CaterKit Privacy Policy

Effective date: 9 July 2026 · Last updated: 11 October 2026 · Ardeo Labs LLC

1. What this covers

CaterKit ("we," "us") is run by ARDEO LABS LLC, a Florida limited liability company. This policy covers our mobile and web apps, our website (including quote share pages and calculators), and support.

The short version: your data is yours. We don't sell or rent it, we don't run ads or share it with third parties for their own advertising, we don't use your content to train AI models, and you can export or delete everything at any time.

2. What we collect

Account information. Your email, name, and sign-in credentials (held by our authentication provider); with Sign in with Apple or Google, the identifier and email they share.

Your business content. What you enter to run your business: recipes, ingredients and costs, menus, events, quotes, notes, branding, and payment-link URLs you choose to show.

Your own contact details, if you choose to publish them. Your booking page can show a phone number and an email address you enter. These are published: anyone on the internet who opens your page can see them, and search engines can index them. Nothing is published until you turn it on (we record when, and which wording you agreed to), and we never fill these in from an address we hold. Delete either one in Settings to unpublish it at once.

Your clients' contact and event details. Names, emails, phone numbers, postal addresses, and event details including the venue and its address, so you can quote, invoice, and deliver. You decide what goes in the free-text venue and notes fields and must have the right to share it. We use these details only to serve you (for example, emailing a quote, printing an invoice, or computing delivery distance) and never for our own marketing.

Delivery distance. To compute delivery distance, the address you cook from and each venue address go to our geocoding provider (OpenCage or Google Maps Platform). If a booking-page visitor taps "Use my location," their device's coordinates go to the same provider to find an approximate ZIP code; we do not store those coordinates.

Photos and text you submit for AI import. Menu photos or PDFs, receipt photos, pasted text, and photos you attach to records. They may contain personal information such as a name or an address; we do not inspect or redact images before parsing, so check what you submit.

Your logo, dish photos, and booking-page images are public: anyone with the link to your booking page or a quote can view them. Imports and private attachments are not.

Payment information. Stripe processes subscription payments on the web; Apple or Google process them in the iOS or Android app, with RevenueCat managing the subscription record. We receive only your subscription status — we never receive or store card numbers, card brands, or billing card details of any kind, from any of them. Payments clients make through your own payment links happen outside CaterKit, into your own accounts; we hold no record of them beyond what you enter. If you turn on CaterKit's in-product client payments, Stripe processes them under your own Stripe account and they settle directly to you. We receive the transaction records (amounts, status, and payment method type — never card numbers or card identifiers of any kind) to show what has been paid, reconcile your events, calculate the platform fee, and send receipts.

Usage, device, and website data. In the apps, PostHog records the screens and features you use, your device type, OS version, and approximate location (city and region, from your IP address), keyed to your account ID; Sentry records crash and error diagnostics and is configured not to send personal data. On our website, including quote share and booking pages, PostHog records page views, clicks, and errors using a first-party cookie and browser storage; Cloudflare Turnstile runs a bot-defense check on public forms; and Cloudflare Web Analytics counts page views and load speed without cookies, fingerprinting, cross-site tracking, or a profile of you, gives us no name, email address, or precise location, and is used only for those counts. On our marketing and content pages — and never on a quote share page, a booking or payment page, or a page you reach while signed in — we also record the browsing session (mouse movement, scrolling, and the page as displayed), with everything you type into a form masked, so we can see where the site confuses people. We do not use advertising cookies or cross-site tracking.

Your choice, if you're in the EU/EEA, United Kingdom or Switzerland. We ask before turning on usage analytics there; elsewhere it runs by default. Change your choice anytime with the "Analytics preferences" link in the footer.

Support communications. What you send us by email, contact form, or the in-app support form. The in-app form adds app version and build, platform, OS version, device model, language, time zone, and any photos you attach.

Device permissions we ask for.

• Contacts: "Add from contacts" copies only the contact you pick (name, email, phone) into your client record; we never read or upload your address book.
• Calendar: calendar sync keeps your booked events (with the client's name and venue) in a calendar the app creates on your device, and reads back only that calendar. Nothing from your calendar is sent to our servers, and other calendars are never read. Turn it off in Settings → Calendar; signing out or deleting your account removes the app's calendar.
• Camera and photos: used only when you choose to import a menu or receipt or attach a photo.
• Notifications: we store an install-specific push token to send reminders you turn on. It is removed when you sign out, delete your account, or the device stops being registered for notifications (for example, after you uninstall the app).

3. How we use it

• Provide, maintain, and improve the service (including sync and backups).
• AI menu and receipt import: a photo, PDF menu, or text you submit goes to Anthropic's API to become recipes, ingredients, or costs. We send only that content and a fixed instruction — never your name, business, or account identifiers. Results land in a review queue; nothing is created until you confirm. Under Anthropic's commercial API terms, inputs and outputs are not used to train Anthropic's models.
• Send transactional email (quote deliveries, team invites, receipts, security notices) via Resend.
• Send a short onboarding email series after signup (you can unsubscribe, and the app honors it too).
• Measure aggregate product usage, diagnose crashes, prevent fraud and abuse, and comply with law.

4. Quote share pages and links

When you send a quote, CaterKit creates a share page at an unguessable link. Anyone who has that link can view that quote (menu items, prices, and the business and event details you included). It stays live until the quote is removed, or email [email protected] and we will take it down.

5. If you're a client of a CaterKit operator

Your caterer uses CaterKit to manage your event and is responsible for their relationship with you. We process your details for them: contact information, event details and venue, quote and payment records, your typed signature with its time and device details, and any change requests or inquiries you send through their pages. When you pay, Stripe collects your card or bank details on its own pages under your caterer's Stripe account; we receive the amount, status, and payment-method type, never the card or account number, and we email you a receipt. To access, correct, or delete your information, contact your caterer, or email us and we'll help.

6. Where your data lives

Data is stored with Supabase (PostgreSQL and file storage) in the United States. Share pages and PDFs are served from our site infrastructure (Fly.io, US region).

7. How long we keep it

• While your account is active: we keep your content so the service works; export it anytime (Settings → Export, CSV/JSON), on any plan, even after you cancel a subscription.
• If you delete your account: you have a 7-day grace period to sign back in and restore it; then we delete your content within 30 days, except minimal records we must keep for legal, tax, or security reasons (such as invoices).
• Backups age out on a rolling schedule of no more than 30 additional days.

8. Service providers (subprocessors)

Each provider processes data only as needed to serve us and is bound by contract to protect it to a standard equal to this policy.

9. Your rights and choices

• Access & portability: export everything from Settings → Export.
• Correction: edit your content in the app.
• Deletion: delete your account in Settings, or email us and we'll do it.
• Marketing opt-out: every non-transactional email has an unsubscribe link.
• State privacy rights: depending on where you live (for example California, Colorado, Virginia, or Florida), you may have rights to access, delete, correct, or copy your personal information, and to non-discrimination for using them. We honor these requests for everyone. We do not "sell" or "share" personal information as those terms are defined in the CCPA/CPRA.
• If we wrote to you before you were a customer, the same request path applies without an account, and after you opt out we keep only a suppression entry for your address so we never contact you again.

To exercise any right, email [email protected]. We verify requests through your account email and respond within the time the law requires (generally 45 days).

10. Children

CaterKit is a business tool for adults. It is not directed at children under 13 (or under 18 for account creation), and we do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.

11. Security

Row-level security on every table, scoped to your organization; TLS in transit and encryption at rest; scoped credentials; no card data in our systems. No system is 100% secure; if we learn of a breach affecting your personal information, we will notify you as required by law.

12. Changes

We'll post changes here and update the date above, and tell you in the app or by email about material changes before they take effect.

13. Contact

ARDEO LABS LLC
[email protected]