Privacy

Account data: your name, email address, hashed password, and the organisation and venue you belong to.

Operational data: the products, counts, recipes, invoices and sales you enter or import. This is your business data — we treat it as yours.

Contact data: if you request a demo, the details you put in that form.

Technical data: standard server logs, which include IP address and browser, kept for security and debugging.

We do not collect payment card details directly — when billing is enabled, that is handled by our payment processor and never touches our servers.

We do not sell or rent your data to anyone, and we do not use your operational data to advertise to you.

Passwords are hashed with scrypt and never stored in a recoverable form. Session tokens are stored as hashes, so a copy of our database cannot be replayed as a login.

Every venue's data is isolated, and every read and write is scoped to the organisation of the signed-in user.

Data is transmitted over TLS and stored in a managed PostgreSQL database with encryption at rest.

Users you invite to your organisation, according to their role.

Our infrastructure providers — hosting, database and email — strictly to run the service.

Our own staff, only where necessary to support you or investigate a fault, and never casually.

For as long as your account is active. If you cancel, your data stays available for 30 days in case you come back, then is deleted.

You can ask us to delete everything sooner and we will, without asking why.

You can export your data at any time — every report has a CSV export, and we will provide a full dump on request.

You can ask for correction or deletion of your personal data. Email us and we will act within 30 days.

Questions about any of this go to privacy@pourpoint.app and a person will answer.