Contents
1. Who is responsible for your data
[Legal entity name], [Registered address], is the controller of personal data processed through the FoodNormIQ website and, in respect of our own account and billing records, the Service. Where we process data contained in your business records on your instructions, we act as your processor.
Data protection contact: hello@foodnormiq.com.
We process personal data in line with the Law on Personal Data Protection of North Macedonia and, where it applies, the EU General Data Protection Regulation (GDPR).
2. What data we handle
a. Website visitors
We use Cloudflare Web Analytics, which is privacy-first and does not use cookies and does not fingerprint individuals. It records aggregate page views, referrers, country and device type. We do not run advertising trackers on this site, so no cookie consent banner is required for analytics.
If you email us, we hold your message and contact details in order to reply.
b. Client account data
Names, work email addresses, phone numbers and roles of the people who use the Service; company and billing details; login and audit records.
c. Business records you upload
Recipes, menus and prices; sales data from your POS or delivery platforms; supplier invoices and utility or overhead bills; and the costs and margins we derive from them.
These are predominantly business records rather than personal data. However, uploaded documents can contain personal data — for example the name and contact details of a supplier's representative, a sole trader's name, a signature, or a staff name on a payroll cost entry. Where that happens, we process it on your behalf as your processor, solely to deliver the Service.
Please do not upload personal data you do not need us to have. The Service does not require customer names, delivery addresses, card details or employee records to work.
3. How scanned invoices are handled
This is the part clients ask about most, so here is the full lifecycle:
- Capture. You upload a photo or PDF through the app, or send it to a dedicated address we set up for your account.
- Immutable storage of the original. The document is stored unchanged in tenant-isolated object storage, encrypted in transit and at rest. We keep the original deliberately: it is the audit trail behind every number, and it lets us re-run extraction if our processing improves.
- Extraction. An AI model reads the document and extracts vendor, dates, line items, quantities, units and prices. Each extracted line carries a confidence score.
- Mapping. Supplier line text is matched to a canonical ingredient. The first time a supplier item is seen, the mapping is confirmed by a human and then reused.
- Human review. Anything below our confidence threshold is queued for review by you or by our team before it affects your costs. Nothing low-confidence silently changes a recipe cost.
- Posting. Confirmed lines update ingredient prices, which recalculate every recipe that uses them. Each stored line keeps a reference back to its source document.
- Retention. Original documents and derived records are kept for your plan's history window (12, 24 or 36 months). After that they are deleted or archived on a schedule. You may request earlier deletion of specific documents at any time.
- Deletion. On termination, we provide an export on request and delete or irreversibly anonymise your documents and data within [30–60] days, unless we must retain something by law.
You must keep your own originals. Invoices are statutory accounting records in your jurisdiction, with retention periods that are typically far longer than ours. FoodNormIQ is an analytics layer, not your archive.
4. Why we process it, and on what basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Providing the Service — costing, margins, alerts, reports | Business records, account data | Performance of a contract |
| Support and communication | Contact details, correspondence | Contract / legitimate interests |
| Billing, accounting, tax | Company and billing data | Legal obligation |
| Security, abuse prevention, audit logs | Login and usage records | Legitimate interests |
| Improving the Service | Aggregated, de-identified usage statistics | Legitimate interests |
| Market and peer benchmarks | Aggregated, anonymised price data | Consent (opt-in) |
5. Benchmarking and anonymisation
Peer benchmarking — showing whether you pay more than comparable kitchens for an ingredient — only works by pooling data across clients. Because that involves your commercially sensitive prices, we hold ourselves to four rules:
- Opt-in only. Your data is not included unless you explicitly consent, and you can withdraw at any time without affecting anything else in the Service.
- Aggregates only. Benchmarks are medians and percentile ranges. We never show a named supplier's price or any single business's figures.
- Minimum sample size. A benchmark is only ever shown where enough independent businesses are in the sample that no individual's data can be inferred from it.
- No resale. We do not sell client price data to suppliers, distributors or third parties.
6. Sub-processors
We use a small number of carefully chosen providers to run the Service. Your data may be processed by:
| Provider | Purpose | Location |
|---|---|---|
| Anthropic | AI reading of documents and proposed ingredient mappings (Claude), through its business API; drafting summaries | US / EU |
| Cloudflare | Application hosting and sign-in; storage of original documents (R2) and of your data and team entries (D1); website hosting and privacy-first analytics | Storage pinned to the EU; delivery from the global edge |
| Optional “Sign in with Google” (email address only) | Global | |
| [Payment provider] | Billing and payment processing | [Region] |
Sub-processors are bound by contract to protect your data and to process it only on our instructions. Our AI sub-processors do not use your data to train their models. Where data is transferred outside your country, we rely on appropriate safeguards such as standard contractual clauses. We will give notice before adding a sub-processor that materially changes how your data is handled.
7. Security
- Encryption in transit (TLS) and at rest.
- Sign-in with a one-time email code or Google; only email addresses your business has approved can open your account, and removing a person ends their access at once.
- Logical tenant isolation — every record is bound to a single client account, and access paths are scoped by account.
- Per-person permissions set by your business (which areas, view or edit, which store, labour visible or not), enforced on the server; our staff access is limited to those who need it to deliver the Service, under confidentiality obligations.
- Audit logging of access and of every change, with who made it, when, and the value before and after.
- Weekly encrypted backups, kept in the EU.
No system is perfectly secure. If a breach affects your personal data, we will notify you and, where required, the supervisory authority without undue delay.
8. Your rights
Subject to the conditions in applicable law, you may request: access to your personal data; correction of inaccurate data; deletion; restriction of or objection to processing; portability; and withdrawal of consent (including benchmarking) at any time.
To exercise any of these, email hello@foodnormiq.com. We respond within [30] days. Where we act as processor for data inside your business records, we will refer your request to the relevant client, or act on their instructions.
You also have the right to lodge a complaint with the data protection authority in your country — in North Macedonia, the Agency for Personal Data Protection.
9. How long we keep things
| Data | Retention |
|---|---|
| Scanned documents and derived records | Your plan's history window (12 / 24 / 36 months) |
| Account and contact data | Duration of the relationship, then [30–60] days |
| Billing and accounting records | As required by tax law in [Country] |
| Website analytics | Aggregated only; no individual profiles |
| Email correspondence | [24] months |
10. Changes to this policy
We will update this policy as the Service develops — for example when a sub-processor changes or a new feature such as benchmarking goes live. Material changes are notified by email or in the dashboard before they take effect, and the version and date at the top of this page always reflect the current text.