Privacy Policy

Last updated: March 6, 2026

1. Introduction

DoughOps ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our production intelligence platform for donut shops (the "Service").

Please read this Privacy Policy carefully. By using the Service, you consent to the practices described in this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when using our Service:

Account Information: Name, email address, phone number, company name, business address
Billing Information: Payment method details (processed securely by Stripe)
Business Data: Product information, recipes, ingredients, pricing, production quantities, sales records, waste logs
Team Information: Names and email addresses of team members you invite
Communications: Messages you send us via email or support channels
Profile Information: Profile photos, preferences, settings
B2B Contact Data: Business names, contact names, email addresses, phone numbers, and addresses of wholesale prospects and accounts you manage through the CRM
Equipment Data: Asset details, maintenance records, nameplate photos, and service history

2.2 Information Collected Automatically

When you use our Service, we automatically collect:

Device Information: Device type, operating system, browser type, screen resolution
Usage Data: Pages visited, features used, time spent, click patterns
Log Data: IP address, access times, referring URLs, error logs
Location Data: General geographic location based on IP address (for weather features)
Mobile Device Tokens: Push notification tokens when you enable notifications in the mobile app
Cookies: Session identifiers and preferences (see our Cookie Policy)

2.3 Photo and Image Data

When using photo-based features, images are uploaded to secure AWS S3 storage:

Waste Capture Images: When using the photo-based waste capture feature (Pro plan), photographs of your display case are uploaded for AI analysis. These images are retained for 90 days and then automatically deleted. Images are processed by OpenAI's API to identify and count items.
Equipment Nameplate Photos: When using the nameplate OCR feature, photos of equipment nameplates are uploaded and processed by OpenAI's API to extract equipment information. These images are retained for the duration of the asset record.
Crew Member Avatar Photos: If you upload photos of crew members, these are stored in S3 and retained for the duration of the crew member's active status in your account. These images are resized to 400x400 pixels upon upload.
Product and Equipment Images: General product photos and equipment images you upload are retained for the duration of the associated record.

2.4 Crew Member Data

If you use our crew management features (Pro plan), you may store information about non-login employees including:

Full names and contact information
Skill tags and station assignments
Assigned locations and shift data
Optionally, profile photos

Crew member data is stored within your tenant's isolated data environment. This data is not shared with third parties. You are responsible for ensuring you have appropriate consent from crew members to store their information in the Service, in accordance with applicable employment and privacy laws in your jurisdiction.

2.5 AI and Machine Learning Processing

Certain features use third-party AI services to process images, text, and audio. When you use these features, the relevant data is transmitted to the applicable AI provider:

Photo Waste Capture: Display case photographs are sent to OpenAI's API (GPT-4o) for product identification and counting.
Equipment Nameplate OCR: Nameplate photographs are sent to OpenAI's API for text extraction and equipment data recognition.
Nutrition Data Fallback: When USDA database lookups do not return a match, ingredient names may be sent to OpenAI's API for nutrition estimation.
Voice Transcription: When using voice input features (Pro plan), audio recordings are sent to AWS Transcribe for speech-to-text conversion. Audio data is processed in real-time and is not stored by AWS after transcription is complete.

OpenAI's data usage and privacy policies apply to data processed through their API. You can review OpenAI's policies at openai.com/policies/privacy-policy. DoughOps does not use your data to train AI models, and our API usage with OpenAI is subject to OpenAI's API data usage policies, which do not use API inputs to train their models by default.

2.6 B2B Wholesale Portal Data

If you use the wholesale portal feature (Pro plan), your business customers ("Portal Users") may access a self-service portal to view pricing, place orders, and manage account details. We collect and process:

Portal User contact information: Business name, contact name, email address, phone number, and delivery address as provided by you (the account owner)
Authentication data: Magic link tokens and session data (automatically expired and cleaned up)
Order data: Orders placed through the portal, including products, quantities, and delivery details

Portal Users do not create passwords or traditional accounts. Authentication is via single-use magic links sent to their email. You are responsible for ensuring your Portal Users are aware of how their data is handled and for obtaining any necessary consent.

2.7 Information from Third Parties

We may receive information from third-party services you connect:

Square POS: Product catalog, sales transactions, employee/crew data, location data (when you authorize the integration)
Clover POS: Product catalog, sales transactions, employee data, location data (when you authorize the integration)
Weather Services: Forecast data based on your location
Event APIs: Local event information for your area
OpenStreetMap: Business information from public map data (when using prospect discovery features)
Google Places: Address and location data (when using address autocomplete)

3. How We Use Your Information

We use your information for the following purposes:

3.1 Providing the Service

Creating and managing your account
Processing payments and managing subscriptions
Generating production predictions and recommendations
Providing sales analytics and reporting
Enabling team collaboration features
Powering AI-driven features — including our demand prediction engine, baseline optimization, and analytics algorithms — using your business data for your account only

3.2 Improving the Service

Analyzing usage patterns to improve features
Improving our prediction algorithms using aggregated, anonymized data
Conducting research and analytics
Testing new features and functionality

AI Model Training: We do not use your business data, images, or customer information to train third-party AI models. Data sent to OpenAI's API is governed by OpenAI's API data usage policies, which do not use API inputs to train their models by default.

No Cross-Customer Data Sharing: Your business data — including sales figures, product catalog, recipes, waste records, and any other business-specific information — is used exclusively to power the Service for your account. We will never share, sell, rent, or disclose your business data to other DoughOps customers, competitors, data brokers, or advertisers. The only exceptions are: (a) aggregated, anonymized data as described in Section 4.5, which cannot identify you or your business; (b) disclosures required by law; and (c) third-party service providers who process data on our behalf under strict confidentiality obligations (as described in Section 4.1).

3.3 Communication

Sending daily production plan emails
Sending push notifications to your mobile device (if you have enabled them in the mobile app)
Providing customer support
Sending service updates and announcements
Marketing communications (with your consent)

3.4 Legal and Security

Complying with legal obligations
Protecting against fraud and abuse
Enforcing our Terms of Service
Maintaining security of the Service

We do not sell, rent, or share your personal information or business data with other customers, competitors, data brokers, or advertisers. We may share your information only in these limited circumstances:

4.1 Service Providers

We share information with trusted third-party service providers who assist us in operating the Service:

Stripe: Payment processing
Amazon Web Services (AWS): Cloud hosting and infrastructure
AWS SES: Email delivery
Analytics providers: Usage analytics (anonymized)
Open-Meteo: Weather forecast data
Google Analytics / Facebook Pixel: Website analytics and marketing attribution
Cloudflare: Website hosting and security for our marketing site

These providers are contractually bound to protect your data and use it only for the services they provide to us.

4.2 POS Integrations

When you connect a POS system (Square or Clover), we access your POS data according to the provider's API terms. We do not share your DoughOps data with POS providers beyond what's necessary for the integration. Data synced from your POS (products, sales, employee/crew information) is stored within your tenant's isolated data environment.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to:

Comply with legal obligations
Protect our rights or property
Prevent fraud or security issues
Protect the safety of users or the public

4.4 Business Transfers

If DoughOps is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.

4.5 Aggregated Data

We may share aggregated, anonymized data that cannot identify you for research, marketing, or other purposes.

4.6 Email Tracking

Emails sent through the Service (such as production plan notifications, task reminders, and B2B communications) may include tracking technologies to measure delivery, open rates, and link clicks. This data helps us improve our email communications and is processed in accordance with this policy. You can opt out of marketing emails at any time using the unsubscribe link provided in each email.

5. Data Retention

We retain your information as follows:

5.1 While Your Account Is Active

Core data (products, recipes, team members, settings): Retained indefinitely while active
Completed task records: Retained indefinitely as work records
Production plans, sales, waste records: 5 years (used for AI predictions and reporting)
Pending/unfinished tasks, summaries, escalations: 3 years
Audit and activity logs: 90 days
Session security events: 90 days
Waste capture images: 90 days, then automatically deleted from storage
Weather cache and past events: 30 days
Authentication tokens: 30 days after expiry
B2B portal sessions and magic links: Automatically cleaned up upon expiry

5.2 After Account Cancellation

You have 30 days to export your data after cancellation
Core account data (Tenant, User records) is deleted after the 30-day export window
Backup systems may retain data for up to 90 additional days before automatic purging
Aggregated, anonymized data may be retained indefinitely
Some data may be retained longer if legally required

You may request deletion of your data at any time (see Your Rights section). Data deletion is performed automatically by our scheduled cleanup processes and can be expedited upon request by contacting privacy@doughops.com.

6. Data Security

We implement industry-standard security measures to protect your data:

Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
Access Controls: Strict role-based access to production systems
Infrastructure: Hosted on AWS (AWS maintains SOC 2 and ISO 27001 certifications)
Password Security: Passwords are hashed using bcrypt with 12 rounds
Monitoring: Continuous security monitoring and logging
Backups: Regular encrypted backups with tested recovery procedures

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

You have the following rights regarding your data:

7.1 Access

You can access most of your data through your account settings. You may also request a copy of all data we hold about you.

7.2 Correction

You can update your account information at any time. Contact us if you need assistance correcting other data.

7.3 Deletion

You can request deletion of your account and data. We will delete your data within 30 days, except where retention is legally required.

7.4 Export

You can export your data in common formats (CSV, JSON) through the Service's export features.

7.5 Objection

You can object to certain processing of your data, including marketing communications.

7.6 Restriction

You can request that we restrict processing of your data in certain circumstances.

To exercise any of these rights, contact us at privacy@doughops.com.

8. Cookies and Tracking

We use cookies and similar technologies to:

Keep you signed in
Remember your preferences
Understand how you use the Service
Improve our Service

For detailed information about the cookies we use, please see our Cookie Policy.

9. Third-Party Services

Our Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those services. We encourage you to review their privacy policies.

Key Third-Party Services:

Stripe: stripe.com/privacy
Square: squareup.com/legal/privacy
Clover: clover.com/privacy-policy
Amazon Web Services: aws.amazon.com/privacy (hosting, email, and voice transcription)
OpenAI: openai.com/policies/privacy-policy (photo waste capture, nameplate OCR, and nutrition AI fallback)
Google: policies.google.com/privacy (Places API for address autocomplete, Analytics)

10. International Data Transfers

Your data may be transferred to and processed in the United States, where our servers are located. If you are located outside the United States, please be aware that data protection laws may differ from your jurisdiction.

For users in the European Economic Area (EEA), we rely on:

Standard Contractual Clauses (SCCs) approved by the European Commission
AWS's compliance with the EU-US Data Privacy Framework

11. Children's Privacy

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

12.1 Right to Know

You can request information about the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it.

12.2 Right to Delete

You can request deletion of your personal information, subject to certain exceptions.

12.3 Right to Opt-Out

We do not sell personal information. If this changes, we will provide an opt-out mechanism.

12.4 Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

12.5 Categories of Personal Information

In the past 12 months, we have collected: identifiers, commercial information, internet activity, geolocation data, and professional information.

To exercise your CCPA rights, contact us at privacy@doughops.com.

13. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

13.1 Legal Basis

We process your data based on:

Contract: Processing necessary to provide the Service you requested
Legitimate Interests: Processing for our legitimate business interests (improving the Service, preventing fraud)
Consent: Processing based on your explicit consent (marketing communications)
Legal Obligation: Processing required by law

13.2 Additional Rights

In addition to the rights listed in Section 7, you have the right to:

Lodge a complaint with your local data protection authority
Data portability (receive your data in a structured, machine-readable format)
Withdraw consent at any time (without affecting prior processing)

13.3 Data Protection Officer

For GDPR-related inquiries, contact our Data Protection Officer at dpo@doughops.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

Posting the updated policy on this page
Updating the "Last updated" date
Sending an email notification for material changes

We encourage you to review this policy periodically.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: privacy@doughops.com
Support: support@doughops.com
Data Protection Officer: dpo@doughops.com
Website: https://doughops.com

This Privacy Policy is effective as of March 6, 2026.