BakeryOS ("we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our service.
This Policy applies to two categories of people: (1) Tenants -- bakery owners and their staff who subscribe to our platform; and (2) End Users -- the bakery customers who shop on storefronts powered by BakeryOS.
By using our Service, you acknowledge that you have read and understood this Privacy Policy. If you disagree with this policy, please discontinue use of the Service.
| Category | Examples | Who Provides It |
|---|---|---|
| Account Information | Name, email, password (hashed), phone, bakery name, subdomain | Tenants at signup |
| Billing Information | Billing address; Stripe payment method token (we never store raw card numbers) | Tenants at subscription |
| Business Content | Product listings, photos, pricing, business hours, branding assets | Tenants in admin |
| Customer Account Data | End-user name, email, password (hashed), shipping/billing addresses, order history | End users on storefront |
| Order Data | Product selections, custom order notes, fulfillment preferences, timestamps | End users at checkout |
| Support Communications | Emails, chat messages, support tickets you send to us | Tenants and end users |
When you use the Service, we automatically collect:
We may receive information from:
We use the information we collect for the following purposes:
We do not sell your personal information to third parties, and we do not use it for targeted advertising.
We share your information only in the following limited circumstances:
We share information with trusted third-party service providers who assist us in operating the Service, subject to confidentiality agreements:
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency). We will attempt to notify you of such requests to the extent permitted by law.
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before your information is transferred and becomes subject to a different Privacy Policy.
We may share your information with third parties when you give us explicit consent to do so.
We use the following types of cookies:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Session Cookies | Maintain your login session and CSRF protection tokens | Session (deleted when browser closes) |
| Preference Cookies | Remember your display preferences (e.g., billing cycle selection) | 30 days |
| Analytics Cookies | Understand how the platform is used to improve features (anonymized) | Up to 2 years |
You can control cookies through your browser settings. Disabling session cookies will prevent you from logging in to the Service.
We implement industry-standard security measures to protect your information:
No method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.
In the event of a data breach affecting your personal information, we will notify you as required by applicable law.
We retain your information for as long as your account is active or as needed to provide you with the Service. Specifically:
You may request early deletion of your data by contacting us at privacy@bakeryos.net. Note that some information may need to be retained to fulfill legal obligations.
Depending on your location, you may have the following rights regarding your personal information:
To exercise any of these rights, please contact us at privacy@bakeryos.net. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.
California Residents (CCPA): California residents have the right to know what personal information we collect, the right to delete it, and the right not to be discriminated against for exercising these rights. We do not sell personal information.
When you use BakeryOS to collect and manage data from your bakery customers (including their names, email addresses, and order history), you are the data controller and we are the data processor acting on your instructions.
As a data controller, you are responsible for:
We process your customers' data only as necessary to provide the Service to you and in accordance with your instructions. We do not use your customers' data for our own marketing purposes or share it with third parties except as necessary to provide the Service.
The Service is not directed to individuals under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.
If you believe we may have inadvertently collected information from a child under 13, please contact us at privacy@bakeryos.net.
The Service may contain links to third-party websites or integrate with third-party services (such as Stripe). These third parties have their own privacy policies and we are not responsible for their practices. We encourage you to review the privacy policies of any third-party services you use.
Key third-party privacy policies:
Our servers are located in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.
By using the Service, you consent to this transfer. We take steps to ensure that your data receives an adequate level of protection regardless of where it is processed.
We may update this Privacy Policy from time to time. We will notify you of material changes by sending an email to the address associated with your account and by posting a notice in your admin dashboard at least 14 days before changes take effect.
The "Last updated" date at the top of this page indicates when this Policy was last revised. Your continued use of the Service after any changes take effect constitutes your acceptance of the revised Policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy team:
We aim to respond to all privacy inquiries within 5 business days.
This Privacy Policy was last updated on January 1, 2025. See also: Terms of Service.