Privacy policy

Who we are

Cortado Services, a California corporation, makes software for independent coffee shops, run from cortado.services. For anything in this policy, write to sen@cortado.services.

There are two kinds of information here, and the law treats them differently. For your account and how you use our website, we decide what happens to it, so we are responsible for it (a "business" or "controller"). For the business records you put into the app, your stock, suppliers and staff, you decide, and we handle it only to run the service for you (a "service provider" or "processor"). How we do that is set out in our data processing addendum, which is part of the terms automatically.

What we collect

What you give us

• Your account. Business name, your name, email address, and a password we keep only as a salted hash. We cannot read it, and neither could anyone who copied the database.
• Your shops. Name, address, time zone, phone number, opening hours, and the staff PIN, also kept only as a hash.
• Your business records. Items, stock counts, deliveries and prices paid, waste, recipes and menu prices, sales, suppliers, orders, temperature readings and checklists.
• Your staff. The name you enter for each person, their role, whether they are active, and what you choose to add for scheduling: hourly rate, employment type, most hours a week, an age band if they are under 18 (so the schedule respects the hours minors may work; never a birth date), start date, notes, availability, whether they serve customers (for the tip pool), and their shifts. If you use the time clock: when they clock in and out and take breaks, exactly as punched, any correction with who made it and why, and their share of the tip pool. Every count, sale, waste entry, reading and checklist is stored with the name of whoever did it, because that is what makes it a record an inspector will accept.
• Your suppliers. Company name, and a contact name, email and phone where you enter them.
• Messages to us. Demo requests, support messages and replies: your name, email, phone if you give it, and what you wrote. A support message also records the page you were on and your browser, which is usually the whole diagnosis.
• Your subscription, if you take one. Your plan, whether it is in a trial, active or lapsed, when a trial ends, and the two reference numbers Stripe uses for you and your subscription.

What the software records as it runs

• Errors. What broke, where, and enough context to fix it. You can see your own under Settings, then Diagnostics.
• AI usage. Which AI feature ran, when, and how much it cost. Not what was in it.
• Staff phones. When a phone enters the shop PIN, a random token is kept on it so it does not have to enter it again. It identifies the phone, not the person.
• IP addresses, briefly, to stop abuse of sign-in, password reset, the PIN and our public forms. They are not attached to your account.
• Page views on our public website, counted by Vercel Analytics without cookies and without building a profile of anyone.

What we deliberately do not collect

• Card numbers. Payment happens entirely on Stripe's own pages. A card number never reaches our servers, our database or our logs. When the app shows "Visa ending 4242", it is asking Stripe at that moment, and we do not keep even that.
• Your customers. Cortado records what you sold, never who you sold it to. If your POS holds customer names or emails, we do not read them and they never reach us.
• Staff contact details, home addresses, Social Security numbers, bank details or work authorization documents. The app has nowhere to put them, deliberately. Please don't type them into a notes field.
• Tracking across other websites. No advertising pixels, no third-party analytics scripts, no cross-site cookies.

Why we use it

• To run the service you signed up for: showing your stock, building your order, costing your menu, suggesting a schedule.
• To send the emails you asked for, like the morning summary, a password reset or a delivery reminder.
• To keep it secure, stop abuse, and fix what breaks.
• To bill you, if you subscribe.
• To decide what to build next, using counts across all accounts (how many shops are active, which features get used). Nothing in that identifies your business, and we never publish anything about your shop without asking you.
• To meet legal obligations, like keeping billing records.

That is the whole list. We do not use your data for advertising, and we do not sell or rent it to anyone.

Who else sees it

Ten companies help us run Cortado. Five are always involved; the rest only when you use the feature they power. The full list, with where each one is, lives on the subprocessors page, and we email you at least 14 days before adding one.

Beyond them, we share information only if the law requires it. If we receive such a request we will tell you first, unless we are legally forbidden to. If Cortado is ever sold or merged, your data would move with it, under this policy, and we would tell you before it did.

The AI features

Reading an invoice photo, importing a menu from your website or a file, researching suppliers near you, suggesting what to reorder, the help assistant, and the weekly look at events near your shop all send information to Anthropic in order to work.

• Only what that job needs. Reading an invoice sends that invoice. The help assistant sends your question and a short summary of your shop's setup, what is running low and any recent errors, so it can answer about your shop rather than in general. The events research sends your shop's address and opening hours, and runs weekly for shops that have an address on file.
• Nobody trains on it. We use Anthropic's commercial API, under which what we send and what comes back is not used to train models. Anthropic may keep requests for a limited time to run its service and prevent abuse, under its own commercial terms.
• Uploads are not kept, with one exception. A photo of an invoice or a menu is read once, in memory, and never saved by us. What we keep is what you confirm on the review screen. Files you send through Send us anything are kept privately so we can set them up for you, and deleted 90 days after they're dealt with.
• You check before anything is saved. Every AI result goes to a review screen first. None of them change your records on their own.

The question box on our public website also sends what you type to Anthropic to answer it. Don't put anything private in it; it has no account behind it and we do not keep the conversation.

Google Calendar

If you connect Google Calendar, Cortado asks Google for permission to make one calendar of its own in your account, called “Cortado shifts”, and to manage the events on it. It also sees that account's email address, so you know which one is connected. Cortado can't see or change any of your other calendars or the events on them. It uses this access only to put your shifts on its calendar, keep them up to date, and notice when you move or delete a shift there, which it then copies back to your schedule. It stores the connection and which event belongs to which shift, nothing else from your Google account. It does not share anything it gets from Google with anyone else, and does not use it for advertising or to train AI.

Cortado's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time from the schedule, or from your Google account's security settings. Disconnecting from the schedule deletes the Cortado shifts calendar and removes Cortado's access to your Google account; your schedule stays in Cortado.

Cookies and your browser

We set four cookies, all needed for the app to work, and none for advertising or tracking. The app also keeps a few conveniences in your browser, like your light or dark setting; those are listed on the cookies and storage page.

Where it lives, and how it is protected

In the United States. Data is encrypted in transit and at rest, and access tokens for Google, Square and Clover are encrypted again by us before they are stored. One cafe's data is kept apart from another's by checks in every query, and an automated test on every change fails the build if a query is missing one. The details are on the security page.

How long we keep it

• Your business records: for as long as you have an account, unless you delete them sooner. We do not expire your history, because last year's counts are how this year's figures are worked out.
• Time clock and tip records: for as long as the account exists. Employers generally have to keep them for at least three years, so export them before closing an account; the app reminds you.
• Billing records: Stripe keeps invoices and payment records for as long as tax law requires.
• Support messages and demo requests: two years, so we have the history if you write again, then deleted automatically. Ask and we will delete yours sooner.
• Error records: one year, then deleted automatically.
• IP addresses used for rate limiting: minutes to hours.
• After you close your account: everything is deleted from the live database immediately. Encrypted backups that contain it are deleted as they age out, within 30 days. After that there is no copy anywhere, and nothing we could restore.

Your choices and rights

• Take it all. Settings, then Organization, then Download my data gives you every record we hold about your business, as one file, whenever you like.
• Delete it all. Same page. It asks for your password, the shop's name typed out and a code we email you, because it cannot be undone.
• Correct it. Everything in the app is editable by you.
• Stop the emails. Preferences lets you change the summary email to Mondays only or turn it off. Account emails, like password resets and billing notices, still come.
• Ask us. For anything else, including a question about what we hold on you personally, email sen@cortado.services. We reply within 30 days, and usually within a day or two.

If you live in California

The California Consumer Privacy Act, as amended by the CPRA, gives California residents specific rights. In the last twelve months we have collected these categories of personal information, from you directly or from the shop you work at, for the purposes listed under "Why we use it":

• Identifiers: name, email address, IP address, account and device identifiers.
• Customer records: phone number and business address.
• Commercial information: your plan and subscription history.
• Internet activity: how the app is used, errors, and page views on our public site.
• Employment information, entered by the shop that employs you: role, pay rate, hours, availability, shifts, start date, an age band if you are under 18, time clock punches and breaks, and your share of tips.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have not done so in the last twelve months. We do not collect sensitive personal information for the purpose of inferring anything about you. Retention for each category is set out above.

You have the right to know what we collect and how we use it, to get a copy, to have it corrected, and to have it deleted, subject to legal exceptions; and not to be treated differently for using any of these rights. To use them, email sen@cortado.services. We will confirm the request came from you, usually by replying to the email address on the account, before acting on it. You may use an authorized agent, and we may ask them for proof that you authorized them.

If you work at a shop that uses Cortado, that shop decides what is recorded about you and we act on its instructions. Ask your employer first; if you write to us, we will pass your request to them and help them answer it.

Other US states, and outside the US

Residents of other states with privacy laws, including Colorado, Connecticut, Virginia, Oregon and Texas, can use the same rights in the same way, and if we turn a request down you can ask us to reconsider by replying to our answer. Cortado is built for US businesses and all of its data is held in the United States. If you use it from elsewhere, tell us before you put staff data in, so we can talk about what your law requires.

Your staff, and your part

When you add staff and schedule their shifts, you are putting someone else's information into our software. They are your employees, not our users, and they have not agreed to anything with us.

So you are responsible for telling them what is recorded, and for having a good reason to record it, which for ordinary scheduling and payroll records you almost certainly already have. To make that easy, there is a ready-made notice for your staff you can print or send.

If something goes wrong

If we discover a breach affecting your data, we will tell you by email what happened, what was affected and what we are doing about it, within 72 hours of finding out, without waiting to be asked.

Children

Cortado is a tool for businesses and is not for anyone under 16 to use. A shop may record that a member of its staff is under 18 so the schedule follows the rules on their hours; that information belongs to the shop and is handled under the data processing addendum.

Changes

If we change this policy in a way that affects you, we will email you before it takes effect, rather than quietly changing the date at the top.