Privacy policy

1. Two roles

For your account (your name, email, sign-in and security records), Item86 decides how the data is used: we are the controller, and this policy applies.

For the business data a hotel or restaurant puts into Item86 (sales, recipes, purchases, comps, staffing, POS checks), the hotel or restaurant is the controller and Item86 processes the data on its behalf, under our data processing agreement. Questions about that data are best sent to the hotel or restaurant that uses Item86.

2. What we collect

Account and team

• Your name and work email, and your password, which we store only as a one-way hash (we can't read it).
• The organization you belong to, your role (owner, group manager, outlet manager or viewer) and the outlets you can see.
• Invitations: the email address invited, the role and outlets, who invited them. Invitation links are stored only as a hash.

Sign-in and security records

• Session records, including the IP address and browser (user agent) a session was started from. Sessions last up to 14 days.
• Short-lived records of sign-in, sign-up and password-reset attempts by IP address, to stop password-guessing (rate limiting).
• An activity log of changes made in an organization (for example "imported sales file", "changed a recipe"), with who made them and when.

Emails

When we send you an email (invitation, password reset, "password changed", welcome), our email provider processes your address and the message.

Business data entered by our customers

Dishes, prices, costs, recipes, ingredients, supplier prices, sales and purchase figures, stock counts, comps and discounts (with their reasons and, if entered, the name of the person who approved them), staffing roles and pay rates, menu photos, and closed POS checks (time, table, number of guests, amounts and items). Item86 doesn't ask for guests' names or contact details, and imports from POS systems don't include them. For POS connections we store the login details the customer gives us, encrypted (see section 7).

What we don't do

We don't use analytics or advertising trackers, don't sell personal data, and don't use customers' data to train AI models. We don't take card payments in the app.

3. Why we use it, and on what legal basis

• To provide the service you or your employer signed up for: accounts, teams, emails about your account. Basis: the contract with you or your organization.
• To keep the service secure: sessions, rate limiting, the activity log, investigating misuse. Basis: our legitimate interest in protecting the service and our customers' data.
• To answer you when you contact us. Basis: legitimate interest, or the contract.
• To meet legal obligations, for example keeping records required by law or answering lawful requests.

4. Cookies

Item86 uses only cookies that are needed for it to work, so it doesn't ask for cookie consent:

• Session cookie (set by our sign-in system): keeps you signed in, for up to 14 days.
• item86_org: remembers which organization you were working in, for up to a year.

Fonts and all other files are served by Item86 itself; your browser doesn't contact third parties such as Google when you use the app.

5. Who processes data for us

We use these providers, under contracts that require them to protect the data and use it only to provide their service to us:

When a customer connects its POS (for example Oracle Simphony), Item86 retrieves the customer's own sales data from that system on the customer's instruction. We may also disclose data if the law requires it.

6. International transfers

Our providers are US companies. Where personal data from the EU, the UK, Georgia or another country with transfer rules is accessible from outside it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, as available for each provider. [To be confirmed with each provider's data processing terms.]

7. How we protect it

• All traffic is encrypted (HTTPS). Passwords are stored only as salted hashes.
• POS login details are encrypted with AES-256-GCM before they are stored; POS keys and invitation links are stored only as hashes.
• Every organization's data is kept apart and every request is checked against the user's organization, role and outlets; automated tests check that one organization can't reach another's data.
• Sign-in attempts are rate limited, and changes are recorded in an activity log.

8. How long we keep it

• Account data: while the account is active. When an organization or account is closed, we delete it within 30 days, apart from backups, which are overwritten on our database provider's schedule [confirm the backup period], and anything we must keep by law.
• Sessions: up to 14 days. Rate-limit records: minutes. Invitation links: expire after 7 days.
• Business data: as the customer decides, under the data processing agreement.

9. Your rights

Depending on where you are, you can ask us for a copy of your personal data, to correct or delete it, to restrict or object to its use, or to receive it in a portable format. Write to [privacy@item86.co]; we answer within one month. If your data is in a customer's business data, we will pass your request to that customer and help them answer it.

You can also complain to a data protection authority, for example the Personal Data Protection Service of Georgia, or the authority where you live or work in the EU or UK.

10. Children

Item86 is a business service and is not meant for anyone under 18.

11. Changes

If we change this policy in a way that matters, we will tell account owners by email before the change takes effect. The version and date are at the top of this page.

12. Contact

[Company legal name], [registered address]. Privacy questions: [privacy@item86.co]. Everything else: [hello@item86.co].