PantryPOSPrivacy Policy
Which policy do you need?
This page covers what we collect about pantry staff and prospective customers who use pantrypos.0xpi.com — the people who run pantries.
If you are a guest or client of a food pantry and you want to know what that pantry does with your information, that is the pantry’s own policy, not ours. Each pantry publishes it at their own welcome page, and they — not us — decide what is collected. We hold it on their behalf under the Data Processing Addendum.
Contents
1. Two very different roles
PantryPOS handles personal data in two distinct capacities, and it matters which one applies:
| Whose data | Our role | Governed by |
|---|---|---|
| Pantry staff and prospects — the people who sign up for and use our service | We are the controller. We decide what to collect and why. | This policy |
| Pantry clients and guests — the households a pantry serves | We are the processor. The pantry decides; we only hold and process on their instructions. | Data Processing Addendum and the pantry’s own privacy notice |
2. What we collect about you
When you start a trial or hold an account
- Your name, work email address and the username you choose.
- Your organization’s name and its locations.
- A cryptographic hash of your PIN. We never store the PIN itself and cannot recover it.
- If you enable two-factor authentication, the secret needed to verify your codes.
- The IP address you signed up from, and the date and time.
Automatically, while you use the service
- Sign-in times, failed sign-in attempts and account lockouts — needed to stop brute-force attacks.
- An audit log of changes made in the product, recording which user did what and when. This log is automatically stripped of PINs, API keys, tokens and personal data before it is written.
- Server error records. Free text in these is automatically scrubbed of email addresses, phone numbers and long numeric strings before storage.
- Standard web-server logs (IP address, request path, timestamp, user agent).
When you contact us
- The content of your message and how to reply to you.
We do not collect payment card details. Subscriptions are invoiced, so no card data ever reaches our systems.
3. Why we collect it
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing the service and your account | Name, email, username, PIN hash, org details | Performance of a contract |
| Securing accounts against attack | Sign-in attempts, lockouts, IP addresses | Legitimate interest in security |
| Accountability inside your organization | Audit log | Legitimate interest; also a requirement of the programs pantries report to |
| Diagnosing faults | Error records, server logs | Legitimate interest in a working service |
| Billing and invoicing | Billing contact, plan, locations | Performance of a contract; legal obligation for tax records |
| Service announcements about your account | Email address | Performance of a contract |
| Understanding which pages of our public site are useful | Aggregate analytics (see below) | Legitimate interest |
We do not send marketing email to people who have not asked for it, and we do not add trial signups to a marketing list. Emails we send about your account — trial reminders, invoices, security notices — are part of providing the service.
4. Analytics and cookies
Our public pages use Umami, a privacy-focused analytics tool that we host ourselves on our own infrastructure. It records page views and referrers in aggregate. It does not set advertising cookies, does not fingerprint you across sites, and the data never leaves our servers or goes to a third-party advertising network.
The signed-in application sets one cookie: a session cookie that keeps you logged in. It is
HttpOnly, marked Secure over HTTPS, and cryptographically signed. It is
strictly necessary for the service to work and is not used for tracking. It expires when your
session ends.
5. Who we share it with
We do not sell personal data. We share it only with:
- Our hosting and infrastructure providers, who store the data at rest on our behalf under contract.
- Our email delivery provider, to send account and notification email.
- An off-site encrypted backup provider, which holds backups it cannot read.
- Law enforcement or regulators, where we are legally required to. If we receive such a demand for a customer’s data we will notify that customer unless we are legally prohibited from doing so.
Live systems are in the United States. Encrypted off-site backups are held by a provider with facilities in New Zealand, Canada and Europe — they are encrypted on our own machines before transmission, so that provider stores ciphertext it cannot read. An earlier version of this page said simply “the United States”, which was right about the live system and wrong about the backups. Detail in the DPA.
6. How long we keep it
| What | Kept for |
|---|---|
| Your account details | While your organization is a customer |
| Organization data after the agreement ends | Exportable for at least 60 days, then held in encrypted archive. Deleted on the organization’s written instruction, not on a timer — because TEFAP records carry a three-year federal retention duty (7 CFR 251.10). Absent instruction, kept at least 3 years 6 months. See the DPA. |
| Audit log | Kept with the organization’s records and removed at the same time they are — it evidences who changed what, which is part of what an audit asks for |
| Error records and server logs | Rotated regularly; not retained long-term |
| Invoices and billing records | As long as tax law requires |
| Support correspondence | Up to 2 years |
7. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct it if it is wrong — most of it you can edit yourself in your account;
- ask us to delete it;
- receive it in a portable format;
- object to processing based on legitimate interests;
- complain to your data protection authority.
Email dale.weaver@0xpi.com and we will respond within 30 days. We will not charge you for a reasonable request and we will not make it difficult.
If you are a pantry client asking about your own records, contact the pantry directly — they control that data. If you contact us instead, we will pass your request to them and tell you we have done so.
8. How we protect it
Encryption in transit with HSTS, PIN hashing with a memory-hard algorithm, optional two-factor authentication, per-account lockout, per-IP rate limiting, database-enforced isolation between organizations, an automatically scrubbed audit log, and nightly encrypted off-site backups. The full picture is on our security overview.
If a breach affects your personal data, we will notify you and any relevant authority without undue delay, and tell you what we know even while we are still working it out.
Concretely: Washington law (RCW 19.255.010) requires notice to affected Washington residents in the most expedient time possible and no more than 30 calendar days after discovery, and notice to the Washington Attorney General as well where more than 500 Washington residents are affected. We treat 30 days as a ceiling, not a target. Where we are the processor for a pantry’s client records, we notify that pantry within 72 hours of becoming aware, so they have time to meet their own deadline — see the DPA.
9. Washington health-data law
Washington’s My Health My Data Act (chapter 19.373 RCW) covers information about diet, allergies and health conditions. For you as a pantry staff member, it largely does not bite: the Act excludes people “acting in an employment context” from its definition of a consumer, and your account with us is exactly that.
For the households your pantry serves, it may well bite — and the obligation is your organization’s, not ours, because your organization decides what to record. We have set out what that means, and the two practical steps, in section 12 of the Data Processing Addendum. Please read it.
10. Children
Our service is for pantry staff and volunteers, and is not directed at children. We do not knowingly collect data directly from children through our website or accounts.
Pantry client records held on a pantry’s behalf may include children as household members. That data is the pantry’s to control, and is covered by the Data Processing Addendum.
11. Changes and contact
If we change this policy materially we will email account holders at least 30 days before it takes effect. The version and date at the top always reflect the current text.
Privacy questions, requests or complaints: dale.weaver@0xpi.com. A postal address for formal notices is available on request.
PantryPOS is a trading name. The operator’s full legal name and registered address are stated on every invoice we issue, and are available on request before you sign up — email us and we will send them. We would rather you had them than not, and you are entitled to know who you are contracting with.