Privacy Policy

This Privacy Policy explains how SpoonSeal LLC (“SpoonSeal,” “we,” “us”) collects, uses, shares, and protects information when you use our website and the SpoonSeal compliance platform (the “Service”). By using the Service, you agree to this Policy.

1. Information we collect

• Account & contact data — name, email, phone, and mailing address you provide when you sign up or edit your profile.
• Restaurant & location data — the locations you add, their addresses, and the compliance profile you configure (e.g. whether you serve alcohol, use a grease trap).
• Documents & records — certificates, permits, service reports, invoices, and photos you or your vendors upload as compliance evidence.
• Vendor data — vendors you add or invite, their names and contact details, and the requests and documents exchanged with them.
• Usage & device data — log data such as IP address, browser type, pages viewed, and timestamps, used to operate and secure the Service.
• Communications — messages you send us (including email to support) and your notification preferences.

2. How we use information

• Provide and maintain the Service — readiness scoring, reminders, document storage, vendor requests, and inspection packets.
• Operate the Spoon AI assistant (see below) and improve the guidance we surface.
• Send transactional email (invitations, requests, notifications) and, where enabled, summaries.
• Provide support, prevent abuse, secure the Service, and meet legal obligations.

3. The Spoon AI assistant

When you use Spoon, your question and a scoped snapshot of your own location’s compliance context are sent to our AI provider (Anthropic) to generate a response. Spoon only ever receives context for the location you are signed in to — never another customer’s data. Your content is not used to train AI models. AI output can be wrong; see the Trust Center for our Responsible-AI practices and limitations.

4. How we share information

We do not sell your personal information. We share it only:

• With service providers (subprocessors) who host and run the Service on our behalf — currently Vercel (hosting), Supabase (database, authentication, and file storage), Resend (email delivery), and Anthropic (the AI assistant). A current list lives in the Trust Center.
• With vendors you choose to engage — when you invite a vendor or send a request, the relevant restaurant name, request, and documents are shared with that vendor.
• For legal or safety reasons — to comply with law, enforce our terms, or protect rights and safety.
• In a business transfer — as part of a merger, acquisition, or sale of assets, subject to this Policy.

5. Data retention

We keep your data while your account is active and as needed to provide the Service. When you close your account, access is disabled and your data is retained in a recoverable state so the account can be reopened; you may request permanent deletion by emailing us. We may retain limited records where required for legal, security, or accounting purposes.

6. Security

Data is encrypted in transit (TLS) and at rest, access is scoped by role and by organization, and uploaded documents are stored with per-organization isolation. No system is perfectly secure, but we apply industry-standard safeguards. Details are in the Trust Center.

7. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. California residents may exercise rights under the CCPA/CPRA, including that we do not sell personal information. To exercise any right, email support@spoonseal.com. You can also edit your profile, manage notification preferences, and close your account from within the app.

8. Cookies

We use essential cookies to keep you signed in and to secure the Service. We do not use advertising cookies or sell data to advertisers. You can control cookies through your browser settings; blocking essential cookies may break sign-in. See Privacy Preferences for more.

9. International users

The Service is operated and hosted in the United States. If you access it from elsewhere, you consent to processing in the U.S.

10. Children

The Service is for businesses and is not directed to children. We do not knowingly collect data from anyone under 16.

11. Changes to this Policy

We may update this Policy from time to time. We will revise the “Last updated” date and, for material changes, provide notice.

12. Contact

Questions or requests: support@spoonseal.com.