Your invoice stays private
Raw documents, extracted lines and supplier account details are tenant-private. Another operator never receives them.
Privacy in plain language
Your invoice stays yours. Peers see only a safe summary.
PriceGrid needs line-item data to calculate your own history. Cross-operator comparisons are deidentified, thresholded and deliberately narrow.
The 30-second promise: we do not show one restaurant another restaurant’s invoices or raw prices. A peer benchmark appears only after at least five eligible sites contribute one latest observation each. Otherwise, it stays hidden.
Small groups stay hidden
If fewer than five eligible sites form a cohort, the operator response contains neither a peer count nor any percentile.
Review comes before contribution
Only approved, normalised observations can enter a cohort. Rejected, duplicated and quarantined lines stay out.
You can leave
An owner can export information, withdraw aggregation consent and request deletion. Withdrawal immediately stops future contribution.
Information we use
Only what the product needs
- Account, membership and site details
- Invoice files, extracted fields and review decisions
- Normalised price observations
- Product security and audit events
Default retention
Limited and documented
- Processing copy
- Up to 24 hours
- Raw invoice and extraction
- 12 months
- Approved observations
- While the account is active
- Audit and security events
- 24 months
Hosting and service providers
The pilot application and data services are designed for Sydney, Australia. Specialist providers may process a transient invoice copy for malware screening and OCR, or deliver transactional email. PriceGrid remains responsible for appropriate safeguards, access controls, deletion and New Zealand Privacy Act obligations.
Your choices and rights
The public synthetic release does not accept customer data. Before the live pilot opens, tenant owners will receive an auditable path to request a portable export or reviewed-information correction, rotate an invoice-forwarding token, withdraw aggregation consent, and request account deletion. Consent withdrawal will stop new benchmark contribution immediately and trigger cohort recomputation.
Before real-data launch
The public synthetic demo contains no customer data. Real invoice ingestion remains gated until the operational privacy notice, subprocessor list, overseas-disclosure assessment, incident process and independent competition-law review are complete.