Privacy Policy

1. Who we are

Tare7 is a hosted platform for service jobs, mobile selling, and inventory operations. This policy covers data collected through tare7.com, tare7.vercel.app, and the Tare7 application.

2. What we collect

Account data — name, email, password (hashed), organization name.

Operational data — everything you enter into the app: items, SKUs, vendors, customers, purchase orders, sales orders, invoices, ledger transactions, etc. This is your business data and we treat it as yours.

Usage telemetry — request logs (URL, status code, duration), error traces, and aggregate metrics. Used to operate and improve the service.

Billing metadata — plan, subscription status, seat count, provider identifiers, and transaction events needed to maintain access. Payment credentials remain with Stripe or Apple; Tare7 does not store full card details.

3. Why we collect it

• To operate the service you signed up for.
• To detect abuse, secure your data, and comply with legal obligations.
• To send transactional email (invoices you emailed to customers, password resets, low-stock alerts you opted into).
• To improve the product — always aggregated, never cross-customer.

We do not sell or rent your data. Ever.

4. Subprocessors

We use a small set of vetted subprocessors to deliver the service:

• Supabase — Postgres database, authentication, file storage. Data residency: US.
• Vercel — application hosting + edge network.
• Stripe — subscription billing and payment method storage.
• Resend — transactional email delivery.
• Approved AI model providers (through Vercel AI Gateway) — used only for enabled, user-invoked or explicitly authorized Tare7 Intelligence features. Requests are limited to the context needed for that action.

5. How your data is protected

• TLS on every request.
• Row-level security in the database — an organization cannot query another organization's data even if the app layer is bypassed.
• Passwords are handled and one-way hashed by Supabase Auth; Tare7 does not receive the plaintext password.
• Provider-operated backup controls, with retention determined by the active hosting plan and configuration.
• Privileged production access is restricted to designated owner or administrator accounts and is subject to separate credentials and multi-factor controls where supported.

6. Data location + retention

Data is stored in US regions on Supabase and Vercel. Backups are encrypted and stored in the same jurisdiction.

Canceling a subscription does not automatically request deletion. An authorized workspace owner can start the deletion flow; the live workspace remains recoverable for 30 days and is then purged. Backup copies age out under the provider's normal rotation rather than being selectively rewritten.

7. Your rights

You can export every table you own as CSV from within the app. You can request deletion of your account and all associated data at any time by emailing privacy@tare7.com. If you are in a jurisdiction with formal data-subject rights (e.g. GDPR / CCPA), we honor requests to access, correct, export, or delete personal data under those regimes.

8. Cookies

We use a small number of first-party cookies for authentication (session), preferences (theme, active organization), and CSRF protection. We do not run third-party ad or tracking pixels.

9. Children

Tare7 is a B2B product not intended for individuals under 16. We do not knowingly collect data from minors.

10. Changes

Material changes will be announced via email to the account owner and via in-app announcement at least 14 days before they take effect.

11. Contact

Privacy questions: privacy@tare7.com. Terms: read them here.