Privacy Policy

For information about the people who run a Kitchen (owners and staff), PrepFlow acts as the business responsible for that data. For a Kitchen's own customers(diners who order from a Kitchen's storefront), the Kitchen decides how that data is used and PrepFlow processes it on the Kitchen's behalf.

Account information — name, email, and login details for Kitchen owners and staff (managed by our authentication provider).

Kitchen & operational data — menus, recipes, inventory, orders, and settings you enter.

Customer information (on behalf of a Kitchen) — a diner's name, email, phone, delivery address, order history, dietary preferences, and loyalty balance.

Payment information — payments are handled by Stripe. We do not collect or store full card numbers; Stripe processes them directly.

Usage & device data — pages viewed, referring website, approximate location (from IP), browser/device type, and interactions, used to operate and improve the Service.

To provide and secure the Service; process orders and subscriptions; send transactional email (confirmations, receipts, reminders); provide support; measure and improve product performance; understand where our signups come from; and comply with legal obligations.

We use a small number of cookies. Some are essential to run the Service (for example, keeping you signed in). Others are used for analytics — understanding traffic and how the product is used — and for attribution (recording which channel referred a new signup). Where required, we ask for your consent before setting non-essential cookies, and you can decline. Analytics may be provided by PostHog. You can also control cookies through your browser settings.

We share data with vendors who help us run the Service, under agreements that limit their use of it:

Stripe (payments), Clerk (authentication), Resend (transactional email), Neon (database hosting), Netlify (application hosting), PostHog (product analytics), and Anthropic (AI processing of supplier invoices you upload, for the optional invoice-scanning feature). We do not sell personal information.

We keep personal information for as long as needed to provide the Service and for a reasonable period afterward, or as required by law. Kitchens can request deletion or export of their data; some records may be retained where we have a legal obligation to keep them.

We use industry-standard measures to protect personal information, including encryption in transit and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to notify affected users of a material breach as required by law.

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and you may withdraw consent for non-essential processing. To make a request, contact us at support@prepflow.ca. If PrepFlow processes information on behalf of a Kitchen, we will direct your request to that Kitchen where appropriate.

Our providers may process data in the United States or other countries. Where data crosses borders, we rely on the safeguards and terms offered by those providers.

The Service is not directed to children, and we do not knowingly collect their personal information.

We may update this Policy; we will post the new version here and update the date above. Material changes will be communicated through the Service or by email.

The organization responsible for personal information under this Policy is 2557551 Ontario Inc., operating as CodeSmart. Privacy questions or requests (including access, correction, or deletion): support@prepflow.ca.