Clarity about the data Mizz uses.

Scope and roles

This policy covers the mizz.food website, messages sent to the team, and use of Mizz features. Available data and modules vary according to the user profile, establishment configuration, and contracted service.

OnTimeStack makes decisions about the data needed to maintain accounts, security, support, and the service itself. When it processes customer and order data following an establishment's instructions, each party's role also depends on the contract and the operation performed.

Information sent through forms

When you submit the form, you provide the establishment name, city and neighborhood, your name, phone or WhatsApp number and, optionally, a description of the opportunity in the operation.

OnTimeStack uses this information only to review the request and contact you about Mizz. The content is not sent to Google Analytics or Sentry.

To prevent abuse, we temporarily retain keyed hashes derived from the source IP address and submitted form content. They stop affecting submission limits after one hour and ten minutes, respectively, and expired records are deleted when later submissions trigger cleanup. The IP address and form content are not stored in raw form in this control.

In the protected area, the interview form sends the recorded answers, interview identification details and, when provided, the participant's contact information.

OnTimeStack uses the record only for internal Mizz research. Access is restricted to authorized people, and the content is not sent to Google Analytics or Sentry.

Data required to provide the service

Depending on the features used, Mizz may process account and profile data, establishment data, order and service records, user-submitted content, preferences, permissions, and technical security and reliability information.

This data is used to authenticate people, deliver contracted features, maintain operational history, protect accounts, prevent abuse, respond to requests, meet applicable obligations, and fix failures. We do not use operational content for behavioral advertising.

What we measure when you accept

We use Mizz's own Google Analytics property to understand website usage and improve communication.

• Pages and sections viewed, language, and whether the area is public, access-related, or internal.
• Actions on website-identified links and buttons, such as opening a section or demonstrating contact intent.
• Technical information provided by the browser and Google Analytics. Page addresses are sent without query parameters or fragments.

What we do not send

We do not send names, email addresses, phone numbers, answers, form input, or user identifiers to Google Analytics.

On protected pages, we record only the area, page, and access status. Strategic content and data about authorized people are not included in events.

How to change your choice

Use “Measurement preferences” in the footer at any time. If you decline after accepting, the website disables measurement and removes the Google Analytics cookies it can identify on this domain.

Technical errors and availability

We use Sentry to record technical website failures and investigate reliability problems. A record may include the error message, technical stack trace, route without parameters, and browser and runtime information.

We do not send identity, form content, cookies, URL parameters, or session replay. The project is also configured not to store IP addresses.

This technical record is separate from optional navigation measurement and is not changed by Google Analytics preferences.

We also use Vercel Speed Insights, in production only, to measure a 5% sample of technical performance indicators on public pages.

Before sending, we limit addresses to aggregated public routes, without locale, URL parameters, fragments, access areas, or internal pages.

Retention and security

We keep data for as long as necessary for the purposes described, the contracted service, security, and applicable legal or regulatory obligations. After that, data is deleted, anonymized, or retained only when there is a valid reason to preserve it. We apply access controls and technical measures proportionate to risk, but no internet-connected system eliminates every risk.

Providers

For optional measurement, we use Google Analytics. See the Google Privacy Policy. For technical monitoring, see the Sentry Privacy Policy. For performance metrics, see the Vercel Privacy Policy.

We use Resend to deliver contact and interview form messages. See the Resend Privacy Policy.

The service may also use hosting, database, authentication, maps, notification, and payment providers according to the enabled modules. Each provider receives only the data needed for its contracted function and may operate in other countries under applicable safeguards.

Your rights

Under applicable law, you may request confirmation and access, correction, information about sharing, review of automated decisions when applicable, portability, and anonymization, blocking, or deletion in the cases provided by law. You may also withdraw consent and object to certain processing. Some requests may require identity verification and may be subject to legal or contractual limits.

To exercise your rights, request account deletion, or ask a privacy question, email contato@mizz.food.

Organization responsible for Mizz

Mizz is developed by OnTimeStack.