Privacy Policy

1. Introduction

Welcome to 86. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our inventory management platform and related services.

86 is operated by 86 Software LLC, doing business as "86," based in Puerto Rico. By using our service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

We collect information you directly provide to us, including:

• Account Information: Name, email address, phone number, organization name, and password
• Business Information: Restaurant/business details, address, cuisine type, timezone preferences
• Inventory Data: Product names, quantities, categories, vendor information, pricing, and related inventory management data
• Payment Information: Billing address and payment method details (processed securely by our payment processor)
• Communications: Messages, feedback, and support requests you send to us
• User-Generated Content: Photos of inventory items, notes, spreadsheets, and other files you upload
• Financial Data (via Plaid): When you choose to connect your bank account, we collect transaction history, account balances, and account metadata (institution name, account type, last four digits) through our integration with Plaid Inc. We do not collect your bank login credentials — Plaid handles authentication directly. See Section 4 for details.
• Invoice Data: Photos or PDFs of invoices you upload for AI-powered cost extraction and inventory price updates

2.2 Automatically Collected Information

When you use our service, we automatically collect:

• Usage Data: Features used, actions taken, time spent, and interaction patterns
• Device Information: Device type, operating system, browser type, and IP address
• Log Data: Access times, pages viewed, and technical errors
• Analytics Data: Usage patterns, page views, clicks, and performance metrics collected via PostHog in our web application (see Section 4)
• Session Replays: Recordings of how you interact with our web application, collected for product improvement and error diagnosis. We configure replays to mask typed input and on-screen text, so recordings are designed to capture layout and interactions rather than your business content (see Section 4)
• Mobile Device Information: For users of our iOS and Android apps:
  • Device model and manufacturer
  • Mobile operating system and version
  • App version and build number
  • Push notification tokens (for sending notifications)
  • Device language and locale settings

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our inventory management services
• Process your subscription payments and manage your account
• Send you operational notifications (inventory reminders, count completion alerts)
• Respond to your support requests and communicate with you
• Analyze usage patterns to improve product features and user experience
• Detect, prevent, and address technical issues, fraud, and security threats
• Comply with legal obligations and enforce our Terms of Service
• Send you important service updates and policy changes
• Measure the effectiveness of our own advertising (see Section 4.2 for details on advertising measurement)

We do not send marketing emails, newsletters, or promotional SMS messages. All emails and text messages we send are transactional and operational. We do use limited advertising measurement tools (described in Section 4.2) to understand whether our own ads on Meta and Google platforms lead to signups — we never sell your personal information, and we never share your inventory, financial, or business data with advertising platforms.

4. Third-Party Services

We use trusted third-party service providers to help us operate our business. These providers have access to your information only to perform specific tasks on our behalf and are obligated to protect your data.

4.1 Service Providers We Use

4.2 Advertising and Conversion Measurement (Meta & Google)

We advertise 86 on Meta platforms (Facebook, Instagram) and Google. To measure whether those ads work, we use conversion measurement tools that share limited information with Meta and Google:

• Meta Pixel and Conversions API: When you visit our website or sign up, we send Meta conversion events (such as "completed registration" or "started subscription") that may include your email address and phone number in hashed form (a one-way transformation — Meta cannot read the original values, only match them against its own hashes), your IP address, your browser's user-agent string, Meta-generated browser cookies (_fbp, _fbc) when present, and — for subscription purchases — the purchase value and currency. Browser and server events carry shared event IDs so Meta can deduplicate them. Meta uses this to match conversions to ads it showed you.
• Google tag (Google Ads / Google Analytics): Measures visits and signup/subscription conversions attributable to our Google ads. For subscription purchases we use Google's "enhanced conversions," which send your email address and name (processed by Google in hashed form) along with the purchase value and currency, so Google can match the conversion to the ad click.

These tags load on our marketing website and, within the web application, only while you are signed out (the sign-in and sign-up pages) or before your subscription is active (the checkout phase) — once your subscription is active they are no longer loaded (starting with your next page load), so day-to-day use of the app (inventory, banking, invoices, reports) and subscription renewals send nothing to ad platforms from your browser. They also do not load on our legal pages (this page, Terms, and account deletion) or anywhere in our mobile apps. What we never share with advertising platforms: your inventory data, financial and banking data, invoices, sales data, or any business records.

Under some U.S. state privacy laws, this kind of disclosure to advertising platforms is considered "sharing" of personal information, and you have the right to opt out. We honor the Global Privacy Control browser signal automatically for browser-based advertising tags, and you can opt your account out of all advertising events (including server-side events) by email. See "Do Not Sell or Share My Personal Information" in Section 11.

5. Mobile Applications

5.1 iOS and Android Apps

86 is available as a mobile application for iOS (iPhone and iPad) and Android devices. Our mobile apps provide the same inventory management functionality as our web application, optimized for mobile use with additional features like camera access for photo capture.

5.2 App Stores

Our mobile apps are distributed through:

• Apple App Store: For iOS devices (iPhone, iPad)
• Google Play Store: For Android devices

When you download our app from these stores, you are also subject to Apple's or Google's respective privacy policies and terms of service.

5.3 Device Permissions

Our mobile apps request the following device permissions:

5.4 Permission Management

You can change permission settings at any time through your device's system settings:

• iOS: Settings → 86 → Permissions
• Android: Settings → Apps → 86 → Permissions

5.5 Updates and Features

We may release updates to our mobile apps to add features, fix bugs, and improve performance. Updates are distributed through the respective app stores and may include new permission requests if new functionality requires them. We will always request permission before accessing new device features and explain why the permission is needed.

6. Push Notifications

6.1 How Push Notifications Work

Our mobile apps use push notifications to deliver timely operational alerts directly to your device. Push notifications are entirely controlled by your organization's administrators and managed by Expo's push notification service. We do not send marketing messages or unsolicited notifications.

6.2 Types of Push Notifications

You may receive the following types of operational push notifications:

• Inventory Count Reminders: Scheduled by your organization's admin to remind employees to count inventory
• Count Completion Notifications: Sent to managers when an inventory count is completed
• Missed Count Alerts: Sent to managers when a scheduled count was not completed

6.3 Push Notification Service Provider

6.4 Consent and Control

• Who Manages Notifications: Push notifications are initiated by your organization's administrator, not by 86 directly. 86 is a B2B platform where employers manage operational notifications for their teams.
• For Organization Admins: By enabling push notifications in your organization settings, you represent that you have obtained appropriate consent from the recipients (employees/team members) to receive operational work-related notifications from 86 on behalf of your organization. Admins have contractual authority as employers to manage work-related operational notifications.
• For All Recipients: You can opt-out of push notifications at any time by:
  • Disabling notifications in the 86 app settings
  • Turning off notifications for 86 in your device's system settings
  • Contacting your organization's administrator to adjust notification preferences
  • Emailing [email protected] to request removal from notifications
• Automatic Fallback: If push notifications fail or are disabled, the system automatically falls back to SMS notifications (if configured)
• Message Frequency: Varies based on your organization's schedules (typically daily or weekly)
• No Charges: Push notifications are free and do not consume SMS credits or incur charges

6.5 Push Token Management

When you enable push notifications, the mobile app receives a unique push token from your device's operating system. This token is stored securely and used only to deliver notifications. We automatically:

• Register your push token when you enable notifications
• Update your token if it changes (e.g., after app reinstall)
• Remove invalid tokens that fail to deliver
• Delete your token when you disable notifications or uninstall the app

6.6 Privacy and Security

Push notifications are transmitted securely through Expo's infrastructure, which uses Apple's and Google's secure push notification services. Your push token and notification content are:

• Encrypted in transit using industry-standard TLS/SSL
• Used solely for delivering operational notifications
• Not sold or shared with third parties for marketing purposes
• Automatically invalidated when you uninstall the app

7. SMS Notifications

7.1 How SMS Works in 86

86 provides SMS notification features that are entirely controlled by your organization's administrators. We do not send marketing messages or unsolicited texts. SMS is used as a fallback when push notifications fail or are unavailable.

7.2 Types of SMS Messages

You may receive the following types of operational SMS messages:

• Inventory Count Reminders: Scheduled by your organization's admin to remind employees to count inventory
• Count Completion Notifications: Sent to managers when an inventory count is completed
• Missed Count Alerts: Sent to managers when a scheduled count was not completed

7.3 Consent and Control

• Who Manages SMS: SMS messages are initiated by your organization's administrator, not by 86 directly. 86 is a B2B platform where employers manage operational notifications for their teams.
• For Organization Admins: By providing phone numbers and enabling SMS notifications in your organization settings, you represent that you have obtained appropriate consent from the recipients (employees/team members) to receive operational work-related SMS messages from 86 on behalf of your organization. Admins have contractual authority as employers to manage work-related operational notifications.
• For All Recipients: Any recipient can opt-out at any time by texting "STOP" to any message. Organization admins are responsible for ensuring recipients are aware of and consent to receiving operational notifications as part of their employment or business relationship.
• Additional Opt-Out Methods: Recipients can also:
  • Contact your organization's administrator to remove your phone number
  • Request removal by emailing [email protected]
• Message Frequency: Varies based on your organization's schedules (typically daily or weekly)
• Charges: Message and data rates may apply based on your mobile carrier's plan

7.4 SMS Privacy and Security

We use Twilio as our SMS service provider. Your phone number and message content are transmitted securely and are used solely for delivering the requested operational notifications. We do not sell or share your phone number with third parties for marketing purposes.

7.5 Compliance

Our SMS notifications comply with the Telephone Consumer Protection Act (TCPA) and CTIA guidelines. For Canadian recipients, we follow Canada's Anti-Spam Legislation (CASL): all messages are transactional/operational in nature, sent with appropriate consent, and include the ability to opt out at any time.

8. Email Communications

8.1 Types of Emails We Send

We send only transactional and operational emails, including:

• Account Emails: Welcome messages, password resets, account verification
• Data Import Status: Updates on your uploaded inventory data import requests
• Subscription Emails: Payment confirmations, subscription changes, billing notifications
• Service Updates: Critical service announcements, security alerts, policy changes
• Support Communications: Responses to your support requests

8.2 No Marketing Emails

We do not send marketing emails, newsletters, or promotional content. All emails are necessary for the operation of your account and the service.

8.3 Email Service Provider

We use Resend to send emails. Resend is GDPR compliant and does not sell or share your email address with third parties. All emails are sent from [email protected] with a reply-to address of [email protected].

8.4 CAN-SPAM Compliance

While we don't send marketing emails, all our communications comply with the CAN-SPAM Act and include:

• Accurate sender information and subject lines
• Our physical business address
• Clear identification of the message type

9. Data Storage and Security

9.1 Where Your Data is Stored

Your data is stored on secure servers provided by Convex, which are hosted on Amazon Web Services (AWS) infrastructure in the United States. Convex maintains SOC 2 Type II compliance and follows industry-standard security practices. Our web applications are served by Vercel, whose infrastructure processes standard web-server logs (such as IP addresses) to deliver the pages.

9.2 Security Measures

We implement multiple layers of security to protect your data:

• Encryption at Rest: All data is encrypted using 256-bit AES encryption
• Encryption in Transit: All data transmission uses TLS/SSL encryption
• Access Controls: Role-based access controls ensure users only see their organization's data
• Authentication: Secure authentication provided by Clerk with industry-standard protocols
• Organization Isolation: Every query is scoped to your organization, so users can only access their own organization's data
• Monitoring: Continuous monitoring for security threats and anomalies via Sentry
• Regular Updates: We keep our systems updated with the latest security patches

9.3 Payment Security

Payment information is handled directly by Stripe (via Clerk Billing) and never stored on our servers. Stripe is PCI-DSS Level 1 compliant, the highest level of payment security certification.

9.4 Security Incidents

If a security incident affects your personal information, we will notify you and the relevant authorities as required by applicable law, and will tell you what happened, what data was involved, and what we are doing about it.

9.5 No Guarantee

While we implement strong security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we continuously work to protect your information using industry best practices.

10. Data Retention

10.1 Active Accounts

We retain your data for as long as your account is active and for a reasonable period afterward to comply with legal obligations and resolve disputes. In general, we determine retention periods based on: how long the data is needed to provide the Service, legal and tax record-keeping requirements for billing and financial records, and whether the data is still needed to resolve disputes or enforce agreements. Diagnostic data is kept on shorter cycles — session replays and error reports are retained by our providers for a limited period before automatic deletion.

10.2 Cancelled Subscriptions

If you cancel your subscription but do not delete your account, we retain your inventory data and account information so you can reactivate your subscription without data loss. This data remains subject to the same security and privacy protections.

10.3 Account Deletion

You can delete your user account in the mobile app (Settings → Delete Account) or by emailing [email protected] with "Account Deletion Request" — email requests are processed within 7 business days. When your account is deleted, we permanently remove your login credentials, email address, phone number, push notification tokens, profile photo, and personal notification history — the account can no longer sign in and can no longer be contacted.

What remains: your name stays attached to your organization's business records — for example, which team member performed an inventory count or scanned an invoice. Those records belong to the organization, and keeping the name preserves the accuracy of its operating history. We never use the retained name to contact you or for advertising, and it is kept only as long as the organization retains its business records. An organization administrator can request deletion of the organization and all of its data, which removes these records entirely. We may also retain certain information if required by law or for legitimate business purposes such as:

• Preventing fraud and abuse
• Resolving disputes or legal claims
• Complying with legal or regulatory requirements
• Enforcing our Terms of Service

10.4 Backup Retention

Deleted data may persist in backup systems for up to 90 days before being permanently removed.

11. Your Rights and Choices

11.1 Access and Update Your Information

You can access and update your account information at any time through your account settings in the 86 application. This includes your name, email, phone number, organization details, and notification preferences.

11.2 Delete Your Account

You can delete your account at any time in the mobile app (Settings → Delete Account) or by emailing [email protected]. Account deletion permanently removes your personal data as described in Section 10.3.

11.3 California Residents (CCPA/CPRA Rights)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request what personal information we collect, use, disclose, sell, or share
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing: We do not sell personal information for money. We do "share" limited personal information with advertising platforms for conversion measurement as described in Section 4.2, and you may opt out of that sharing at any time (see below)
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

Sensitive personal information: Financial data synced through Plaid may qualify as "sensitive personal information" under the CPRA. We use it only to provide the Service you requested (expense tracking, reconciliation, and reporting inside your own account) — never for advertising, profiling, or any secondary purpose — so no separate "Right to Limit" action is needed.

To exercise any of these rights, email us at [email protected] with "CCPA Request" in the subject line. You may also use an authorized agent to submit a request on your behalf; we will ask the agent for proof of authorization and may need to verify your identity directly. We verify requests by matching the information you provide against the account details we hold (such as your account email or phone number).

Other U.S. State Privacy Rights

Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Texas, Oregon, and Montana) have similar rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising. We extend the rights and opt-out mechanisms described in this section to all U.S. users regardless of state. To exercise them, use the same contact methods above; if we decline a request, you may appeal by replying to our response, and we will review the appeal within the timeframe your state's law requires.

11.4 European Residents (GDPR Rights)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

• Right of Access: Obtain confirmation of whether we process your data and access to it
• Right to Rectification: Correct inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Request restriction of processing under certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, email us at [email protected] with "GDPR Request" in the subject line.

11.5 Canadian Residents (PIPEDA Rights)

If you are located in Canada, we handle your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (including Quebec's Law 25). You have the right to:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Withdraw Consent: Withdraw your consent to our collection, use, or disclosure of your personal information (subject to legal or contractual restrictions; withdrawing consent may limit our ability to provide the Service)
• Portability (Quebec): Quebec residents may request a copy of the computerized personal information we hold about them in a structured, commonly used technological format
• Complain: File a complaint with the Office of the Privacy Commissioner of Canada — or, for Quebec residents, the Commission d'accès à l'information du Québec — if you believe your privacy rights have been violated

Your data is stored and processed in the United States (see Section 14). Our person in charge of the protection of personal information (privacy officer) can be reached at [email protected] — include "Privacy Officer" in the subject line. We do not use your personal information to make automated decisions that have legal or similarly significant effects on you. To exercise these rights, email us at [email protected] with "Privacy Request" in the subject line.

11.6 Response Time

We will respond to your data rights requests within 30 days. If we need additional time, we will notify you of the reason and extension period.

12. Cookies and Tracking

12.1 Essential Cookies

We use essential cookies necessary for the operation of our service, including:

• Authentication Cookies: Keep you logged in and maintain your session (managed by Clerk)
• Security Cookies: Detect and prevent security threats
• Preference Cookies: Remember your settings and preferences

12.2 Analytics Cookies

Our web application uses PostHog to understand how the product is used (see Section 4.1). PostHog sets first-party cookies to recognize your browser across sessions. This data is used solely by us for product improvement and is never sold or used for advertising.

12.3 Advertising Cookies

Our marketing website and signup flow use Meta Pixel and the Google tag for advertising conversion measurement (see Section 4.2). These set cookies such as Meta's _fbp and _fbc and Google's advertising cookies. You can opt out of these at any time — we automatically honor the Global Privacy Control browser signal, and you can also opt out as described in Section 11.

12.4 First-Party Attribution Storage

When you arrive at our marketing website from an ad or campaign link, we store the campaign parameters from the URL (UTM tags and ad click identifiers such as gclid and fbclid), along with the landing page and referrer, in your browser's localStorage and a first-party cookie for up to 30 days. If you sign up, this attribution information is saved with your organization so we know which campaign brought you. It is used only for measuring our own marketing and is covered by the same opt-out rights described in Section 11.

12.5 Third-Party Cookies

Some third-party services we use (such as Clerk for authentication) may set their own cookies. We do not control these cookies. Please review the privacy policies of these services for more information.

12.6 Managing Cookies

You can configure your browser to refuse cookies or alert you when cookies are being sent. However, disabling essential cookies may prevent you from using certain features of our service.

13. Children's Privacy

86 is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected], and we will delete such information from our systems.

By using 86, you represent that you are at least 18 years of age.

14. International Users

14.1 Where 86 Is Offered

86 is offered to businesses located in the United States, U.S. territories, and Canada. We do not currently market or offer the Service in other countries.

14.2 Data Transfer

86 is operated from Puerto Rico, and our servers are located in the United States. If you access our service from outside the United States — including from Canada — your information will be transferred to, stored, and processed in the United States. By using the Service, Canadian users consent to this cross-border transfer. Our U.S. service providers are bound by contractual and security obligations described in this policy, and your information may be subject to access by U.S. authorities under U.S. law.

14.3 Canadian Users

For users in Canada, we comply with PIPEDA and applicable provincial privacy laws. Your rights are described in Section 11.5. Our SMS and email practices for Canadian recipients follow CASL (see Section 7.5).

14.4 European Users

86 is not directed at, offered in, or marketed to the European Economic Area (EEA), United Kingdom, or Switzerland. If you nevertheless access the Service from those regions:

• We honor the data-protection rights described in Section 11.4 upon request
• Data transfers from the EEA to the U.S. are based on appropriate safeguards, including our service providers' compliance with relevant frameworks (e.g., Convex and Clerk have GDPR-compliant practices)
• You have the rights described in Section 11.4

14.5 Legal Basis for Processing (GDPR)

For European users, our legal basis for processing your personal data includes:

• Contract Performance: Processing necessary to provide the service you requested
• Consent: Where you have given explicit consent (e.g., for push and SMS notifications)
• Legitimate Interests: For improving our service, preventing fraud, and ensuring security
• Legal Obligations: To comply with applicable laws and regulations

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• For material changes, we will notify you via email or through a prominent notice in the application
• Changes become effective immediately upon posting unless otherwise stated

We encourage you to review this Privacy Policy periodically. Your continued use of 86 after changes are posted constitutes your acceptance of the updated policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: