Privacy policy

What we keep

• Your account: your name, your email address, your role and what you can reach at your company, and the location you last picked in the sidebar, so it follows you to any device. Your password is handled by our sign-in service, and we cannot read it.
• What your company adds: its name and contact details, recipes, prep, products, prices, menus, locations, counts and photos. Recipe photos are kept at web addresses that are not secret, so anyone given one of those addresses could open that photo.
• Who did what: a record of every change anyone makes, with their name and the time, and of each sign-in, wrong password tried on an account, sign-out, new password and file downloaded. A sign-in or download also keeps the browser and device, such as Chrome on a Mac, and the rough place it came from, such as Irvine, CA, read from the connection. We do not keep the network address itself, a password or what anyone asked the AI. Nobody can change this record. A year of it stays in the app, and each older month goes to your company's own Google Drive as one file, and only then leaves the app. Your company's Admins see all of it, and you see your own sign-ins and downloads under Profile.
• Your training: how you did on each Training quiz and program, and the drinks a manager signed off for you, so it follows you to any device. You see your own. Your company's Admins can see everyone's quiz results, and its Managers, Editors and Admins can see everyone's program phases and sign-offs.
• Drinks you pitch: a drink you pitch for a concept's menu in Training, with your name on it: its name, flavors, idea and rough spec, the drink it would replace, and once it is invited to a tasting, its full spec. Only you see a draft. Once you pitch it, the Managers, Editors and Admins at that location see it too, with your name, and their notes back to you are kept with it. At its tasting, each taster's scores and notes are kept with their name, and only the tasters see them, never the person who pitched it. You can delete a draft, or a pitch sent back with notes, at any time.
• R&D projects: a dish or a drink your company is developing, with its brief, its stage and the names of the people on its team, and its working recipe, with a history of every change to it and the name of whoever made each one. Your company's Admins, and its Editors on that side, see every project. Anyone added to a project sees that one, with the names of the others on it. While you have a project open, your browser is told when someone else changes its recipe, so your page can show it. That signal says only that something changed, never what. The others on the project also see that you are there, and which box of the recipe you are in. That is not kept anywhere, and is gone when you leave the page. When someone logs a trial, the recipe as it stood is kept with their name, what they were trying and any notes on how it went, for the same people to read. A photo added to a trial is kept with the name of whoever added it, at a web address like a recipe photo's. A tasting score on a trial is kept with the name of whoever gave it, and the others on the project see it once their own is in. What you write in a project's Talk is kept with your name, for everyone on that project to read, until you take it back. A tick on a project's checklist is kept with the name of whoever ticked it.
• Interview checks: when a manager runs one for a job candidate, the candidate's name, their score and the manager's notes. The candidate needs no account. Only the company's Managers, Editors and Admins can see it, and it is erased a year after the interview, or sooner if they take it away.
• What your company deletes: it goes to the company's Trash, and is erased for good 30 days later, or sooner if an Admin erases it. A recipe that was on a menu, and prep or ingredients that an older recipe still uses, stay in the Trash so menus and History still make sense. Photo files nothing uses any more, such as those of what was erased or a photo someone replaced, are removed from storage the next night.
• A record of changes: who changed what, and when. It cannot be edited, so it stays even after something is removed.
• Errors: when something in the app fails for you, such as a part that cannot be shown or a page the server could not make, a note of it, kept with your account: when it happened, which page and which part, your company and your role, the kind of browser, and the error's own words, which the app writes. Never anything you typed. We read these to fix the app. Nobody at your company or any other can see them, and each is erased 90 days after it last happened.
• In your browser: small cookies and browser storage that keep you signed in and remember your chosen look, your chosen location and what you opened lately. We use no advertising or tracking cookies.

How we use it

Only to run the app for your company. We do not sell it, and we do not use it for advertising. People at your company see it according to what an Admin allows. We look at it only when we need to, to run or fix the app.

Who else handles it

• Supabase stores the database and photos, handles sign-in, and sends sign-in emails.
• Vercel hosts the app, and measures how quickly its pages load, by kind of page. That uses no cookie and keeps nothing that names you. It also keeps a ready copy of lists that read the same for everyone at a company, such as classics, so pages open faster, and throws it away when someone saves a change.
• Anthropic, only if your company's Admin turns on Ask AI and connects an AI account. What you ask, and what the AI looks up for you, goes to Anthropic under your company's own account. So does a drink's recipe when someone presses Suggest while editing it, with a few of the company's own menu lines to show the style. We keep no record of the conversation or the suggestion, only a count of questions.
• Google, only if your company's Admin connects Google Drive, as below.

Google Drive

An Admin can connect a Google Drive, so a copy of the company's Excel files is kept there.

• What it can reach: only the files and folders Ametrine made itself, and the one folder an Admin picks for them to go in, in Google's own window. It does not look at anything else in that folder, and it cannot see anything else in that Drive.
• What it reads: the email address of the Google account, to show Admins which one is connected, and the details of its own files and folders.
• What it does: makes a Ametrine folder, moves it if an Admin picks a different place for it, puts the Excel files in it, replaces a file when a new version is published, and moves a file to the Drive's trash when its recipe goes to the Trash here. It never erases anything.
• How it is kept: what Google gives us to connect is locked before it is stored, can only be opened by our server, and never reaches a browser. While an Admin picks a folder, Google's window uses a short lived pass in that Admin's browser, which we do not store.
• Who gets it: it is only stored with the services named above. We do not sell or share information from Google, we do not use it for advertising, and we do not use it to train AI.

Ametrine's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

An Admin can press Disconnect in Settings, under Excel backup, which deletes the key we hold, so we can no longer reach the Drive. To also cancel the permission itself, whoever owns the Drive can remove Ametrine from their Google Account. Files already in the Drive stay there.

Seeing, changing or removing your information

You can change your name and password in Settings. To see, correct or remove anything else we keep about you, write to admin@gem15.app. Your company's information stays until your company asks us to remove it, so we may need to check with its Admin first.

Changes

If this changes, we will update this page and the date at the top.