Pantry Nexus Privacy Policy

1. Information We Collect

1.1 Account and organization information

We may collect information needed to create and manage an account, including:

• Name, email address, phone number, and password-related account data.
• Organization name, address, organization type, and operating settings.
• Staff role, profile information, and access or security events.

1.2 Pantry operations information

Organizations and their authorized users may enter or upload:

• Household and member names, contact details, demographics, language, and eligibility information.
• Dietary restrictions, household notes, visit history, queue activity, and distribution records.
• Donor, volunteer, inventory, task, activity, and operational report records.
• Profile images and other content an authorized user chooses to upload.

Organizations should collect only information needed for their programs and should not enter passwords, payment credentials, Social Security numbers, or unrelated medical records into household notes.

1.3 Subscription and billing information

Pantry Nexus does not currently collect card numbers, bank account numbers, or CVV values through the application. If paid subscriptions become available, a selected third-party billing and payment provider may collect those credentials. Pantry Nexus may receive the billing contact, selected plan, subscription status, invoice metadata, processor token references, payment outcomes, and customer support details needed to manage access and billing. The provider's own privacy notice and terms will also apply.

1.4 Device, security, and browser information

We may receive IP address, browser and device information, request timestamps, error information, and security events from the application, hosting infrastructure, authentication service, and abuse-prevention tools. Cloudflare Turnstile may process information needed to determine whether an authentication request is automated or abusive.

The application uses browser storage for authentication sessions and preferences such as theme and sidebar mode. Authentication, hosting, and security providers may use cookies or similar technologies needed to provide their services. Pantry Nexus does not use the application for cross-context behavioral advertising.

The public website and the sign-in pages use Cloudflare Web Analytics to count page visits. This tool does not use cookies. It does not collect household records or other information that you enter in the application.

2. How We Use Information

• Provide, maintain, and secure the Service.
• Authenticate users and enforce organization access permissions.
• Support intake, queue management, checkout, inventory, volunteer coordination, donor records, and reporting.
• Respond to support requests and send account, security, service, and billing communications.
• Prevent fraud, abuse, unauthorized access, and service disruption.
• Process subscriptions and billing when those features are available.
• Comply with law, enforce agreements, and protect the rights and safety of users and the public.

3. How Information Is Shared

We do not sell personal information or share it for cross-context behavioral advertising. We may share information in these situations:

• Organization and authorized users: The organization controls its records and decides which authorized staff or volunteers may access them.
• Service providers: Supabase supports authentication, database, storage, and realtime services. Cloudflare supports hosting and Turnstile. Email, support, billing, and payment providers may process information when those services are used.
• Legal and safety reasons: When required by law or reasonably necessary to investigate fraud, security incidents, or threats to people or property.
• Business changes: In a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable protections.

We do not share household records with another organization unless the organization using Pantry Nexus authorizes that disclosure or the law requires it.

4. Organization Responsibilities

An organization using Pantry Nexus is responsible for determining what information it collects, providing required notices, obtaining required permissions, keeping records accurate, assigning appropriate access, and responding to household member requests about its records. Pantry Nexus processes organization-controlled records to provide the Service and according to the organization's instructions, subject to this policy and applicable law.

5. Security

We use measures designed to protect information, including authenticated access, organization permissions, row-level database policies, private storage for protected files, encrypted network connections, and security monitoring. No internet service or storage system can guarantee complete security. Users must protect their credentials and report suspected unauthorized access to support@pantrynexus.com.

6. Retention and Deletion

We retain information while it is needed to provide the Service, maintain security, support an account, meet legal or accounting obligations, resolve disputes, and enforce agreements. Organization records may remain available to the organization until it deletes or exports them, subject to applicable retention requirements. Backups, security logs, and billing records may remain for a limited period after deletion when needed for these purposes.

Contact privacy@pantrynexus.com to request access, correction, export, or deletion. We may verify the requester's identity and may direct requests about organization-controlled records to the organization that collected them.

7. Privacy Rights

Depending on where you live and whether a law applies, you may have rights to access, correct, delete, export, restrict, or object to the processing of personal information. You may also withdraw consent where processing relies on consent. We will handle verified requests within the time required by applicable law and will not discriminate against you for exercising a privacy right.

California residents may have additional rights under the California Consumer Privacy Act, including rights to know, delete, correct, limit certain sensitive information, opt out of sale or sharing, and receive equal service where applicable. Pantry Nexus does not sell personal information or share it for cross-context behavioral advertising. Send requests to privacy@pantrynexus.com.

If the General Data Protection Regulation or a similar law applies, Pantry Nexus and the organization using the Service may have different controller or processor roles. The applicable organization is responsible for its legal basis and notices for organization-controlled records. You may contact privacy@pantrynexus.com about Pantry Nexus processing and may contact your local data protection authority where permitted.

8. Children's Information

Pantry Nexus is not directed to children. An organization may enter information about children as part of a household record. The organization is responsible for complying with laws that apply to collecting and using that information. Pantry Nexus processes it only to provide the Service to that organization.

9. International Processing

Our service providers may process information in countries other than the country where it was collected. When a law requires safeguards for an international transfer, we will use appropriate contractual or other safeguards.

10. Changes and Incidents

We may update this policy when our practices, Service, or legal obligations change. We will update the date above and provide additional notice when required. If we determine that a security incident requires notice, we will notify affected organizations or individuals as required by law.

11. Contact

For privacy questions or requests, contact:

See the Terms of Service for the rules that apply to use of Pantry Nexus.