Privacy Policy

Last Updated: August 14, 2026

At PlateSense ("we," "our," or "us"), we respect your privacy and are committed to protecting the personal and business information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile applications, and software services (collectively, the "Service").

By accessing or using our Service, you agree to the terms of this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

1. Information We Collect

1.1 Personal Information

We collect personal details when you register for an account, subscribe to a plan, or contact support. This may include:

  • Name and display name
  • Email address
  • Password (stored in hashed form)
  • Restaurant or business name
  • Billing information (processed by our payment provider; we do not store full payment card numbers)

1.2 Business Data

Our Service allows you to upload, input, and manage business data, including:

  • Invoice documents (images, PDFs) and extracted line item data
  • Inventory items, quantities, pricing, and cost history
  • Recipes, ingredients, yields, and cost calculations
  • Menu items, categories, and pricing
  • Supplier and vendor information
  • Preferred ingredient names and terminology
  • Inventory count records and valuations
  • Point-of-sale (POS) sales data (if you connect a POS integration)

You retain full ownership of your Business Data. We process it strictly to provide and improve the Service.

1.3 Usage and Analytics Data

We automatically collect certain information when you use the Service, including:

  • Pages visited, features used, and actions taken within the Service
  • Device type, browser type, operating system, and screen resolution
  • IP address, approximate geographic location, and referring URLs
  • Session duration, click patterns, and navigation paths
  • Error logs and performance data

We use Google Analytics (Firebase) to collect and analyze this data. Google Analytics may set cookies on your device. For more information, see Section 6 (Cookies and Tracking Technologies).

1.4 Mobile Application Data

If you use our mobile application, we may additionally collect:

  • Device identifiers and push notification tokens
  • Camera images (only when you explicitly capture or select photos for invoice upload)
  • Photo library access (only when you select images for upload)

Camera and photo library data is used solely for invoice processing and is not accessed for any other purpose.

1.5 Email-Submitted Data

If you submit invoices or POS reports via our designated email addresses (e.g., invoices@data.platesense.ai, pos@data.platesense.ai), we collect and process the email content, attachments, and sender information for the purpose of extracting business data into your account.

1.6 AI Chat Conversations

If you use our AI assistant ("Sage"), we collect the messages you send and the responses generated. Sage may access your Business Data (inventory, recipes, invoices, pricing) in order to provide contextual answers. Chat conversations are processed by our third-party AI provider (see Section 5).

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Service, including AI-powered features
  • Process invoices, calculate costs, and manage inventory on your behalf
  • Generate AI-powered insights, suggestions, and conversational responses
  • Process your transactions and manage your account and subscription
  • Improve, personalize, and expand the Service based on usage patterns
  • Send you service-related notifications, security alerts, and support messages
  • Respond to your comments, questions, and customer service requests
  • Detect and prevent fraud, abuse, and security incidents
  • Generate aggregated, anonymized analytics to understand industry trends
  • Comply with legal obligations

We do not use your Business Data to train our own proprietary machine learning models. AI processing is performed by third-party providers under their API terms (see Section 5).

3. AI and Automated Processing

A core feature of PlateSense involves processing your data using artificial intelligence (AI) and machine learning (ML) technologies. This includes:

  • Invoice OCR and Extraction: Invoice images and PDFs are sent to AI services for optical character recognition and structured data extraction.
  • Inventory Matching: Extracted invoice line items are compared against your inventory using AI to suggest matches.
  • Recipe and Menu Import: Uploaded documents (menus, recipe lists) are processed by AI to extract structured data.
  • Price Anomaly Detection: AI analyzes pricing patterns to identify potential errors or anomalies.
  • Sage AI Assistant: Your conversational queries, along with relevant Business Data context, are processed by AI to generate responses.
  • Category Image Generation: AI may generate illustrative images for your recipe and menu item categories.
  • Vendor and Supplier Identification: AI analyzes invoice content to identify and match vendors.

Important: When your data is processed by AI, it is transmitted to our third-party AI provider (currently Google Gemini API). Under Google's API terms of service, data submitted through the Gemini API is not used by Google to train its foundation models. We do not permit any third-party AI provider to use your data for their own training, marketing, or other unrelated purposes.

4. AI-Generated Content

The Service may generate content using AI, including:

  • Category images for recipe types and menu item categories
  • Suggested ingredient names, matches, and corrections
  • Conversational responses from the Sage AI assistant
  • Cost calculation explanations and price fix recommendations

AI-generated content is created algorithmically and may not always be accurate. AI-generated images are stored in our cloud infrastructure and shared across the platform (they are not unique to your account). See our Terms of Service for more details on AI accuracy disclaimers.

5. Third-Party Service Providers

We use the following categories of third-party service providers to operate the Service. These providers may process your information as described below:

Infrastructure and Hosting

  • Google Cloud Platform / Firebase: Cloud hosting, database (Firestore), authentication, file storage (Cloud Storage), serverless compute (Cloud Functions), and analytics. Your data is stored on Google Cloud servers in the United States.

AI and Machine Learning

  • Google Gemini API: Powers all AI features including invoice OCR, inventory matching, recipe extraction, Sage AI assistant, and image generation. Data is processed under Google's API terms, which prohibit use of API data for model training.

Email Processing

  • Cloudflare: Email routing for invoice and POS report submission addresses. Cloudflare processes email metadata and forwards content to our Firebase backend.

Analytics

  • Google Analytics (Firebase Analytics): Collects usage data, page views, feature engagement, and event tracking as described in Section 1.3.

All third-party providers are bound by contractual obligations to protect your information and are prohibited from using it for purposes unrelated to providing services to us.

6. Cookies and Tracking Technologies

We use the following tracking technologies:

  • Essential Cookies: Required for authentication, session management, and security. These cannot be disabled without breaking core functionality.
  • Analytics Cookies: Set by Google Analytics (Firebase) to collect usage data, including page views, feature interactions, session duration, and user flow. These cookies help us understand how the Service is used and identify areas for improvement.

We do not use advertising cookies or sell your data to advertisers. We do not participate in cross-site tracking for advertising purposes.

You can control cookies through your browser settings. Disabling analytics cookies will not affect the core functionality of the Service, but it will limit our ability to improve your experience.

7. Sharing Your Information

We may share your information in the following circumstances:

  • Service Providers: With the third-party providers listed in Section 5, strictly for the purposes of providing the Service.
  • Legal Requirements: If required by law, regulation, legal process, or governmental request.
  • Safety and Rights: To protect the rights, property, or safety of PlateSense, our users, or the public.
  • Business Transfers: In connection with a merger, acquisition, sale of assets, or bankruptcy proceeding. You will be notified of any change in ownership or use of your information.
  • With Your Consent: With your explicit consent or at your direction.

We do not sell your personal information or Business Data to third parties. We do not share your data with third parties for their own marketing purposes.

8. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy. Specific retention periods include:

  • Account Data: Retained for the duration of your account. Upon account deletion, personal information is deleted within 30 days.
  • Business Data: Retained for the duration of your account. You may export your data at any time. After account termination, Business Data is retained for 30 days to allow for export, then scheduled for deletion.
  • Invoice Files: Original invoice images and PDFs stored in cloud storage are retained for the duration of your account and deleted within 30 days of account termination.
  • AI Processing Logs: Internal logs related to AI processing (token usage, pipeline events) are retained for up to 90 days for debugging and quality assurance, then automatically purged.
  • Analytics Data: Aggregated analytics data collected by Google Analytics is retained according to Google's standard retention policies (typically 14 months for user-level data).
  • Chat Conversations: Sage AI chat messages are retained for the duration of your account.

We may retain anonymized, aggregated data indefinitely, as it cannot be used to identify you or your business.

9. Data Security

We implement industry-standard security measures to protect your information, including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Firebase Authentication for secure account access
  • Firestore Security Rules enforcing restaurant-level data isolation (multi-tenancy)
  • Role-based access controls
  • Regular security reviews of our infrastructure

Despite our efforts, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. If you become aware of a security vulnerability, please report it immediately to support@platesense.ai.

10. International Data Transfers

Your information is processed and stored on servers located in the United States (Google Cloud Platform). If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

By using the Service, you consent to the transfer, processing, and storage of your information in the United States. We rely on Google Cloud's compliance frameworks (including Standard Contractual Clauses where applicable) to ensure adequate data protection for international transfers.

11. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate or incomplete personal information.
  • Deletion: Request deletion of your personal information, subject to certain exceptions (e.g., legal obligations).
  • Data Portability: Request your data in a structured, commonly used, machine-readable format.
  • Restriction: Request that we restrict the processing of your personal information in certain circumstances.
  • Objection: Object to the processing of your personal information for certain purposes.
  • Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.

You can manage most of your personal information directly within your account settings. You may export your Business Data at any time through the export features in the Service. You can also delete your account and eligible data yourself in the PlateSense mobile app under More > Settings > Profile, Password & Data > Account & Data Deletion, without contacting us first. If you cannot access the app, visit our Account & Data Deletion page to submit a request. We will respond to verified requests within 30 days (or as required by applicable law).

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights:

  • Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
  • Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
  • Right to Correct: You have the right to request correction of inaccurate personal information.
  • Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your California privacy rights, contact us at support@platesense.ai. We may need to verify your identity before processing your request.

Categories of personal information collected: Identifiers (name, email), commercial information (subscription data), internet/electronic activity (usage data, analytics), and professional information (business name, role).

13. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 13 (or the applicable age of consent in your jurisdiction). If we become aware that we have collected personal information from a child under the applicable age, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at support@platesense.ai.

14. Do Not Track

Some web browsers transmit "Do Not Track" (DNT) signals. Because there is no uniform standard for interpreting DNT signals, the Service does not currently respond to DNT browser signals. However, as stated above, we do not engage in cross-site tracking for advertising purposes.

15. POS Integration Data

If you connect a third-party point-of-sale (POS) system to the Service, we may receive sales data, transaction records, and menu item information from your POS provider. This data is:

  • Used solely to provide POS-related features within your account (e.g., sales tracking, menu item matching, variance analysis)
  • Stored in your Restaurant Account and subject to the same security and retention policies as your other Business Data
  • Not shared with other PlateSense users or third parties

You are responsible for ensuring you have the right to share POS data with us under your POS provider's terms of service.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 15 days before the changes take effect. We will update the "Last Updated" date at the top of this page. Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

17. Contact Us

If you have any questions about this Privacy Policy, your data, or your privacy rights, please contact us:

By email: support@platesense.ai