BatchcraftBatchcraft

Privacy Policy

Last updated: July 17, 2026

1. Who we are

Batchcraft is a software-as-a-service product for small food manufacturers (recipes, constraint-based scaling, costing, production batches, inventory, and sales). This Privacy Policy explains how [LEGAL_ENTITY_NAME] (“we,” “us,” or “our”) collects, uses, and shares personal information when you use the Batchcraft website and application (the “Service”).

Controller contact: [LEGAL_ENTITY_NAME]. Privacy requests: [PRIVACY_EMAIL].

Mailing address: [LEGAL_ENTITY_ADDRESS].

2. Scope

This policy covers personal information processed in connection with Batchcraft accounts, workspaces, and related transactional emails. It does not cover third-party websites or services you connect on your own (for example, a separate ecommerce storefront that calls Batchcraft APIs with your API key).

3. Information we collect

Account and authentication

  • Email address and password (passwords are handled by Firebase Authentication; we do not store plaintext passwords).
  • If you sign in with Google: Google account identifiers, email, name, and profile photo as provided by Google.
  • Display name, optional avatar image, plan tier, and workspace membership identifiers.
  • Authentication session data persisted by Firebase Auth in your browser.

Workspace and business profile

  • Business/workspace name and profile fields (for example contact name, address, phone, public business email, website, default payment terms, logo).
  • Team member roles and invite emails/tokens.
  • API keys you generate for integrations (stored securely per our integrations design).
  • Notification preference toggles for transactional emails.

Production, inventory, and sales content

  • Ingredients, recipes, batches, inventory transactions, storage locations, and related production data you enter.
  • Customer records you enter (name, street address, city, state, ZIP, and optional email) and invoice content. This may include personal information about your wholesale or retail customers.
  • Uploaded images such as recipe photos, customer images, business logos, and avatars (Firebase Storage).

Operational and technical data

  • Transactional email metadata and delivery logs needed to send invites, batch/invoice/low-stock notices, and account-deletion notices (via Resend).
  • Hosting and serverless function logs typical of our hosting provider (for example IP address and user agent).
  • Theme preference stored in your browser’s local storage.

Information we do not collect today

We do not currently use advertising cookies, third-party analytics SDKs, or sell personal information. We do not collect payment card numbers in the Service (paid billing is not live yet).

4. How we use information

  • Provide, operate, and secure the Service (accounts, recipes, batches, inventory, invoices, team collaboration).
  • Send transactional emails you or your workspace enable (invites, production and sales notices, deletion confirmations).
  • Enforce plan limits, prevent abuse, and maintain product integrity.
  • Respond to support and privacy requests and comply with law.
  • Process account and workspace deletion requests as described below.

5. Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process personal information as needed to perform our contract with you, based on our legitimate interests in operating and securing a B2B SaaS product (balanced against your rights), and based on consent where we ask for it (for example agreeing to this policy at signup). You may have the right to object to processing based on legitimate interests.

6. How we share information (subprocessors)

We share personal information with service providers that process it on our behalf to run Batchcraft:

  • Google LLC / Firebase — Authentication, Cloud Firestore database, and Firebase Storage.
  • Netlify — Website hosting and serverless functions (including scheduled jobs such as deletion purges and transactional email triggers).
  • Resend — Transactional email delivery.
  • Google — When you choose Google sign-in, Google processes your Google account data according to Google’s policies and your Google settings.

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale (with notice where required).

7. Customer and end-customer data (controller vs processor)

For your Batchcraft login and account profile, we act as a controller.

For business content you store in a workspace—including customer names, addresses, emails, invoices, and production records—we act as a processor on your instructions to provide the Service. Your workspace is responsible for having a lawful basis to collect and use that information and for providing any required notices to your customers.

8. Cookies and local storage

We use essential browser storage only: Firebase Authentication session persistence and a theme preference in local storage. We do not use non-essential advertising or analytics cookies in the current product. If we add analytics or advertising later, we will update this policy and obtain any consent required by law.

9. International transfers

Batchcraft is operated using U.S.-based cloud providers. Personal information may be processed in the United States and other countries where our subprocessors operate. Where required, we rely on appropriate transfer mechanisms offered by those providers (such as standard contractual clauses).

10. Retention

  • Workspace (business) deletion: when an owner schedules deletion, the workspace enters a 7-day recovery window, then data is permanently purged (including related Storage files) according to our deletion process.
  • Archived records: certain archived items are retained for 30 days before purge.
  • Personal account deletion: removes your Firebase Auth user and profile; you may need to delete or leave workspaces first if you are an owner (see in-app Profile and Workspace settings).
  • Hosting logs and email delivery records may be retained for a limited period for security, delivery troubleshooting, and legal compliance, then deleted or anonymized.

11. Security

We use industry-standard measures appropriate to a cloud SaaS product, including encrypted transport (HTTPS), Firebase Authentication, and Firestore/Storage security rules that restrict data to authorized workspace members. No method of transmission or storage is 100% secure.

12. Your rights

Depending on where you live, you may have rights to:

  • Access, correct, or delete personal information we hold about you
  • Export or receive a portable copy of certain account data (to the extent we can provide it)
  • Object to or restrict certain processing
  • Opt out of “sale” or “sharing” of personal information — we do not sell personal information
  • Lodge a complaint with a data protection authority (EEA/UK) or contact us first so we can help

You can delete your personal account or schedule workspace deletion in the app (Profile and Settings → Workspace). For other requests, email [PRIVACY_EMAIL]. We may need to verify your identity before fulfilling a request.

13. Children’s privacy

Batchcraft is intended for business users and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact [PRIVACY_EMAIL] and we will take appropriate steps.

14. Changes

We may update this Privacy Policy from time to time. We will change the “Last updated” date at the top of this page. For material changes, we may also notify you by email or in-product notice.

15. Contact

Questions about this policy or our privacy practices: [PRIVACY_EMAIL].

Related: Terms of Service.