Privacy Policy

1. Information we collect

• Account data — name, email, and authentication identifiers from our auth provider (Clerk).
• Company & facility data — workspace name, address, FDA facility identifiers, and related profile fields you enter.
• HACCP plan content — product descriptions, process steps, hazard analyses, CCPs, citations, documents, and chat questions you submit.
• Billing data — handled by Stripe (we store customer and subscription identifiers, not full card numbers).
• Usage data — product analytics (e.g. Vercel Analytics), logs, and audit events needed to operate and secure the service.

2. How we use information

• Provide, secure, and improve the HACCP drafting service.
• Run AI features that generate drafts from your inputs and indexed FDA guidance.
• Process subscriptions and respond to support requests.
• Enforce plan limits, prevent abuse, and meet legal obligations.

3. AI processing

When you use AI features, relevant plan content and retrieved FDA guidance passages are sent to our AI provider (currently OpenAI) to generate drafts or answers. Do not submit secrets or personal data that is not needed for food-safety planning.

4. Sharing

We share data with processors that help us run the product (for example Clerk for auth, Stripe for billing, Neon for database, Vercel for hosting/storage, OpenAI for model inference). We do not sell your personal information. We may disclose information if required by law or to protect the service and users.

5. Retention

We retain account and plan data while your account is active and for a reasonable period afterward for backups, disputes, and legal requirements. You may request deletion by contacting support; some records may remain in backups for a limited time.

6. Security

We use industry-standard safeguards (TLS in transit, access controls, and least-privilege credentials). No method of transmission or storage is perfectly secure.

7. Your choices

You can update profile information in the app, manage billing in the Stripe portal, and contact us to request access or deletion subject to applicable law. Marketing email is not a core part of this product today; transactional messages may still be sent for account and billing purposes.

8. Children

The service is intended for business users and is not directed to children under 16.

9. Changes

We may update this policy and bump the version date. Continued use after you accept the new version constitutes acknowledgment.

10. Contact

Privacy questions: support@haccpengine.com. See also our Terms of Service.