Legal

Privacy

Last updated 4 November 2026

Draft for approval. Written from Piano's data-protection notes for the owner to approve, ideally with a lawyer. Marked to confirm where a fact is still open.

This page says what personal data Intelligence Arts Ltd handles on pianoros.com and in Piano, why, where it is kept, for how long, and what you can ask of us. It is written for the Mauritius Data Protection Act 2017 and the United Arab Emirates' Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

Who we are

Piano is made by Intelligence Arts Ltd, a company registered in Mauritius to confirm: business registration number, to confirm: registered office, Moka, Mauritius, also in Dubai, United Arab Emirates.

For anything on this page, write to [email protected].

On this website

No cookies, no advertising

This website sets no cookies, shows no advertising and follows nobody to other websites. We sell nothing about you and share nothing for marketing.

Counting visits

We count page views with Cloudflare Web Analytics, which works without cookies and without storing anything on your device. It tells us how many people read which page, from which kind of device and country; it does not tell us who you are.

The request form

Until online sign-up opens, the buttons Start with Counter, Start with Full, Start in ten minutes and Create your restaurant open a short form. It asks for four things: your name, your restaurant, your country and your email, and notes which button you pressed. We use them to set your restaurant up and to reply to you, nothing else.

They reach us as one email. The website keeps no copy and no database. The email stays in our inbox while we set you up and look after your account; if you do not become a client, we delete it within twelve months to confirm, or sooner if you ask.

The spam check

The form uses Cloudflare Turnstile to tell a person from a robot. It reads technical signals from your browser for that check only.

Hosting and downloads

The website is served by Cloudflare, which, like any web host, handles your IP address and browser details to deliver the pages and protect them from attacks. The till's installer is downloaded from GitHub, which handles that download under its own privacy statement.

In Piano, for restaurants that use it

What Piano holds

• Your staff's display names, roles and where they work, and a record of what was done at the till (sales, refunds, closes), so that every action has a name.
• Till PINs, kept only on the till and only in a scrambled (hashed) form. They never leave the till.
• The email, name and role of each person who signs in to Piano Cloud. Passwords are kept only in a scrambled form.
• The details on a business invoice, when a customer asks for one: exactly the fields the tax authority requires.
• The name you give each kitchen screen when you pair it. Name the device, not the person.

Training on the kitchen screens is recorded per station, not per person.

What Piano does not hold

Your customers' names or phone numbers on ordinary receipts, card numbers (a card payment is entered as an amount; no card number reaches Piano), biometrics, or camera images.

Where it is kept

The original records are on your till, in your restaurant. A copy is kept in Piano Cloud, hosted by Scaleway SAS in Paris, France, in the European Union, with a daily backup kept for 30 days. No sale, invoice or fiscal number is ever held only in the cloud.

When something goes wrong

A technical error report goes to our error-tracking service (Sentry to confirm: where it is hosted) so we can fix the fault. It carries no sales lines and no customer data. A fuller diagnostics file, with staff names and the last day's activity, is sent only when a manager presses Send diagnostics, and is kept until the problem is solved.

Reading a menu file with AI

If you choose a file under Menu › Import a file › Pre-filled by the AI, that one file is sent to an AI service, Anthropic's Claude, to be read, along with your restaurants' names and currencies. As the screen says: “The file you choose is sent to an AI service to read it. Nothing else leaves Piano.”

Who decides

For what Piano records about a restaurant's staff, the restaurant decides and we act on its behalf to run Piano. For this website, the request form and our own accounts with clients, we decide. to confirm with a lawyer

How long we keep it

• Fiscal and audit records (receipts, refunds, closes, who did them): for the years tax law requires. They are kept on the till.
• The Piano Cloud copy: while you are a client, with daily backups kept for 30 days. After a client stops: to confirm.
• Sign-in accounts: for as long as the contract runs. When someone leaves, their account is closed at once. Their name stays on past receipts and audit lines, because those records belong to the law, not to us.
• Diagnostics files: until the problem they were sent for is solved.

Outside Mauritius and the UAE

Some of the services above are run from other countries: Cloudflare (worldwide), Scaleway (France), Sentry, Anthropic and GitHub (United States), and our email provider to confirm. We use each under a contract that binds it to protect the data it handles for us.

What you can ask of us

You can ask to see the personal data we hold about you, to have it corrected or deleted, to object to how we use it, or to withdraw a consent you gave. Write to [email protected]; we answer within one month.

If you work at a restaurant that uses Piano, your employer decides what is recorded about you; ask them first, or write to us and we will pass it on.

Some records cannot be deleted: a name on a past receipt or audit line stays, because tax law requires those records to be kept as they were.

If you are not satisfied with our answer, you can complain to the Data Protection Office in Mauritius or, in the United Arab Emirates, to the UAE Data Office.

Changes to this page

When this page changes, the date at the top changes. If a change affects how we use a client's data, we tell the client by email before it applies.