Privacy Policy

Account details. Your email address, a password (stored only as a salted hash by our authentication provider), your business name and type, and your name if you give it.

What you put into the app. Photos and PDFs of supplier invoices, menus and recipes; the details read from them (vendors, invoice numbers and dates, line items, quantities, prices); your ingredient list and costs; recipes, menu items and selling prices; your settings, such as target margin and alert threshold; and the decisions you make while reviewing, such as confirming that a supplier's wording means a particular ingredient.

Technical data. When you use the site, our hosting and database providers record standard request logs (IP address, browser type, pages requested, time, errors). We use these to keep the service running and secure. We also count page visits with Vercel Web Analytics, which sets no cookies and records only the kind of page visited, the referring site and general device details (browser, operating system, country) — not who you are or what's in your account.

Records we keep about your account. Which version of our Terms and this policy you agreed to, and when; when you signed up and last signed in; and a daily count of how many documents you had read by AI (to apply the daily limit).

Other people in your documents. Supplier invoices can name a supplier's staff or show their business address. We use that only as part of your invoice; we don't build records about those people or use it for anything else.

We don't ask for payment card details, and we don't collect information about your customers.

Only to run DoughTally for you:

• to read your documents and turn them into costs, recipes and menu items;
• to match invoice lines to your ingredients, and remember how each supplier words things so it can match them automatically next time;
• to calculate costs and margins, raise price alerts and suggest options;
• to sign you in, keep your account secure, and send the emails the service needs (such as confirming your address or resetting a password);
• to find and fix problems, and to answer you when you contact us.

We don't sell your data, share it with advertisers, or use it to advertise to you. We don't combine your business's numbers with anyone else's, and we don't show them to other users.

To read your documents, DoughTally sends them to AI models run by our service providers:

• Anthropic (Claude) receives the images and PDFs you upload and the text read from them, invoice lines you type in by hand, and your ingredient, recipe and menu names and figures — to extract line items, menu items and recipes, to match and convert recipe amounts, to link menu items to recipes, and to write the short plain-English summaries on price alerts.
• Voyage AI receives ingredient names and invoice item descriptions (text only, not your documents) to produce the numerical representations used for matching.

Both process this data to provide their service to us under their commercial API terms, which do not permit them to train their models on it; they may keep it for a limited time under those terms (for example, to detect abuse). Nothing that AI reads changes your costs on its own when it isn't sure: uncertain matches wait for you to confirm, and you can correct anything.

We use a small number of providers to run the service. Each only gets what it needs to do its job:

• Supabase: database, sign-in, and storage for your uploaded files.
• Vercel: hosting of the website and app, and anonymous, cookie-free visit counts.
• Anthropic and Voyage AI: as described above.
• An email delivery provider, for account emails.

Market prices come from public sources (the USDA Agricultural Marketing Service, the UN Food and Agriculture Organization and the US Bureau of Labor Statistics). We only download from them; none of your information is sent to them.

We may disclose information if the law requires it, to protect the rights and safety of our users or the service, or as part of a sale or merger of the business, in which case this policy would continue to apply to your data.

We use only the cookies needed to keep you signed in. There are no advertising or cross-site tracking cookies, and our visit counting uses no cookies at all.

The app also stores a small note in your browser if you dismiss the “install the app” card, so it stops asking. If you install DoughTally to your home screen, your device keeps a copy of the offline page and app files; it never stores your business data offline.

Every item, what it's for and how long it lasts is listed in our Cookie Policy.

Your data is encrypted in transit (HTTPS) and at rest with our providers. Every row in the database belongs to one business, and the database itself refuses to show it to anyone outside that business. Uploaded files are kept in private storage that only your account can read. Server-side secrets are never sent to your browser.

No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you without undue delay.

How long we keep each kind of information:

• Account details, your business's records and your invoice files: while you have an account. You can edit or delete individual ingredients, recipes, menu items and invoice lines at any time.
• Menu and recipe photos you import: deleted as soon as you save the import, and within about a day if you don't finish it.
• Request and error logs: kept by our hosting and database providers for their standard periods (typically days to a few weeks), then deleted.
• After you delete your account: removed from the live service straight away; copies in our providers' backups age out on their normal schedules (typically within 30 days).

Settings → Download my data gives you a copy of everything we hold for your account and business, as one file. Settings → Delete account deletes your account and all of its data. You can also email support@doughtally.app from the address on the account for either, or to correct anything you can't edit yourself.

Depending on where you live, you may have further rights under laws such as the GDPR; email us and we'll respond within the time the law requires. California residents, see below.

Do Not Track and Global Privacy Control. We don't track you across other websites or let anyone else do so on ours, and we don't sell or share personal information for advertising, so there is nothing for these browser signals to switch off. The site works the same whether or not your browser sends them.

This section is for California residents and follows the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA). In the last 12 months we have collected these categories of personal information, all from you, your uploads and your device, and only for the purposes in “How we use it”:

• Identifiers: email address, name if you give it, account ID, IP address.
• Account login details: your email and password (stored only as a salted hash). This is “sensitive personal information”; we use it only to sign you in and keep your account secure.
• Commercial information: your business's purchases from suppliers, as read from your invoices, and its recipes, menu and prices.
• Internet or network activity: request logs and anonymous page-visit counts, as described above.

We disclose these categories only to the service providers listed in “Who else handles your data”, for the business purpose of running DoughTally. We do not sell or share personal information (including for cross-context behavioral advertising), and have not in the last 12 months; we don't sell or share the information of anyone under 16. We don't use sensitive personal information to infer anything about you, and we don't make automated decisions that have legal or similarly significant effects on you: DoughTally's suggestions are options for you to choose from.

You have the right to know what personal information we hold and how we use it, to get a copy of it in a portable format, to have it corrected or deleted, to opt out of its sale or sharing (we do neither), and to limit the use of sensitive personal information (we already use it only to provide the service). We won't treat you differently for using any of these rights.

To use them: Settings → Download my data and Settings → Delete account work straight away. Or email support@doughtally.app from the address on your account; we verify a request by confirming it with that address, and answer within 45 days (we'll tell you if we need up to 45 more). You can have an authorized agent make a request for you; we'll ask for your signed permission and confirm the request with you directly. We don't disclose personal information to third parties for their own direct marketing.

DoughTally is a business tool for adults (our Terms require users to be 18 or older). It isn't directed at children, and we don't knowingly collect information from anyone under 18; if we learn we have, we delete it.

Our providers may store and process data in the United States and other countries. Where the law requires it, transfers are covered by the providers' standard contractual protections.

If we change this policy in a way that matters, we'll update the date above and tell signed-up users by email or in the app before the change takes effect.

Questions or requests: support@doughtally.app. This policy covers doughtally.app and the DoughTally app, operated by DoughTally Software. See also our Terms of Service.