Privacy Policy

This Privacy Policy describes how The Pass ("we," "us," "our") collects, uses, and shares information when a restaurant or bakery business ("Customer") and its employees use The Pass's software (the "Service").

Who this applies to

The Pass is business software: a restaurant or bakery signs up as a Customer, and that Customer's owners, managers, and employees use the Service under the Customer's account. If you're an employee using The Pass through your employer, your employer is the Customer, and this policy describes what The Pass itself collects — your employer may have its own policies about how it uses your information internally.

Information we collect

We collect the following categories of information as part of operating the Service:

• Account and identity information: name, phone number, and role/position, used to create your account and sign you in. Employee sign-in uses a one-time code sent by SMS to your phone number; a short numeric PIN may also be set as a convenience re-lock on a shared device (this does not replace your real sign-in, it just re-locks the app after it's been idle).
• Location information: with your device's permission, we check your GPS location specifically to confirm you're on the Customer's premises before showing certain restricted content (currently: recipes). We do not use location data for general tracking, and it is not collected unless you're actively trying to view that restricted content.
• Work and scheduling information: shifts, availability, time-off requests, clock-in/clock-out times, checklist and task completion, and inventory counts.
• Financial information (business-level, not personal): the Customer's own sales and payroll data (mirrored from Square) and financial reports (mirrored from QuickBooks) — this is the Customer business's own financial data, used to power dashboards and reports for the Customer's owners/managers.
• Messages and photos: if the Customer uses The Pass's crew messaging feature, we store the text and any photos sent between team members using that feature.
• Device and notification data: a push-notification token, if you enable notifications, used only to deliver notifications to your device (e.g. a new message).

How we use this information

We use the information above to operate the Service: authenticating you, showing you your schedule and tasks, enforcing on-premises-only access to certain content, powering the Customer's own dashboards and reports, delivering messages and notifications, and providing customer support. We do not sell any of this information.

Who we share information with

The Service relies on a small number of infrastructure and integration providers to work:

• Square — as the source of the Customer's sales and payroll data, which we mirror into the Service.
• Intuit / QuickBooks — as the source of the Customer's financial reports, which we mirror into the Service with the Customer's authorization.
• Twilio / Bird — to deliver the SMS one-time codes used for employee sign-in.
• Supabase — our database and backend infrastructure provider, which stores the data described above.
• Vercel — our application hosting provider.
• Apple — for the iOS version of the Service, distributed through the App Store.

We do not share your information with any other third party except as required by law, or with your (or the Customer's) explicit consent.

Data retention

We retain information for as long as the Customer's account is active, and for a reasonable period afterward to allow account recovery and to meet legal/record-keeping obligations. A Customer or individual user may request deletion of their data by contacting us at the address below, subject to any legal retention requirements (for example, payroll and financial records may need to be retained for a minimum period regardless of a deletion request).

Security

We use industry-standard practices to protect information, including encryption in transit, access controls that isolate each Customer's data from every other Customer's, and role-based permissions within a Customer's own account. No system is perfectly secure, and we cannot guarantee absolute security.

Your choices

You can decline location permission (certain content simply won't be available) and notification permission (you won't receive push notifications) at the device level at any time. To request access to, correction of, or deletion of your information, contact us at the address below.

Changes to this policy

If we make material changes to this policy, we'll update the "last updated" date above and, where appropriate, notify Customers directly.

Contact

Questions about this policy or your information can be sent to support@thepass.cloud.