CaterKit Privacy Policy

Effective date: 9 July 2026 · Last updated: 31 July 2026 · Ardeo Labs LLC

1. What this covers

CaterKit ("CaterKit," "we," "us") is operated by ARDEO LABS LLC, a Florida limited liability company. This policy explains what we collect, why, and what your rights are. It covers the CaterKit mobile and web apps, the CaterKit website (including quote share pages and calculators), and support channels.

The short version: your data is yours. We don't sell it, we don't run ads, we don't use your content to train AI models, and you can export or delete everything at any time.

2. What we collect

Account information. Email address, name, and authentication credentials (managed by our authentication provider; if you sign in with Apple or Google, we receive the identifier and email they share).

Your business content. What you enter to run your catering business: recipes, ingredients and costs, menus, events, quotes, notes, business branding, and payment-link URLs you choose to display.

Your clients' contact details. You may enter names, emails, and phone numbers of your clients so you can send them quotes. You are responsible for having the right to share that information with us; we use it only to provide the service to you (e.g., delivering a quote email you initiate) and never for our own marketing.

Photos and files you upload. Menu photos and documents you submit for AI import, and files you attach to your records.

Payment information. Subscription payments are processed by Stripe. We receive your subscription status only — we never receive or store card numbers, card brands, or billing card details of any kind (billing happens on Stripe's own pages). Payments your clients make to you through your own payment links happen entirely outside CaterKit: those funds settle to your own accounts with those providers, and we hold no record of them beyond what you enter yourself. Where CaterKit offers in-product collection of client payments and you enable it, those payments are processed by Stripe under your own Stripe account and settle directly to you; CaterKit receives transaction records for them (amounts, status, and payment method type — never card numbers or card identifiers of any kind) to show what has been paid, reconcile your events, calculate the platform fee, and send receipts.

Usage and device data. Product analytics events (screens used, features triggered), device type, OS version, and approximate region, collected via PostHog. Crash and error diagnostics collected via Sentry.

Support communications. Emails you send to our support address.

3. How we use it

• Provide, maintain, and improve the service (including sync and backups).
• AI menu import: photos or text you submit are sent to Anthropic's API to be parsed into structured recipes. Results always land in a review queue for your approval — nothing is created without your confirmation. Under Anthropic's commercial API terms, your inputs and outputs are not used to train their models.
• Send transactional email you initiate or that the service requires (quote deliveries, team invites, receipts, security notices) via Resend.
• Send a short onboarding email sequence after signup (you can unsubscribe; unsubscribing is honored in-product too).
• Measure aggregate product usage, diagnose crashes, prevent fraud and abuse, and comply with law.

We do not sell or rent personal information, and we do not share it with third parties for their own advertising.

4. Quote share pages and links

When you send a quote, CaterKit creates a share page at an unguessable link. Anyone who has that link can view that quote (menu items, prices, your business details, and event details you included). Treat share links like the quote document itself. Share links stay live until the quote is removed. If you need a share page taken down, email [email protected] and we will remove it.

5. Where your data lives

Data is stored with Supabase (PostgreSQL and file storage) in the United States, encrypted in transit (TLS) and at rest. Access in our systems is enforced by row-level security scoped to your organization. Share pages and PDFs are served from our site infrastructure (Fly.io, US region).

6. How long we keep it

• While your account is active: we keep your content so the service works; export is available anytime (Settings → Export, CSV/JSON), on any plan, including after you cancel a subscription.
• If you delete your account: we delete your content within 30 days, except minimal records we must keep for legal, tax, or security purposes (e.g., invoices).
• Backups age out on a rolling schedule of no more than 30 additional days.

7. Service providers (subprocessors)

Each provider processes data only as needed to provide its service to us, under its own contractual data-protection commitments.

8. Your rights and choices

• Access & portability: export everything from Settings → Export.
• Correction: edit your content in the app.
• Deletion: delete your account in Settings, or email us and we'll do it.
• Marketing opt-out: unsubscribe links in every non-transactional email.
• State privacy rights: depending on where you live (e.g., California, Colorado, Virginia, Florida), you may have statutory rights to access, delete, correct, or obtain a copy of your personal information, and to non-discrimination for exercising them. We honor these requests for everyone, resident or not. We do not "sell" or "share" personal information as those terms are defined in the CCPA/CPRA.

To exercise any right: [email protected]. We verify requests via your account email and respond within the time required by applicable law (generally 45 days).

9. Children

CaterKit is a business tool for adults. It is not directed at children under 13 (or under 18 for account creation), and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will delete it.

10. Security

Row-level security on every table, TLS everywhere, encryption at rest, scoped credentials, and no card data in our systems. No method of transmission or storage is 100% secure; if we learn of a breach affecting your personal information, we will notify you as required by law.

11. Changes

We'll post changes here and update the date above. For material changes, we'll notify you in the app or by email before they take effect.

12. Contact

ARDEO LABS LLC
[email protected]