Skip to main content
ExactPour logo
Back to ExactPour

ExactPour Privacy Policy

Version 3.2 · effective October 7, 2026

ExactPour Privacy Policy

Last updated: October 7, 2026

ExactPour LLC, a Florida limited liability company ("ExactPour," "we," "us"), respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit exactpour.com, use our web and mobile applications, or otherwise interact with our services (the "Service").

This policy covers information we handle as a controller (e.g., account and billing data, website visitors, marketing leads). Where we process personal data on behalf of a business customer as a processor (e.g., data inside a customer's workspace), that processing is governed by our Data Processing Agreement.

1. Information We Collect

Information you provide:

  • Account & profile, name, email address, password (stored hashed by our authentication provider), phone number (optional), company name, business type, city/state (optional), role, and marketing opt-in preference.
  • Location & organization, venue/location names, addresses, and time zones you configure.
  • Billing, billing email and subscription details. Payment card data is collected and stored directly by our payment processor (Stripe); we do not store full card numbers.
  • Lead, demo, contact, and support forms, name, work email, phone, company/venue details, message contents, and any other fields you submit.
  • Support communications, messages, screenshots, and attachments you send us.

Information generated through use of the Service:

  • Inventory & operational data, barcodes scanned, product names, brands, categories, ABV, container sizes, fill levels, quantities, session metadata, waste logs, recipes, menu/recipe data, variance and report outputs, and optional item or waste images.
  • Integration data, data exchanged with connected services you enable (e.g., Toast, Square, Clover, or GoTab POS menus and sales; barcode lookup results).
  • AI feature inputs, prompts, uploaded documents (such as invoices), chat history with the in-app assistant, and other inputs you submit to optional AI-powered features.
  • Push notification tokens, device push tokens (e.g., Expo push tokens) when you allow notifications on a mobile device, stored on your profile so we can deliver operational alerts (low stock, variance, digests).
  • Biometric unlock preference, whether you enable Face ID / Touch ID / device biometrics to unlock the mobile app. Biometric templates never leave your device and are not stored by ExactPour; we store only an on/off preference.

Information collected automatically:

  • Device & usage data, IP address, browser and device type, user-agent, pages viewed, app screens and actions taken, and approximate referral source (e.g., classifying that a visit came from a known AI-assistant host, without collecting prompt text).
  • Security & audit logs, sign-in events, consent records, administrative actions, and security events, including IP address and user-agent, retained for security and compliance.
  • Cookies, local storage, and analytics, see our Cookie Policy. On the web this includes Supabase auth cookies, CSRF tokens, preference storage, and Google Analytics (GA4) under Consent Mode v2. In mobile apps this includes encrypted session storage, offline scan queues, on-device product/session caches, crash diagnostics, and product analytics identifiers.
  • Crash and diagnostic data, when enabled in our mobile apps, crash reports and limited performance traces (stack traces, device/app metadata, breadcrumbs, and user identifiers we attach) via our crash-reporting provider.

2. How We Use Information

We use personal information to:

  • provide, operate, secure, and maintain the Service (including offline sync and barcode scanning);
  • authenticate users and enforce access controls and usage quotas;
  • process payments and manage subscriptions;
  • deliver push notifications and in-app alerts you enable;
  • provide support and respond to inquiries and demo requests;
  • monitor, detect, and prevent fraud, abuse, and security incidents;
  • diagnose crashes and improve reliability;
  • generate anonymized, aggregated analytics to improve and benchmark the Service;
  • measure product usage (web and mobile analytics) to improve features and user experience;
  • send service, support, and technical communications, and (with your consent, where required) marketing communications you can opt out of at any time, see Section 11;
  • operate optional advertising measurement and Google Signals features on the website only where you have granted the relevant consent, see Section 12; and
  • comply with legal obligations and enforce our agreements.

Legal bases (EEA/UK). Where GDPR applies, we rely on: performance of a contract; our legitimate interests (operating, securing, and improving the Service); consent (e.g., certain cookies, marketing, and advertising measurement); and compliance with legal obligations.

3. Our Access to Your Data

We do not sell your data, and we never have. We do not share it with third parties for their own advertising or marketing.

To operate the Service, authorized ExactPour personnel may access your data on a need-to-know, least-privilege basis, for example, to provide support you request, investigate a security or fraud concern, diagnose and fix a technical problem, or comply with law. This access is limited to what is necessary, is subject to confidentiality obligations, and administrative access is logged for accountability.

Your data is protected with security measures described in Section 9, including encryption in transit and database-enforced isolation so that one customer cannot access another customer's data. If a confirmed security incident affects your data, we will notify you as described in Section 9. You remain the owner of the data you put into the Service.

4. How We Share Information

We do not sell personal information. We share it only:

  • With subprocessors, vetted service providers that host and support the Service. We maintain a public list at exactpour.com/legal/subprocessors describing each subprocessor, its purpose, the categories of data involved, and the regions where processing occurs. We will provide at least thirty (30) days' advance notice of material additions to that list (via the public page and, where practical, by email to subscribed customers). If you have a signed Data Processing Agreement and you object to a new subprocessor on legitimate data-protection grounds, you may contact support@exactpour.com within that notice period; if we cannot accommodate a valid objection, you may terminate the affected subscription without penalty.
  • With integrations you enable, third parties you connect, at your direction (e.g., POS providers, barcode data providers, AI providers).
  • For legal reasons, to comply with law, respond to lawful requests, or protect rights, safety, and security (see Section 5 for how we handle government demands).
  • In a business transfer, in connection with a merger, acquisition, or sale of assets, subject to this policy.

5. Law Enforcement and Government Requests

We may receive requests from law enforcement, regulators, or other government authorities for customer or user data. Our commitments:

  • Legal validity review. We review every request to confirm it is legally valid, properly served, appropriately scoped, and supported by the legal process required for the data sought (for example, a subpoena, court order, or warrant). We reject or challenge requests we believe are overbroad, improper, or legally insufficient.
  • Notice before disclosure. Unless we are legally prohibited from doing so (for example, by a valid non-disclosure order or sealed process), or an emergency involves imminent risk of death or serious physical harm, we will notify the affected customer or user before disclosing their data, so they have an opportunity to seek legal protection.
  • Minimum disclosure. We disclose only the specific data we are legally required to produce, narrowly interpreted.
  • Processor role. Where we hold data as a processor on behalf of a business customer, we will refer the requester to that customer (the data controller) unless legally prohibited, and we will cooperate with the customer's lawful instructions.
  • No backdoors or bulk access. We do not provide any government with direct, unfettered, or bulk access to customer systems or data, and we do not build or maintain encryption backdoors.

6. AI and Automated Features

We offer optional AI-powered features, including invoice and document extraction (including an optional OCR layout prepass), forecasting, variance and anomaly detection, ordering recommendations, insights, conversational agents, narrated reports, and automated data enrichment or verification (e.g., product catalog or UPC-related processing).

Data use and training. Data submitted to these features (such as uploaded invoices, prompts, chat messages, or operational aggregates) is processed solely to deliver results to you. We do not use Customer Data or personal information to train or fine-tune foundation models. Any third-party AI subprocessors we use are contractually required to process your data only for the specific feature and are prohibited from using it to train or improve their models. ExactPour does not allow a model provider to train on Customer Data unless the customer authorizes that feature in writing.

Where processing occurs. Some AI processing may occur using local or self-hosted models; other features may route data to vetted cloud AI providers identified on our Subprocessors list (currently including Anthropic and, for certain invoice OCR flows, Mistral). AI outputs are assistive and informational. They do not constitute legal, tax, accounting, or other professional advice.

Automated decision-making. We do not engage in solely automated decision-making or profiling that produces legal or similarly significant effects on individuals. AI features provide recommendations and insights that you control and verify. You remain responsible for reviewing and verifying all AI-generated results before acting on them.

Control. Certain AI insight features can be disabled at the account level (for example, AI insights opt-in). Invoice OCR and similar document features process files you upload to deliver the extraction you requested. For more details, see our documentation or contact support@exactpour.com.

7. Mobile Applications

Our native mobile applications (including barcode-scanning and operator apps) process data as follows:

  • Camera, used to decode barcodes in real time for inventory counts. Live camera frames are processed on-device for barcode recognition; we transmit the barcode value (and related inventory metadata you confirm), not a continuous video stream. Optional photos (for example, waste or invoice images) are processed only when you capture or select them for a feature that uses them.
  • Photo library, used only when you choose an image to attach (for example, waste documentation or invoice upload in supported flows).
  • Biometrics (Face ID / Touch ID / device biometrics), optional app unlock. ExactPour never receives or stores biometric templates; the operating system performs the check. We store only your preference to require biometric unlock.
  • Push notifications, with your permission, we store a device push token to deliver operational alerts. You can disable push in the app or in system settings.
  • On-device storage, encrypted session credentials (Keychain/Keystore-backed encryption keys), offline scan queues, and product/session caches so counting can continue without connectivity. These are cleared or become inaccessible when you sign out, subject to ordinary device backups you control.
  • Crash reporting and product analytics, as described in Sections 1 and 4 and listed on our Subprocessors page (e.g., Sentry, PostHog). We do not use mobile advertising identifiers for cross-app tracking, and we do not request App Tracking Transparency for cross-app advertising.

Device permissions can be revoked in your OS settings; doing so may disable related features.

8. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service, then delete or anonymize it within a commercially reasonable period.

Customer Data (including inventory, sales, and operational data we process on behalf of business customers) is retained for the duration of the active subscription and for up to thirty (30) days thereafter to allow data export, after which it is deleted or anonymized in accordance with Section 13.4 of our Terms of Service, except where longer retention is required for legal, tax, security, audit, or backup purposes.

Additional retention notes:

  • Uploaded invoices, subject to a configurable retention window (platform default ninety (90) days, adjustable within documented bounds), after which files are garbage-collected.
  • Audit and security logs, typically retained up to twenty-four (24) months to support integrity, fraud prevention, and compliance, then purged on a rolling schedule.
  • Consent records, retained for the life of the account and as needed to demonstrate compliance.
  • Push tokens, retained while the device remains registered and removed or overwritten when you disable push, re-register, or your user/account is deleted or anonymized.
  • Backups, follow a rolling purge cycle and may temporarily retain deleted data until the next purge.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit, platform encryption of data at rest, database-enforced Row Level Security for multi-tenant isolation (so customers cannot access one another's data), encrypted storage of integration secrets (Vault), role-based access controls, least-privilege administrative access, and append-only audit logging. Mobile session secrets are encrypted on-device. While we work hard to protect your information, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Security Incident Notification. In the event of a confirmed security incident that compromises personal information we process as a controller, we will notify affected individuals without undue delay and as required by applicable law (including Florida law, which generally requires notice as soon as practicable and no later than thirty (30) days after determination of the breach in most cases, see Fla. Stat. § 501.171, and GDPR, where applicable). We will also notify relevant supervisory authorities where required. For personal data we process as a processor on behalf of a business customer, we will notify that customer without undue delay after becoming aware of the incident, consistent with our Data Processing Agreement and, where feasible, within seventy-two (72) hours of confirmation as described in the Terms of Service. Notice will include, to the extent known and appropriate, a description of the incident, the categories of data affected, and the steps taken or planned to address it.

10. Your Rights and Choices

If you are in the United States, including California and Florida, start with the rights in this section and the California paragraph below. If you are in the EEA or the UK, the GDPR also applies as described here.

Depending on your location, you may have the right to access, correct, delete, port, or restrict processing of your personal information, and to object to certain processing or withdraw consent. To exercise these rights, contact support@exactpour.com or use your in-app account settings where available:

  • Account owners may download an account data export and delete the account from Settings.
  • Non-owner users may delete their own user profile from Settings.
  • Marketing opt-out is available via unsubscribe links and account preferences.

We will respond within the timeframes required by applicable law (generally thirty (30) days under the GDPR and forty-five (45) days under the CCPA/CPRA, extendable as permitted by law). If we process data as a processor for a business customer, we will refer your request to that customer. We will not discriminate against you for exercising your rights.

California (CCPA/CPRA). California residents have rights to know, delete, correct, and opt out of "sharing"/"selling" of personal information. We do not sell personal information. Limited advertising measurement on our marketing website (Google Signals and, where enabled, Meta) is described in Section 12. Choosing "Essential only" on the cookie banner is how you refuse that measurement, including sharing for cross-context advertising measurement. You may also exercise rights via support@exactpour.com.

EEA/UK. You may lodge a complaint with your supervisory authority.

11. Communications, Marketing, and Opt-Out

We send two kinds of messages:

  • Service and transactional messages, account, security, billing, legal/policy updates, password reset, invites, and support or technical notices related to your use of the Service (including optional AI report digests you enable). These are necessary to provide the Service (or a feature you turned on) and are not promotional. You cannot opt out of essential service/transactional messages while you maintain an account (other than by closing your account or disabling the specific digest feature).
  • Marketing and product communications, product news, tips, feature announcements, and occasional promotional offers. We send these only where permitted by law and, where required, based on your opt-in consent (for example, a checkbox you select at signup or in your settings). You may opt out at any time by clicking the "unsubscribe" link in any marketing email or by emailing support@exactpour.com. Opting out of marketing does not stop essential service/transactional messages.

Our anti-spam commitment. We comply with applicable anti-spam laws, including the U.S. CAN-SPAM Act and, where applicable, Canada's CASL. We do not send unsolicited bulk email ("spam"); we accurately identify ourselves and the nature of each message; every marketing email includes a clear way to unsubscribe; and we honor opt-out requests promptly. We never sell or rent your contact information to third parties for their own marketing.

12. Advertising Measurement and Google Signals

We do not sell personal information and we do not run third-party behavioral advertising networks inside the authenticated product.

On the marketing website, when you choose Accept all on our cookie banner, we may enable Google Analytics advertising features, Google Signals, and the Meta pixel (for example, ad storage, ad user data, and ad personalization under Consent Mode v2) to measure campaign performance. You can refuse these features by choosing Essential only, by adjusting cookie preferences where available, or by using the Google Analytics Opt-out Browser Add-on. See our Cookie Policy for details.

We do not use the mobile apps for cross-app advertising tracking, and we do not request App Tracking Transparency for that purpose.

13. International Transfers

We may process and store information in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers, such as Standard Contractual Clauses and the EU-U.S. Data Privacy Framework where applicable. Specific transfer mechanisms for each subprocessor are noted on our Subprocessors list where relevant.

14. Children's Privacy

The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal information from children.

15. Changes to This Policy

We may update this policy from time to time. Material changes will be notified through the Service (e.g., in-app) or by email, and the "Last updated" date will change. Where consent is required, we will request your acceptance. Continued use after the effective date constitutes acceptance where permitted by law.

16. Contact Us

ExactPour LLC, Privacy Team
Email: support@exactpour.com
Security: security@exactpour.com
exactpour.com

Privacy inquiries and formal CCPA/GDPR requests may also be directed to our registered agent in Florida. To request the current registered-agent name and address, email support@exactpour.com.