Klariti

Klariti privacy notice

This notice explains how personal information is handled in Klariti, the signed-in hospitality software at klariti.io. Our public pages have their own website and enquiry privacy notice.

Last updated 9 October 2026.

Who we are

Klariti is operated by the trustee for the Legassick Family Trust, trading as AppMate Consulting (ABN 12 500 703 026), 12 Torquay Place, Arundel QLD 4214. In this notice that business is “AppMate”, “we” or “us”.

We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) when we handle personal information in Klariti.

Whose information this covers

Hospitality businesses (our customers) use Klariti to run their venues. Most of what Klariti holds is business information: invoices, prices, sales, stock counts and accounts. Some of it is personal information about:

users: the owners, managers, chefs and staff who sign in;
staff named in venue records: names typed onto checklists and temperature logs, and staff or customers named in reports from a venue’s point-of-sale (POS) system;
supplier contacts: reps and accounts staff named on invoices, orders and supplier records, and sole traders whose invoices carry their own name and ABN;
people who email Klariti: senders of invoices, and suppliers replying to orders.

What we collect and where it comes from

Information	Examples	Where it comes from
Account details	Name, email address, role, the venues you can see. Your password is stored only as a one-way hash.	You, or the person in your business who invites you
Sign-in records	When you signed in, the IP address you signed in from, how many times you have signed in	Your browser, automatically
Activity records	Who approved, edited or deleted a record, when, and the reason they gave	Your use of Klariti
Names on operations lists	The name typed when a checklist or temperature log is completed	The person completing it
Supplier contacts	Rep names and phone numbers, order email addresses, account numbers, ABNs	Your business, supplier invoices and suppliers
Documents	Invoice PDFs and photos, stocktake files, recipe photos, POS sales files	Your business, or emails sent to your venue’s Klariti invoice address
Emails	Sender, subject and content of emails sent to Klariti, including supplier replies to orders	The sender
Order records	Where an order was sent, whether it was delivered or bounced and, where the recipient’s email app reports it, opened. The IP address of a supplier who confirms an order online.	Your use of Klariti, our email provider and the supplier
Data from connected services	Sales, stock counts, accounts and labour costs from services your business connects, such as Xero, Square, Lightspeed, Kounta, Bepoz, Restoke and Sculpture Hospitality	The connected service, under your business’s authority
Questions to the assistant	Questions you ask Klariti’s assistant, and its answers	You

Labour is stored as one daily cost per venue. Employee names, hours and pay rates are removed before it reaches Klariti. Some POS dashboard pages name a venue’s top staff member or customer, and Klariti keeps those pages as received.

We don’t ask for sensitive information (such as health information), tax file numbers or card details. If a document you upload contains them, they are held as part of that document.

Why we use it

We use personal information to:

provide Klariti: signing you in, showing each person only the venues they may see, reading invoices, producing reports, and sending the orders and reports you ask us to send;
keep an accurate record of who changed what, which the figures depend on;
support you and fix problems;
secure Klariti and prevent misuse;
meet our legal obligations.

We don’t sell personal information or use it for advertising. Klariti doesn’t send marketing email. Invitations, sign-in emails, and the reports and orders you send are service emails, not marketing.

AI and automated processing

Klariti uses AI models from Anthropic (Claude) for these features:

reading invoices and recipe photos;
suggesting product categories and menu sections;
answering questions about a venue’s figures.

To make them work, we send Anthropic the document or question, plus the business data needed to answer it. An invoice may include personal information printed on it, such as a contact name.

Klariti can also generate illustrations of dishes with OpenAI. It sends only dish names and ingredients.

Klariti doesn’t use automated processing to make decisions about individuals. It produces figures for businesses, and people review them.

Under their commercial terms, Anthropic and OpenAI don’t train their models on the data we send. Anthropic deletes it within 30 days, unless it must keep it longer to enforce its usage policy or to comply with the law.

Who helps us run Klariti

Provider	What they do	What they receive	Where
DigitalOcean	Hosts Klariti’s servers and database	Everything in Klariti	Sydney, Australia
Amazon Web Services	Stores uploaded documents and database backups, receives emailed invoices, and protects the keys to connected services	Documents, emails and backups	Sydney, Australia
Anthropic	AI reading and answers	Documents and questions, and the figures needed to answer them	United States
OpenAI	Dish illustrations	Dish names and ingredients	United States
Resend	Sends Klariti’s emails and receives supplier replies	Recipient addresses and email content	United States and Japan
Sentry	Error monitoring	Technical details of errors. It is set not to collect personal information, but an error report can occasionally include a detail from the record involved.	United States
Google	Hosts the AppMate mailbox where some venues send their invoices	Those emails	Google’s data centres, including outside Australia
AppMate’s own computers	Hold backup copies, and run the tools that collect POS and labour reports	Backups and those reports	Australia

The services your business connects, such as Xero, Square, Lightspeed, Kounta, Bepoz, Restoke and Sculpture Hospitality, handle information under their own terms. Klariti reads from them only with your business’s authority. If a venue asks us to, Klariti also collects its invoices from its own mailbox or from its suppliers' websites, using the login the venue gives us.

Information sent overseas

Most of what Klariti holds stays in Australia. Personal information goes overseas only to the providers listed above: Anthropic, OpenAI, Resend and Sentry in the United States (Resend also uses Japan), and Google. We use providers whose terms bind them to protect the information and not to use it for their own purposes.

Cookies and browser storage

A session cookie keeps you signed in. It ends when you close your browser.
If you tick “Remember me”, a cookie keeps you signed in for up to two weeks, or until you sign out.
Klariti saves some settings on your device: your light or dark theme, the sidebar layout, your list filters, a draft of an invoice you are typing and, on a shared kitchen device, the name last typed on an operations list.
Klariti has no advertising, analytics or tracking cookies, and loads no third-party scripts.

How we protect it

Every connection uses HTTPS.
Each person sees only the venues and figures their business has given them.
Passwords are stored only as one-way hashes, and invitation and password reset links expire.
Logins to connected services are encrypted with keys held in Amazon’s key management service.
Repeated sign-in attempts are slowed down.
Documents are shown only after Klariti checks that the person may see them.
Backups are kept away from the main server.

Within AppMate, access to customer data is limited to the people who support Klariti.

How long we keep it

Business records. We keep business records, and the record of who changed them, for as long as the customer subscribes, because the figures depend on them.
Deleted invoices. Deleting an invoice in Klariti hides it and records why. Only AppMate can remove it permanently, and we do that at the customer’s request.
Operations lists. They are kept as recorded. Food safety rules require some of them to be kept for at least three months.
Former users. A former user’s account is deactivated rather than deleted, so the history of who did what stays accurate. On request, we’ll replace a former user’s name and email with a placeholder, unless the law requires a record to keep them.
Server logs. These are kept for 14 days.
When a customer leaves. The customer can export its data for 30 days. After that, we delete it within 90 days. Two things are kept: records the law requires us to keep, and backup copies. Backups are kept only to recover from an incident and are never used for anything else.

Seeing or correcting your information

You can view and change your name, email and password under Profile in Klariti. To ask for any other information we hold about you, or to have it corrected, contact us using the details below.

We’ll respond within 30 days, at no charge.
If the information is part of a customer’s records, such as an invoice, we may need to involve that customer.
If the law allows us to refuse a request, we’ll tell you why.

Data breaches

If personal information in Klariti is lost or accessed without authority, we’ll tell the affected customers without undue delay. Where a breach is likely to cause serious harm, we’ll also notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Questions and complaints

If you aren’t satisfied with our response, you can complain to the Office of the Australian Information Commissioner on 1300 363 992.

Changes to this notice

When this notice changes, we’ll post the new version here with a new date. If a change materially affects how we handle personal information, we’ll email customers before it takes effect.

Contact

AppMate Consulting, 12 Torquay Place, Arundel QLD 4214

Email: brad@appmate.com.au
Phone: 0447 285 025