Privacy Policy

This policy explains what Boulangeries de Paris LLC does with personal information when you or your colleagues use Socialcarbs. It covers the people who sign in to the application: business owners, managers and staff.

It does not cover shoppers on a bakery's own website or online store. When a business uses Socialcarbs to run its storefront, that business decides what happens to its customers' information and is responsible for it. We act only on that business's instructions. If you bought something from a bakery, read that bakery's privacy notice, which is linked in the footer of its site.

1. Information we process

1.1 Account and business information

• Business name, addresses, locations and contact details
• User account details: username, email address, role and location assignments
• Subscription and billing details, handled by Stripe — we never see or store full card numbers
• The date, version and IP address recorded when someone accepts our terms

1.2 Operational information you create

• Orders, items, catalogs, schedules, production records and reports
• Where a business uses the labor features: employee names, shift times, hourly rates and break records imported from its point-of-sale system
• Support conversations with the in-app help assistant. To answer a question the assistant may look up your own records and send both the question and what it found to our AI provider, named on the sub-processors page

1.3 Security and delivery records

• Sign-in and security events, including timestamps, IP address and the action taken
• Email delivery records: recipient address, subject, and whether the message was sent, skipped or failed
• Error reports, when error monitoring is enabled for the environment

1.4 QuickBooks Online, only if you connect it

• The realm ID and OAuth tokens needed to act on your authorization
• The invoice data required to create or update an invoice you asked for

We do not continuously sync your QuickBooks file, and we do not read bank feeds or unrelated ledgers.

1.5 Cookies

We set a session cookie, a security token, and Google reCAPTCHA's anti-abuse cookie. All three are strictly necessary to sign you in and to keep the service from being abused. There are no advertising or analytics cookies, and we do not operate any analytics or advertising tags. The full list is in our Cookie Notice.

2. Where the information comes from

Almost all of it comes from you: what you type into the application, and what your use of it generates. Some comes from services you connect yourself, such as QuickBooks Online or a point-of-sale system. Some is generated automatically, such as sign-in records and email delivery logs.

3. Why we use it

• To provide the service you have asked for, including any action you initiate in a connected system
• To keep the platform secure, prevent abuse, and maintain an audit trail
• To take payment and manage subscriptions
• To provide support and respond to your requests
• To meet legal obligations and respond to lawful requests

For anyone covered by UK or EU data protection law, the lawful bases are performance of a contract, our legitimate interests in securing and operating the service, and compliance with legal obligations.

4. We do not sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by California law. We have not done so in the preceding twelve months. Because we do not, there is no “Do Not Sell or Share My Personal Information” link on this site — there is nothing to opt out of.

5. Who else processes it

We use service providers to run the platform. They may process personal information only on our instructions and only to provide their service to us. The current list, with what each one does, is on our sub-processors page.

6. How long we keep it

We keep information for as long as the account is active, and after that for as long as we need it for the purpose it was collected for or to meet a legal obligation. The criteria we apply:

• Business records you created — kept while your subscription is active. On closure we work with you to export them before removal.
• Financial records — invoices, payments and the order records behind them are kept for as long as tax and accounting law requires, which is longer than the account itself.
• Time and pay records — where a business uses the labor features, these are kept for the period California wage-and-hour law requires, and are not deleted on request while that period runs.
• Security and delivery records — kept for as long as they are useful for security and troubleshooting.
• Integration tokens — deleted when you disconnect the integration.

We are replacing manual removal with scheduled deletion. Until that is in place, deletion happens when you ask us — see the next section.

7. Your rights and how to use them

If you are a California resident, you have the right to:

• Know what personal information we hold about you, where it came from, why we have it, and who we disclosed it to
• Get a copy of it in a portable format
• Correct information that is wrong
• Delete it, subject to the retention periods in section 6
• Limit the use of sensitive personal information — we do not use it for anything beyond providing the service, so this is already the case
• Not be discriminated against for exercising any of these rights. We will not deny you service, charge you a different price, or give you a lower level of service because you asked.

How to make a request

Email privacy@socialcarbs.com and tell us what you want. You can also ask your own administrator, who can pass the request to us.

We will acknowledge your request and respond within 45 days. If the request is complex we may take up to 45 more days, and we will tell you why before the first period runs out.

How we check it is you

We match the request against the email address on the account and ask you to confirm it from that address. For a deletion request we also ask you to confirm something only the account holder would know. We use what you give us for verification only to answer the request. If we cannot verify you, we will tell you why rather than act on an unverified request.

Authorized agents

You may use an authorized agent. We will ask for written permission signed by you, and we may still ask you to confirm the request directly.

If you disagree with our answer

Reply to us at privacy@socialcarbs.com and we will review it. You may also complain to the California Privacy Protection Agency or the California Attorney General.

8. If you are in the UK or EEA

We are based in the United States and do not target the UK or EEA, and we have not appointed a representative there. If UK or EU law applies to you, you have rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your local supervisory authority. Use the same address above and we will handle your request on the same timetable.

9. Where information is processed

We process and store information in the United States, on Google Cloud. Our service providers may process it elsewhere; where they do, they rely on standard contractual clauses or an equivalent safeguard.

10. How we protect it

• Encrypted in transit with TLS, and encrypted at rest by our hosting provider
• Credentials and integration tokens held in a dedicated secret store with least-privilege access
• Each business's data is isolated at the query layer and enforced again by the database
• Role-based access control, so people see only what their role allows
• Audit records for sensitive operations
• Automated daily backups

No service can promise perfect security, and we do not. If a breach affects your personal information we will notify you as the law requires.

11. Children

Socialcarbs is a tool for businesses. It is not directed at children and we do not knowingly collect personal information from anyone under 16 through it. If you believe a child has given us information, write to privacy@socialcarbs.com and we will delete it.

12. Changes

When we change this policy we publish a new version with a new effective date, both shown at the top of this page. If a change materially affects your rights we will tell account administrators directly.

13. Contact

Privacy questions and requests: privacy@socialcarbs.com
Anything else: support@socialcarbs.com

Boulangeries de Paris LLC, 143 S Beverly Dr., Beverly Hills, CA 90212