Privacy Policy

1. Information we collect

• Account information. Your name, email address, organization name, and role, provided when you sign up or are invited to a team.
• Operational data. The business data you enter — recipes, ingredients, customers, orders, inventory, locations, and labels. This belongs to your organization; we process it only to provide the Service.
• Billing information. Subscription and payment details are handled by our payment processor, Stripe. We store your subscription status and a Stripe customer reference, not full card numbers.
• Usage and technical data. Log data such as IP address, browser type, and actions taken in the app (including an audit trail of changes), used for security, support, and improving the Service.

2. How we use your information

We use your information to operate and secure the Service, process subscriptions and billing, provide support, send service-related communications (such as invitations, password resets, and account notices), and comply with our legal obligations. We do not sell your personal information.

3. Tenant isolation

Provendry is multi-tenant. Each organization's data is logically isolated and enforced at the database layer with row-level security, so your data is accessible only to members of your organization and to our systems acting on your behalf.

4. Service providers (sub-processors)

We share data with vendors who process it on our behalf, under contract, only to deliver the Service:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Stripe — subscription billing and payment processing.
• Resend — transactional email delivery.
• OpenAI — optional AI features (e.g. label copy and spec-sheet extraction). Content you submit to an AI feature is sent to OpenAI to generate a result and is not used to train their models under our API terms.

5. Data retention

We retain your organization's data for as long as your account is active. After cancellation we retain data for a limited period to allow reactivation and to meet legal or accounting requirements, after which it is deleted or anonymized. You may request export or deletion of your data at any time.

6. Security

We use industry-standard measures including encryption in transit, access controls, and row-level security to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to notify you of material breaches as required by law.

7. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details below.

8. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with an updated effective date, and where required we will notify you.

9. Contact

Questions or requests? Contact us at support@roxstarlab.com.