Terms of Use
Version 2.0 — effective from 20/11/2026
1. Identification and acceptance
These Terms govern the use of the Aufisoft platform, provided by LFKA DEV TECNOLOGIA LTDA, company ID (CNPJ) 60.825.050/0001-30, headquartered in Ourinhos/SP, Brazil ("Aufisoft").
By creating an account or using the Service, you declare that you have read, understood and accepted these Terms and the Privacy Policy, which forms an integral part of this contract. If you do not agree, do not use the Service.
By accepting, you declare that you have authority to bind the legal entity you represent.
2. Description of the Service
Software-as-a-service platform for restaurant management, including:
- Point of sale
- Inventory management and recipe costing
- Order, table and tab control
- Online menu and delivery platform integration
- Electronic consumer invoice issuance (NFC-e)
- Reports, analytics and an artificial intelligence assistant
- User and permission management
3. Account and registration
To use the Service you must create an account with complete and accurate information. You are responsible for:
- Keeping your credentials confidential
- All activity under your account
- Notifying us immediately of unauthorised use
- Keeping the information truthful and up to date
- Granting access only to those who need it, at the appropriate level — the platform offers role and permission-based control
4. Plans and payments
4.1 Free plan. There is no trial period. When you create an account you enter the Free plan, which generates no charge and has no expiry date. Charges only exist if you subscribe to a paid plan.
4.2 Free plan limits. The Free plan comprises 100 (one hundred) orders per month and 1 (one) user. Anything beyond those limits requires a paid plan, as described at aufisoft.com from time to time.
4.3 Changes to the Free plan. Aufisoft reserves the right to change the Free plan limits, discontinue it or begin charging for it in respect of accounts created after the notice, upon notice at aufisoft.com and by email. This reservation is made under the sole paragraph of Art. 429 of the Brazilian Civil Code.
4.4 Renewal. Subscriptions renew automatically at the end of each period unless cancelled beforehand.
4.5 Refunds. May be requested within 7 days of the charge, subject to review.
5. Acceptable use
You agree not to:
- Use the Service for any unlawful purpose
- Attempt to breach system security
- Reverse engineer, decompile or disassemble the software
- Transmit viruses or malicious code
- Resell or redistribute the Service without express authorisation
- Use the Service in a way that harms other users
- Enter personal data without a legal basis, or use it for a purpose other than the one disclosed to the data subjects — see Annex I
- Write third-party personal data into the AI assistant
6. Intellectual property
The content, features and technology of the Service belong to Aufisoft or its licensors.
6.1 Your data is yours. You retain all rights over the data you enter. We grant you a non-exclusive licence to use the software. On termination, you may export your data — see A.12.
7. Availability and support
7.1 We strive to keep the Service available, without guaranteeing uninterrupted operation. Scheduled maintenance is announced in advance.
7.2 Support follows the contracted plan.
8. Limitation of liability
Aufisoft is not liable for indirect, incidental, special, consequential or punitive damages — including lost profits and loss of data or use — arising from:
- Your access or use, or inability to access or use
- Third-party conduct or content on the Service
- Content obtained from the Service
- Unauthorised access, use or alteration of your transmissions
This limitation does not exclude the liability set out in the LGPD, addressed in Annex I.
9. Cancellation
9.1 By you. At any time, through the dashboard or support.
9.2 By us. We may suspend or terminate the account in case of breach of these Terms or non-payment.
9.3 After termination. A.12 applies regarding the return and deletion of data.
10. Modifications
We may modify these Terms. If the revision is material, we will give at least 30 days' notice by email or in-app notice. Continued use after the effective date constitutes acceptance.
Every version gets a number and a date, and previous ones remain available at aufisoft.com/termos/v/{version}.
Changes to the Free plan follow section 4.3, whose 90-day period for accounts already active prevails over the 30 days set out above.
11. Governing law and jurisdiction
Governed by the laws of Brazil. The courts of Ourinhos/SP are elected, unless the law determines otherwise due to the nature of the party.
12. Contact
- General: contact@aufisoft.com
- Privacy and data protection: privacy@aufisoft.com
Annex I — Data Processing Addendum
A.1 Definitions
The definitions of Art. 5 of the LGPD apply. In addition:
- Customer Data: personal data of end consumers and other data subjects that you enter or generate on the Platform
- Account Data: data of your users — name, email, credentials and access records
A.2 Roles of the parties
A.2.1 As to Customer Data, you are the controller and Aufisoft is the processor. You define the purposes and answer to the data subjects.
A.2.2 As to Account Data, Aufisoft is the controller, because it defines the identity, authentication and security model of the Platform.
A.2.3 As to the registration and management of your users, there is limited joint controllership: you decide who has access; Aufisoft controls the identity and authentication layer.
A.3 Controller instructions
A.3.1 The documented features of the Platform constitute the instructions you give Aufisoft. By using a feature, you instruct Aufisoft to carry out the corresponding processing.
A.3.2 These include, among others: customer registration; delivery address records, with geocoding; order recording and processing; NFC-e issuance; credit control; delivery platform integration; online menu; local printing; and courier registration.
A.3.3 Orders received from delivery platforms create or update a customer record on the Platform, including name, phone and tax ID where provided. By enabling the integration, you instruct this processing and take responsibility for informing the data subjects.
A.3.4 Measurement and advertising tools only operate if you configure them, with your own identifiers. You are the controller of that processing and answer for informing the data subjects. Aufisoft collects the end consumer's consent before loading them.
A.3.5 Instructions beyond the documented features require prior written agreement.
A.3.6 Aufisoft will inform you if it believes an instruction breaches the LGPD (Art. 39, final part).
A.4 Nature, purpose and duration
- Nature: collection, storage, organisation, consultation, transmission, deletion
- Purpose: operate the Platform as contracted
- Duration: the term of the contract, plus the statutory retention periods in A.12
A.5 Categories of data and data subjects
| Data subjects | Data |
|---|---|
| End consumers | name, phone, email, tax ID, address, location, order history, notes |
| Couriers | name |
| Your users | name, email, credentials, access records |
A.5.1 Sensitive data. The Platform is not intended for sensitive data (Art. 5, II). Free-text fields — customer notes and order remarks — must not receive information about health, medically motivated dietary restrictions, or any other sensitive category. Improper use of those fields is your responsibility.
A.6 Confidentiality
Aufisoft and its personnel will keep Customer Data confidential, an obligation that survives termination of the contract.
A.7 Security (Art. 46)
Aufisoft adopts, among others:
- Database storage within Brazilian territory
- Encryption in transit (TLS)
- Passwords stored encrypted, never in readable form
- Role and permission-based access control
- Logical isolation between restaurants
- A single session per user, with invalidation
- Incident response plan
A.8 Sub-processors
A.8.1 You authorise the engagement of the following sub-processors:
| Sub-processor category | Purpose | Country |
|---|---|---|
| Infrastructure and database | server, database and cache hosting | Brazil |
| Cloud storage and delivery | backups, file storage and content delivery | USA |
| Tax invoicing | NFC-e issuance | Brazil |
| Delivery platforms | order integration | Brazil |
| Network and routing | custom domain routing | global |
| Maps and geocoding | delivery calculation and location | USA |
| Postcode lookup | address completion | Brazil |
| Artificial intelligence | artificial intelligence assistant | USA |
| Transactional email | email delivery | USA |
A.8.1.1 The named, up-to-date list of sub-processors, with each one's legal name and country, is available on request at privacy@aufisoft.com. It is not published on this page for information security reasons, and is provided to you as controller whenever you ask.
A.8.2 Aufisoft will give 30 days' notice of any change. You may object with reasons; if the impasse persists, you may terminate without penalty.
A.8.3 Aufisoft is liable for its sub-processors as if the processing were its own.
A.9 Data subject rights
A.9.1 Aufisoft provides, within the Platform itself, functions to consult, correct, delete and export Customer Data, so that you can respond directly to data subject requests. Deletion operates as described in A.12.1.
A.9.2 A request received directly by Aufisoft will be forwarded to you within 2 business days, with notice to the data subject.
A.9.3 Your request for assistance will be answered within 10 calendar days — shorter than your own deadline towards the data subject, to give you room.
A.10 Security incident
A.10.1 Aufisoft will notify you within 24 hours of becoming aware of an incident affecting Customer Data, with the elements of Art. 6, §2 of ANPD Resolution 15/2024.
A.10.2 Aufisoft will provide the information needed for your notification to the ANPD and to data subjects.
A.10.3 Notification to the ANPD and to data subjects regarding Customer Data is your responsibility — you are the controller.
A.10.4 You will notify Aufisoft within 24 hours of an incident affecting the Platform.
A.11 International transfer
A.11.1 Some sub-processors are outside Brazil, as listed in A.8.1.
A.11.2 Aufisoft maintains contractual data protection commitments with each foreign sub-processor and selects its providers considering the safeguards offered. As they are formalised, the Standard Contractual Clauses approved by the ANPD (Resolution 19/2024, Art. 33, II, "b") will govern those transfers.
A.11.3 Where Customer Data is held. The live database is hosted within Brazilian territory. In addition:
- Backups of the database are generated daily and stored in the cloud in the United States , with a retention policy that deletes them automatically after the configured period.
- Files uploaded through the Platform — product images and tax reports — are also stored on the same infrastructure.
- The remaining foreign sub-processors in A.8.1 receive only the data necessary for their specific purpose.
A.11.4 All international transfers are covered by the safeguards in A.11.2.
A.12 Data deletion and termination
A.12.1 How deleting one of your customers works. When you delete a customer through the Platform, the operation has three effects with different timeframes:
| Data | Effect | Timeframe |
|---|---|---|
| Profile, addresses, contacts, notes and credit entries | deletion | immediate |
| Name and tax ID recorded in orders already placed | anonymisation — the order remains, without identifying the data subject | immediate |
| Tax document issued (NFC-e) and whatever tax law requires to be kept | retention for the statutory period, then deletion | 5 years from issuance |
A.12.1.1 How to request it. Deleting a record with no history is done directly by you on the Platform. Where orders or tax documents are involved, the operation is handled by Aufisoft's Data Protection Officer — privacy@aufisoft.com — within the A.9.3 deadline, because it requires separating what may be deleted from what has a statutory retention period.
A.12.2 The anonymisation in A.12.1 is grounded in Art. 16, IV of the LGPD — retention for the controller's exclusive use, third-party access forbidden, provided the data is anonymised. Retention of the tax document is grounded in Art. 16, I — compliance with a legal obligation.
A.12.3 Once complete, the history can no longer be linked to the data subject, either by you or by Aufisoft. You may request, at any time, a report of what was deleted and what was retained, with the respective justification — information you can pass on to the data subject under Art. 18, §4 of the LGPD.
A.12.4 Later collection. If the same data subject places a new order after deletion — including through an integrated delivery platform — their data will be collected again to fulfil that order. This is a new collection for a new relationship, not a restoration of deleted data.
A.12.5 Termination of the contract. On termination, Aufisoft makes Customer Data available for export, in a structured format, for 30 days. After that period, it deletes Customer Data within 90 days, subject to the same reservations as A.12.1. Accounting records and documents with a statutory retention period — as a rule 5 years — are kept for the statutory period, even after the contract has ended.
A.13 Audit
A.13.1 You may request information about the measures adopted, once a year.
A.13.2 Aufisoft may respond with a compliance report or certifications, instead of an on-site audit.
A.13.3 Where there is concrete evidence of non-compliance, a specific audit is warranted, at the cost of the requesting party, unless the non-compliance is confirmed.
A.14 Liability
A.14.1 Each party is liable under Arts. 42 and 43 of the LGPD.
A.14.2 Aufisoft is jointly liable where it breaches its processor obligations or acts outside your instructions (Art. 42, §1, II).
A.14.3 You are responsible for the lawfulness of the collection, the legal basis, informing the data subjects, and the content you enter on the Platform.
A.15 Data Protection Officer
- Aufisoft: Luis Andriolo — privacy@aufisoft.com
- Your Officer: inform Aufisoft, if you have one
Version history
- v1.0 — 20/10/2026: identification of the contracting party, jurisdiction, acceptable use clauses relating to personal data, and the inclusion of Annex I — Data Processing Addendum (Art. 39), absent from the previous version.