PantryPOSData Processing Addendum
A food pantry holds some of the most sensitive information a person ever hands over: where they live, who is in their household, what they cannot afford, and the fact that they needed help. This document sets out what we do with that information, and what we will never do with it.
In one paragraph: the client data in your PantryPOS account is yours. You decide what goes in and why. We hold it, keep it isolated from every other organization, secure it, back it up, and act on your instructions. We do not sell it, mine it, train models on it, or contact the people in it. When you leave, we give it back — and we delete it when you tell us to, not on a timer, because the records you keep here are ones a federal programme may require you to hold for three years.
Contents
1. Roles
For personal data about the households your pantry serves, your organization is the controller and PantryPOS is the processor. You decide what is collected, why, and for how long. We act only on your documented instructions.
PantryPOS is a trading name. The operator’s full legal name and registered address are stated on every invoice we issue, and are available on request before you sign up — email us and we will send them. We would rather you had them than not, and you are entitled to know who you are contracting with.
For personal data about your own staff’s use of our service — account details, sign-in records — we are the controller, and our Privacy Policy applies.
2. Scope of processing
| Item | Detail |
|---|---|
| Subject matter | Providing hosted food-pantry management software |
| Duration | For as long as your account is active, plus the deletion windows in section 9 |
| Nature and purpose | Storing, organising, retrieving, exporting and deleting records so you can run distributions, keep food-safety records, and report to your funders and commodity programs |
| Categories of data subject | Pantry clients and the members of their households; volunteers; donors; referral contacts |
| Categories of personal data | Names, contact details, addresses, dates of birth, household composition, identifiers you assign, visit and distribution history, dietary and allergy notes, documents you upload, pickup signatures |
| Special-category / sensitive data | Where you choose to record it: demographic data such as race and ethnicity (commonly required by USDA commodity programs), income self-certification, and health-related dietary needs |
Collect less where you can. The product lets you record demographic and income fields because programs like TEFAP ask for them. It does not require you to. If a field is not needed for a program you actually report to, turning it off is the strongest privacy measure available to you — stronger than anything we can do downstream.
3. Our instructions
We process client personal data only:
- to provide, maintain and secure the service for you;
- as instructed by your authorised users through the product;
- as instructed by you in writing; or
- where law requires it — in which case we will tell you first unless legally prohibited.
We will not:
- sell, rent or licence your client data to anyone;
- use it for advertising or share it with advertising networks or data brokers;
- use it to train machine-learning or AI models;
- contact the people in your records for any purpose of our own;
- combine it with another customer’s data, or with data from any other source.
If we ever believe an instruction from you would breach data protection law, we will tell you and may pause that specific processing until it is resolved.
About the optional AI assistant
The product includes an optional assistant feature. Where it is enabled and a request requires it, the text of that request is sent to a third-party model provider to generate a response. We do not use it to train models, and we select providers whose API terms do not claim training rights over submitted content — but we will not assert on their behalf what happens inside their systems, because that is not something we can verify for you.
If you would rather no client data left our infrastructure for this purpose at all, the assistant can be switched off for your organization alone, from Admin → Settings or by asking us. It stays off until you turn it back on, and the rest of the product is unaffected.
4. Confidentiality
Access to production systems is limited to the small number of people who need it to operate the service, and each is bound by confidentiality obligations that survive the end of their engagement. We do not access your client records except where necessary to fix a fault or to answer a support request from you — and where practical, we will ask first.
5. Security measures
We maintain technical and organisational measures appropriate to the sensitivity of this data, including:
- Isolation between organizations enforced by the database itself, using PostgreSQL row-level security rather than an application filter somebody has to remember to add.
- Encryption in transit for all traffic, with HSTS.
- PINs stored using a memory-hard hashing algorithm, never in recoverable form.
- Optional two-factor authentication for administrator accounts.
- Per-account lockout and per-IP rate limiting on every sign-in surface.
- An audit log of changes, automatically scrubbed of secrets and personal data before writing.
- Error records scrubbed of emails, phone numbers and long identifiers before storage.
- Nightly encrypted off-site backups, with a written restore procedure.
- Role-based access within your account, so a volunteer at the check-in desk cannot bulk-export your client list.
Full detail is in the security overview.
6. Sub-processors
You give us general authorisation to use sub-processors for hosting, email delivery and encrypted off-site backup. Each is bound by written terms no less protective than this addendum.
We maintain a current list of sub-processors and will provide it on request. We will give you at least 30 days’ notice before adding or replacing one. If you reasonably object on data protection grounds, tell us within those 30 days and we will work to find an alternative; if we cannot, you may terminate the affected service without penalty and receive a refund of prepaid fees for the unused period.
7. Helping you answer data-subject requests
When a client asks you for a copy of their record, asks you to correct it, or asks you to erase it, you can do all three yourself inside the product. If a request needs more than the product offers, we will help you at no charge.
If a data subject contacts us directly, we will not respond on your behalf. We will pass the request to you promptly and tell the person we have done so.
8. Breach notification
If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any case within 72 hours of becoming aware, and we will tell you what we know at the time rather than waiting until we have a complete picture.
Our notice will describe the nature of the breach, the categories and approximate volume of data involved, the likely consequences, and the steps we are taking. We will support your own notification obligations.
9. Return and deletion
We do not delete your records on a timer, and that is deliberate. If you take part in TEFAP or another USDA commodity programme, what you keep in PantryPOS is very likely a record you must retain for three years: 7 CFR § 251.10 requires records “retained for a period of 3 years from the close of the Federal Fiscal Year to which they pertain, or longer if related to an audit or investigation in progress”, and it names precisely the fields this product holds — the name of the household member receiving USDA Foods, the number of persons in the household, and the basis for the eligibility determination. Federal award records carry a comparable three-year rule under 2 CFR § 200.334.
An earlier version of this addendum promised automatic deletion on a fixed schedule. Honouring it could have destroyed records you are legally required to produce at an audit. Deletion is now something you instruct, not something a clock does to you.
- You can export your data yourself, at any time, without asking us.
- On request at any time, we will provide a complete database export in a machine-readable format.
- After the agreement ends you keep export access for at least 60 days. We will extend that on request and will not shorten it.
- After that we move your organization to encrypted archive: out of the live system, unreachable by any sign-in, and not processed for any purpose.
- We delete on your documented instruction, within 30 days, and confirm in writing what was deleted and when. If the instruction covers data we believe you are still required to retain, we will tell you once — and then do as you say. The retention decision is yours.
- Absent any instruction, we keep the archive for at least three years and six months after the agreement ends, so the federal retention period can run, and contact you before removing anything.
- Deletion propagates out of encrypted backups within a further 90 days as they rotate.
- We will not withhold your data to secure payment of a disputed invoice.
10. Audit and assurance
On reasonable notice, and no more than once a year unless a regulator or a breach requires otherwise, we will provide the information reasonably necessary to demonstrate our compliance with this addendum and will respond to a security questionnaire.
We do not currently hold SOC 2 or ISO 27001 certification. We would rather tell you that plainly than imply an assurance we cannot evidence. What we can offer is a direct conversation with the people who build and operate the system.
11. Where the data actually is
Live systems: the United States. The application and its database run on our own infrastructure in the US. Day-to-day, your records do not leave the country.
Encrypted off-site backups: not the United States. Our off-site backup provider operates facilities in New Zealand, Canada and Europe. We are telling you this plainly because an earlier version of this page said data was stored in the US full stop, which was true of the live system and wrong about the backups.
What makes that acceptable rather than alarming: backups are encrypted by us, on our own machines, before they are transmitted. The provider stores ciphertext and does not hold the key, so it cannot read your records, produce them to anybody, or lose them in readable form. It is storage, not access. New Zealand is also a jurisdiction the European Commission has recognised as providing an adequate level of data protection.
If your funder, board or insurer requires that backups never leave the United States, tell us — we can move your organization’s backups to a US-only arrangement. Ask before you rely on it, not after.
12. Washington health-data law (and why it probably applies to you)
Washington’s My Health My Data Act (chapter 19.373 RCW) defines “consumer health data” unusually broadly. It reaches information about a person’s diet, allergies and health conditions — and PantryPOS records exactly that, because a pantry has to know that a household cannot eat peanuts or needs diabetic-appropriate food.
We would rather you learned this from us than from a demand letter.
Who is on the hook for what
| Data | Position |
|---|---|
| Your clients’ dietary and health notes | You decide what to collect and why, so you are likely the “regulated entity”. We process it for you under this addendum. |
| Your own staff’s account data | The Act excludes people “acting in an employment context” from the definition of a consumer, so your staff logins are not consumer health data. |
| If you are a government agency or a tribal nation | The Act excludes those bodies, and service providers processing on their behalf, from “regulated entity”. Most independent nonprofit pantries are not covered by that exclusion — do not assume it applies to you. |
Two things you should actually do
-
Publish a consumer health data privacy policy, linked from your homepage. The Act requires
a regulated entity to prominently publish one, disclosing what health data is collected and why,
where it comes from, what is shared and with whom, and how someone exercises their rights.
PantryPOS already gives you a place to do this: your own public privacy page, editable in
Admin → Settings and served at
/privacyon your pantry’s address. It is yours to word; we do not write it for you, because we do not decide what you collect. - Collect less. The strongest compliance measure available to you is not recording a dietary note you do not actually use. Every field you leave empty is one you never have to disclose, secure, produce or delete.
Why this is worth ten minutes of your time. A violation of the Act is a per se violation of the Washington Consumer Protection Act (chapter 19.86 RCW), which carries a private right of action — an individual can sue without waiting for the Attorney General, and can recover actual damages, trebled up to $25,000, plus attorney’s fees. This is not a filing-cabinet regulation.
What we commit to as your processor
- We process consumer health data only on your instructions and only to provide the service, as section 3 already says.
- We do not sell it. The Act treats a “sale” of consumer health data as requiring a signed authorisation; we simply never do it, so the question does not arise.
- We do not use it for advertising, profiling or model training.
- We will support you in responding to a consumer’s request to access or delete their health data, at no charge.
- The AI assistant, which is the one feature that sends text outside our infrastructure, can be switched off for your organization alone — see section 3.
We are not your lawyers and this is not legal advice. It is a vendor telling a customer where the sharp edge is, which is the least we owe you.
13. Getting this signed
This addendum applies automatically as part of the Terms of Service. If your board, funder or insurer needs a countersigned copy, email dale.weaver@0xpi.com and we will sign and return one — at no charge and without making it an ordeal.