Privacy Policy

At PlatePrep, safeguarding your data is foundational to how we operate. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use PlatePrep Hospitality AI — our Culinary Intellectual Property Operating System.

It applies to our website, the PlatePrep platform, and all associated operational modules including MenuSignal™ and RecipeCore™. By accessing or using the platform you acknowledge that you have read and understood this policy.

We collect information necessary to deliver, maintain, and improve the platform:

We use a small number of cookies and similar technologies — and, more than cookies, we use your browser's local storage. Strictly necessary items keep you signed in, hold work in progress so a dropped connection does not lose it, and remember the cookie choice you made. They are set without consent, as permitted by law, because the platform cannot function without them.

Analytics is different. We use Google Analytics 4 to understand how the platform is used and where it can be improved, and no analytics identifier is written to your device until you accept that category. Until then the tag runs in a consent-denied state and stores nothing.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. Marketing cookies are a separate, opt-in category that is switched off unless you turn it on — accepting analytics does not turn it on.

You can change any of it at any time through Cookie Settings, in the footer of every public page and in your account menu once you are signed in. Our Cookie Policy lists every individual item we store, its category, its provider and how long it lasts.

We use the information we collect to:

• Provide, maintain, and improve PlatePrep's AI-powered services

• Process transactions and deliver billing-related communications

• Power MenuSignal™ menu intelligence and RecipeCore™ recipe generation

• Send administrative messages, platform updates, and security alerts

• Respond to inquiries, support requests, and feedback

• Personalize your experience and deliver relevant operational insights

• Monitor platform usage trends and optimize performance

• Detect, investigate, and prevent unauthorized access or fraudulent activity

• Develop new modules, features, and AI capabilities

Where the GDPR or UK GDPR applies, we rely on the following legal bases. We process account, billing and operational data because it is necessary to perform our contract with you. We process security, diagnostic and product-improvement data on the basis of our legitimate interests in keeping the platform safe and functional, balanced against your rights. We rely on your consent for analytics cookies and for optional marketing communications, and you may withdraw it at any time. Where a law requires us to retain or disclose information, we process it to comply with that legal obligation.

We share your information only in the following limited circumstances:

• With the service providers that operate the platform, under written confidentiality and data-processing terms. Today these are: Amazon Web Services (hosting and content delivery), Stripe (subscription payments — card details are entered on Stripe's own pages, never on ours), and Google (Analytics 4, Tag Manager, Fonts, Translate and Maps). Our Cookie Policy lists which of these run in your browser and when

• With your explicit consent or at your direction

• To comply with legal obligations, enforce our terms, or protect rights, privacy, safety, and property

• In connection with a merger, acquisition, or sale of assets, with continued privacy protections

• In aggregated or anonymized form that cannot reasonably identify you or your restaurant

We do not sell personal information.

We implement enterprise-grade technical and organizational measures to protect your data:

• Encryption of data in transit and at rest

• Regular security audits, penetration testing, and vulnerability assessments

• Multi-factor authentication and role-based access controls

• Employee training on data security and privacy best practices

• Incident response procedures with prompt notification protocols

• SOC 2-aligned security practices and infrastructure monitoring

While we employ rigorous security measures, no system is completely impenetrable. We continuously invest in strengthening our security posture, and we will notify you and the relevant authorities of a qualifying breach within the timeframes the law requires.

Depending on your jurisdiction, you have certain rights regarding your personal information:

• Access and review the personal information we hold about you

• Correct inaccurate or incomplete information

• Request deletion of your personal information

• Restrict or object to certain processing of your data

• Data portability — receive your data in a structured, machine-readable format

• Withdraw consent where processing is based on consent

• Export all culinary IP, recipes, and operational data at any time

To exercise any of these rights, email support@plateprep.com. We respond within 30 days, and we will not discriminate against you for exercising them. If you are in the EEA or UK and believe we have not resolved your concern, you may lodge a complaint with your local supervisory authority.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to request its deletion or correction, and to opt out of any sale or sharing of it. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information for purposes requiring a right to limit.

You may exercise these rights, or designate an authorised agent to do so, by emailing support@plateprep.com. We will verify your request against the information already associated with your account before acting on it.

We retain personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. When determining retention periods we consider:

• The nature and sensitivity of the information

• Potential risk from unauthorized use or disclosure

• The purposes for which we process the information

• Applicable legal, regulatory, tax, and accounting requirements

Upon account termination we provide a 30-day export window before securely deleting your information in accordance with our retention schedule.

PlatePrep is a business tool intended for restaurant operators and their staff. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If we learn that we have collected such information, we will delete it promptly. Where a staff member under 16 is scheduled through the platform, that information is provided and controlled by their employer as the data controller.

PlatePrep operates across the United States, Canada, and Europe. Your information may be transferred to, stored, and processed in countries other than where you reside. We implement appropriate safeguards — including Standard Contractual Clauses where applicable — to ensure your personal information remains protected in accordance with this policy and applicable data protection laws.

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated policy here and, where appropriate, by email. The date at the top of this page always reflects the most recent revision, and your continued use of PlatePrep after notice constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this policy or our data practices, please get in touch: