1.Scope and roles
This Privacy Policy applies to information processed through the KPI360 website and platform (the “Service”). For most business data your company connects (e.g., point-of-sale records), you are the controller and KPI360 acts as a processor on your behalf under our Data Processing Addendum. For information about your account and your use of our website, KPI360 is the controller and this Policy governs.
2.Information we collect
Information you provide
- Account & contact: name, email, phone, company, role, and store/location assignment.
- Billing: subscription and payment details, processed by our payment processor (we do not store full card numbers).
- Support & communications: messages you send us.
Business data via Integrations
- Point-of-sale & operations: sales, orders, product mix, labor hours and pay, and related figures ingested from systems you connect (e.g., Toast) or spreadsheets you link/upload.
Automatically collected
- Usage & device: log data, IP address, browser/device type, pages viewed, and actions taken, used for security and to operate the Service.
- Cookies: as described in the Cookies section below.
3.Bank and card connections
We use Stripe (Financial Connections) as a subprocessor for read-only bank and card transaction connections.
This connection is read-only. It cannot move money, make payments, or make transfers.
The KPI360 platform owner chooses which accounts to link in Stripe’s screen. Bank sign-in happens inside Stripe’s own screen; KPI360 does not receive or store bank logins.
We store the account’s display name and last four digits when Stripe provides them, the bank name, account category and subcategory, and connection status. This Stripe connection does not request or store account balances.
For each transaction we store its Stripe transaction ID, amount, currency, description, status (pending, posted, or void), transaction time, posted and void times when provided, refresh ID, and update time.
We also store an encrypted Stripe account ID, a local account ID, restaurant mapping, deposit rules, deposit-direction checks, the last refresh ID, a version number, read and update times, any read-error message, and the chosen deposit source.
These records are kept in private Vercel Blob storage, separated by company. KPI360 encrypts the Stripe account ID before storing it. The other account details and transaction rows are stored as JSON without a separate layer of encryption in KPI360’s code.
The Stripe feed has no set time limit for stored rows. Switching providers or turning the feed off keeps the stored data.
The platform owner can request disconnection at any time in Company › Connections: open “Disconnect this account,” type DISCONNECT, and press “Disconnect account.” KPI360 first pauses reads, then asks Stripe to stop transaction updates. After Stripe accepts, KPI360 removes the account ID, details, and rows from its current feed and rewrites the current saved copy. It also deletes older saved versions returned by one lookup of up to 1,000 versions. If a step fails, disconnection or cleanup may be incomplete. This does not delete data held by Stripe.
Only the KPI360 platform owner (the superadmin role) can view the linked accounts and recent transaction rows or manage the connection. Company members with the manager role and access to Cash or Finance can see deposit totals for their permitted locations.
KPI360 uses this feed to show your company its own cash and compare deposits with its books. This feed is not sold or shared with other companies. The current Stripe feed is not passed to AI features or model training.
4.How we use information
We use information to: provide, secure, and maintain the Service; ingest and analyze your business data to produce dashboards, forecasts, and AI-generated insights; authenticate users and enforce access and usage limits; process billing; provide support; detect, prevent, and investigate fraud, abuse, and security incidents; comply with law; and improve the Service. We do not use your Customer Data to train third-party AI models, and we do not sell personal information.
5.AI processing
Certain features send relevant, minimized data to an AI provider (Anthropic) to generate summaries, forecasts, and suggestions. This processing is performed to provide the feature you request. AI outputs are informational and may be inaccurate; see the “No advice” disclaimer in our Terms. We choose providers that contractually commit not to train their models on data submitted through their business APIs.
6.Legal bases (where applicable)
Where the GDPR or similar laws apply, we process personal data on the bases of: performance of a contract (to provide the Service); legitimate interests (to secure and improve the Service, prevent abuse); consent (e.g., for non-essential cookies); and legal obligation. For business data processed on your behalf, your instructions and our DPA govern.
9.Data retention
We retain personal and business data for as long as your account is active or as needed to provide the Service, then for a limited period as required to comply with legal obligations, resolve disputes, and enforce agreements. On termination, and subject to the DPA, we delete or de-identify Customer Data within a reasonable period after any export window. You may request earlier deletion where legally permitted.
10.Security
We use administrative, technical, and organizational safeguards designed to protect information, including encryption in transit and at rest, per-company data isolation, and access controls. See our Security & Compliance page for details. No method of transmission or storage is 100% secure.
11.Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to opt out of certain processing, and to withdraw consent. To exercise rights, contact privacy@kpi360.ai; we will verify and respond as required by law and will not discriminate against you for exercising rights.
California (CCPA/CPRA). We do not sell or share personal information as defined by the CPRA. California residents may request to know, delete, and correct personal information, and may designate an authorized agent. New York and other states. Residents may have similar rights under applicable state law. For business data we process on your company’s behalf, please direct requests to that company (the controller); we will assist as its processor.
12.International data transfers
We operate the Service using infrastructure primarily located in the United States. If you access the Service from outside the U.S., you understand your information may be processed in the U.S. Where required, we rely on appropriate transfer mechanisms.
13.Children’s privacy
The Service is for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child provided us information, contact us and we will delete it.
14.Changes to this Policy
We may update this Policy. Material changes will be posted here with a new effective date and, where appropriate, communicated to you. Your continued use after the effective date constitutes acceptance.
15.Contact us
Privacy questions or requests: privacy@kpi360.ai. KPI360, New York, NY.