Privacy Policy

1. Who we are

Cater Karma, LLC, a Georgia limited liability company ("CaterKarma," "we," "us"), runs a platform that caterers, venues, and event businesses ("Businesses") use to manage events, proposals, floor plans, payments, and client communications.

2. Who controls the data

For the people who sign in to CaterKarma (Business owners and staff), we decide how the data is used. For information a Business enters about its own clients and guests, the Business decides, and we act only as its service provider: we use that information to provide the platform and for nothing else, including contacting those clients for our own purposes. If you are a Business's client and want your information corrected or deleted, contact that Business; you can also contact us and we will pass the request along.

3. What we collect

• Accounts and businesses: name, email, optional phone, a hashed password, business details, and team membership.
• Clients and events: names, emails, phone numbers, event details, menus, notes, and floor plans, entered by a Business or submitted through an inquiry form. Please don't enter sensitive details (such as health information) in notes.
• Approvals: when a client approves a proposal, or a Business owner accepts our Terms, we record the typed name (for clients), the time, and the IP address.
• Payments: Stripe processes payments. We keep Stripe reference IDs, amounts, and status.
• Messages: a record of emails sent through the platform (and texts, once text messaging is active), with delivery status.
• Technical: IP addresses, emails, and link tokens used for rate limiting and abuse prevention; error logs; session cookies; and aggregate analytics.

4. How we use and share it

We use information to run and secure the service, send proposals, receipts, invitations, and notifications, process payments, prevent fraud, fix errors, and meet legal obligations. We do not sell personal information or share it for advertising, and we have not done so in the past 12 months.

We share it only with providers that help us run the platform, under terms that restrict them to serving us: Stripe (payments), Resend (email), Supabase (database and file storage), Vercel (hosting and analytics), Mapbox (address search; it sees the addresses searched and your IP address), and Zoho (our support inbox). We may also disclose information when the law requires it or in a business sale or merger. A Business's team can see its data according to their roles, and a proposal is visible to the client who receives the link.

5. Text messages and email

Text messaging is not currently active. If we turn it on, texts will go out on behalf of a Business, which is responsible for getting the recipient's consent, and only to people who have agreed. They will be transactional (proposal and event updates, payment reminders), never marketing. Message frequency varies; message and data rates may apply. Reply STOP to opt out or HELP for help. Consent is not a condition of any purchase. No mobile information or opt-in consent will be shared with third parties or affiliates for marketing, other than providers that deliver the messages. Emails sent to a Business's clients are transactional and sent on the Business's behalf; replies go to the Business.

6. Cookies

We use only the cookies needed to keep you signed in and protect the site, plus Vercel Analytics for aggregate traffic. No advertising cookies.

7. Retention and deletion

We keep data while an account is active. Approval and payment records are kept as long as needed for the Business's records, disputes, and legal and tax obligations. Error logs are kept about 30 days and rate-limit records a few hours. Message logs are kept while needed for troubleshooting and the Business's records. Backups age out on their normal cycle. To request deletion, email info@caterkarma.com with "Privacy Request" in the subject; we will delete or de-identify the data within 45 days (extendable once by 45), except what we must keep for legal, tax, fraud-prevention, or dispute reasons.

8. Security

We use encryption in transit, hashed passwords, access controls designed to keep each Business's data separate, and rate limiting on sign-in. No system is perfectly secure. If a breach affects personal information, we will notify affected people and the relevant Businesses without unreasonable delay, as the law requires.

9. Your rights

You can ask to access, correct, or delete your information, or to opt out of texts. Depending on where you live (for example California), you may have additional rights and are protected from retaliation for using them. Email info@caterkarma.com with "Privacy Request" in the subject; we verify identity and respond within 45 days (extendable once by 45). Requests about information a Business entered are forwarded to that Business. If we decline a request, you can appeal by replying to our response.

10. Other things to know

CaterKarma is for businesses and not directed to anyone under 16. It is operated in the United States for US users; our providers may process data elsewhere. If we change this policy, we will post the new version with a new date and, for material changes, email account holders at least 30 days ahead; continued use means you accept the update. We will also email Businesses before adding a provider that processes their clients' data.

11. Contact

Cater Karma, LLC, 277 Atlanta Ave SE, Atlanta, GA 30315. Email: info@caterkarma.com.