Privacy Policy

Effective 2026-06-18

This policy explains what personal information Board86 collects when you use this service, how we use it, and the choices you have. It is written in plain English. Where it matters, we note the relevant obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Who we are

Board86 is operated by Chi Cheng and Johnny Chan, carrying on business as Board86, based in Ontario, Canada. For any privacy questions, email info@board86.com.

What we collect

Account information — your email address, used to sign you in and contact you about the service.
Business data you upload — invoices, receipts, labour reports, sales/POS exports, inventory counts, and any files or notes you attach.
Derived data — fields extracted from your uploads (e.g. vendor, totals, line items) stored to power the dashboards.
Technical data — standard web logs (IP, user agent, timestamps) from our hosting and error-reporting providers, used to keep the service running and debug problems.

How we use it

We use your data to provide the service: ingest your uploads, run extraction, store the results, and render them back to you in the app. We do not sell data that identifies you or your restaurant, do not share your identifiable data with advertisers, and do not use your identifiable data to train machine-learning models. We may, however, create aggregated and de-identified data from your uploads and use, share, or sell it to third parties — see "Aggregated and de-identified data" below.

Aggregated and de-identified data

We create aggregated and de-identified data from the information you upload — for example, combining pricing across many restaurants into market benchmarks, or pooling purchasing volume to negotiate group-purchasing deals. We may use, share, or sell this aggregated data to third parties, including suppliers, buying groups, and other partners. We use Board86 this way by default; using the service constitutes your agreement to it.

Aggregated data is built so it cannot reasonably be traced back to you:

Combined across many restaurants — never presented as a single restaurant's figures.
De-identified — no restaurant names, owner identities, or vendor account details are included in what we share or sell.
Ranges, not single points. A pricing benchmark shows percentiles across a cohort (e.g. 25th, 50th, 75th) — never an identifiable price from any single restaurant.
Minimum cohort size of 5. A cohort must contain at least 5 restaurants before any benchmark or aggregate statistic is produced. Below that, no result is shared.
Excluded automatically: credits, samples, comp lines, and any invoice you mark as private.

Only your own restaurant's data is ever shown back to you, by name, in your own reports.

Who else processes it

We use a small set of trusted service providers to run the service. Your data is processed by:

Supabase (database, authentication, storage, server functions) — our project is hosted in AWS us-east-2 (Ohio, USA).
Anthropic — we send the contents of your uploaded invoices and POS reports to Anthropic's Claude API to extract fields. Anthropic acts as a subprocessor; per Anthropic's API terms, your data is not used to train their models.
Postmark — processes inbound email (the optional "forward your POS reports here" flow) and any outbound transactional emails.
Glitchtip — receives anonymized error reports from the app.

Cross-border transfer

Because our database and most subprocessors are located in the United States, your information is transferred to and stored outside Canada. U.S. law may allow local authorities to access data stored there. By using Board86, you consent to this transfer. If you have questions about this, contact us.

How long we keep it

While your account is active, we keep your data so the service works. If you ask us to close your account and delete your data, we'll purge it within 30 days. Some information may remain in routine backups for a short period after that before being overwritten.

Your rights

Under PIPEDA you have the right to:

Ask what personal information we hold about you.
Ask us to correct information that is inaccurate.
Ask us to delete your account and associated data.
Withdraw your consent to our processing (note: this may mean we can no longer provide the service).

To exercise any of these, email info@board86.com. If you're unhappy with how we've handled your request, you can file a complaint with the Office of the Privacy Commissioner of Canada.

Security

We take reasonable steps to protect your data: all traffic is encrypted in transit (HTTPS/TLS), database access is gated by row-level security so one account can't read another's data, and sensitive credentials live in isolated secret storage, not in source code. No system is perfectly secure — if you notice a vulnerability, please email us.

Changes to this policy

If we make material changes to this policy, we'll update the effective date at the top and, where practical, notify you by email.