Privacy Policy

Only what it takes to run CASEWISE for your restaurant:

• Your account. Your email address and password (stored only as a hash by our sign-in provider), your restaurant's name and locations, and the people you invite: their email addresses, roles and which locations they can see.
• Your invoices. The photos and PDFs you upload, and what we read from them: the supplier, invoice number and date, each line's item, quantity, pack size and price, and the totals.
• Your answers and changes. When you answer a question about an invoice or correct a line, we keep what changed, who changed it and when, so the history can be checked.
• Running the service. How much invoice reading each location has used, and a record of the emails we send you.
• Phone notifications, if you turn them on. The address your phone's browser gives us for sending them, and the kind of device (such as “iPhone”). Turning them off, or signing out on that device, deletes it.
• The inquiry form. Your restaurant's name and address, your name and email, and, if you give them, a phone number and a note.
• Technical basics. A cookie that keeps you signed in, and your browser remembering your light or dark setting and whether you closed the “install the app” or “get a ping” card. Our hosting provider logs requests, including IP addresses, for security and to fix problems. We don't use advertising or analytics trackers.

To give you the service you signed up for:

• reading your invoices and tracking what you pay each supplier over time;
• your reports, price alerts and the weekly email;
• remembering your answers, such as a supplier's pack size, so we don't ask again;
• keeping accounts secure, answering you, and finding and fixing problems.

We don't sell your data, we don't use it for advertising, and nobody outside your restaurant's account sees your invoices or prices.

We plan to show restaurants how their prices compare with what others pay. To do that, we may combine prices from many restaurants into anonymized figures that don't name or point to any restaurant, location or person. A figure is only shown when enough restaurants contributed to it that no single one can be picked out. Because these figures can't be traced back to you, they aren't removed if you delete your account.

Inside your account, people see what you give them access to: the owner decides who is invited and which locations each person can see.

Outside it, only the companies that run parts of CASEWISE for us:

• Vercel hosts the website and app.
• Supabase holds the database, your uploaded files and sign-in.
• Anthropic provides the AI that reads your invoice pages. We send it the page images and get back what's printed on them. Under the terms we use, Anthropic doesn't train its models on them.
• Postmark sends our emails.
• Apple, Google, Mozilla or Microsoft, whichever made your browser, deliver phone notifications if you turn them on. Each notification is encrypted so only your device can read it: it names the supplier and invoice number, never amounts.
• Google Workspace holds our own email, when you write to us.

Each of them handles your data only to provide its service to us. We would also share information if the law requires it, or with a buyer if CASEWISE were sold, in which case this policy would still apply to your data.

We keep your data while your account is open, so your price history stays complete.

• An invoice you delete is removed, with its pages, straight away.
• If you ask us to delete your restaurant's account, we delete its data within 30 days.
• Deleted data can remain in our database backups until they age out, about a week later.
• The companies above keep their own records for their own retention periods, for example the history of emails sent. We can't delete those on request.
• Anonymized price figures (see above) are kept.

Your data travels encrypted. Your uploaded files are private, and the database itself checks who is allowed to see each restaurant's and each location's data. No system is perfectly secure; if we learn of a breach that affects your data, we'll tell you.

Email us to:

• get a copy of your data;
• correct something we have wrong (you can also fix invoice lines yourself);
• delete your account and your restaurant's data.

We answer within 30 days. If you were invited to someone else's restaurant account, its owner controls that account's data, so we may ask them first.

CASEWISE is a tool for businesses and isn't meant for anyone under 18.

If we change this policy, we'll update the date at the top. If a change affects how we use data you've already given us, we'll email account owners before it takes effect.