the record, or asking us to.
• Deletion follows the 30-day closure commitment above.

Cookies

The public page does not set a cookie and does not load a third-party script. No consent banner is required for a page that does not track. If a banner is added later, it has to be able to say no, and non-essential tags stay off until the answer is yes.

Changes

We will give 30 days' notice before a material change to this notice, by email to the workspace owner or by a notice in the product. We will change the date at the top when the text changes, and we will not pretend an old version was accepted if we never asked.