Privacy policy

1. Who we are and what this policy covers

ApFoodz LLC (“ApFoodz,” “we,” “us,” or “our”), which operates the APFoods platform at apfoodz.com, provides software for foodservice distribution: order management, inventory and warehouse operations, delivery routing, and financial record-keeping. This policy applies to the websites, web portals, mobile applications (including our warehouse application), and related services that link to it (together, the “Service”).

Our two roles. Much of the data on the Service belongs to our business customers: the distributors and food businesses that use APFoods to run their operations. When we handle that data on their behalf and under their instructions, they are the controller of it and we act as their processor (service provider), and their own privacy notices govern how they treat it. When we decide how and why to handle information for our own purposes, such as to operate, secure, and improve the Service or to manage our own account holders, we act as a controller and this policy applies directly.

The Service is intended for business and professional use. It is not directed to consumers for personal, family, or household purposes.

2. Information we collect

Information you or your organization provide

• Account and identity data: name, work email, phone number, job role, warehouse or location assignment, and the credentials used to sign in (including a staff ID and PIN where your organization uses ID-based login).
• Business records you enter: customer and supplier profiles, product and catalog data, orders, invoices, purchase orders, inventory and lot records, delivery routes, and related notes and attachments.
• Payment and financial data: bank and remittance details, invoice and settlement records, and payment references. Where your organization enables online invoice payments, card and bank-account credentials are collected and processed by our payment processors, not stored by APFoods.
• Communications: messages, support requests, and feedback you send us, and records of orders or inquiries submitted through channels your organization enables.

Information we collect automatically

• Device and log data: IP address, browser and device type, operating system, app version, identifiers, time zone, and the pages or actions you take on the Service, kept in server and security logs.
• Warehouse-app data: with your permission, our mobile application uses the device camera to scan barcodes for picking and receiving, and network state to sync work when connectivity returns. It may record the approximate facility a task is performed at for operational and food-safety traceability. It does not track your location in the background.
• Cookies: first-party cookies used to keep you signed in, remember preferences, and secure the Service (see Section 9). No third-party advertising cookies.

Mobile numbers & text messaging

If you choose to add a mobile number, we use it only to deliver the text messages you opted into: sign-in and password-reset codes and order and account notifications (sent by APFoods on behalf of the distributor you buy from, from the APFoods toll-free number, and identifying that distributor by name), and, only with a separate opt-in, occasional promotions sent by your distributor from their own business number. The APFoods toll-free number is never used for marketing. Text alerts are off by default and activate only after you verify your number with a texted code. Full program details, frequency, and opt-out instructions are on our SMS policy page.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are never shared with any third party. You can opt out at any time by replying STOP to any message or switching off text alerts in your notification settings.

Information from third parties

When your organization connects an outside account, such as an accounting system, we receive data from that provider as needed to run the integration (see Section 5). We may also receive information from fraud-prevention, security, and infrastructure vendors that help us protect the Service.

3. How we use information

• Provide the Service: process orders, inventory, deliveries, invoicing, and accounting; sync connected systems; and maintain records your organization relies on, including food-safety traceability of lots and shipments.
• Authenticate and secure: verify identity, apply role and warehouse permissions, detect and prevent fraud and abuse, and keep audit trails.
• Support and communicate: respond to requests, send service and transactional messages, and share administrative or security notices.
• Improve and develop: understand how the Service is used, fix problems, and build new features, using aggregated or de-identified data wherever practical.
• Comply and protect: meet legal, tax, and recordkeeping obligations, and establish, exercise, or defend legal claims.

Where required by law, we rely on a lawful basis for each use, typically performance of a contract, our legitimate interests in operating and securing the Service, your consent (for example, camera access on the mobile app), or compliance with a legal obligation.

4. How we share information

We do not sell personal information and we do not share it for cross-context behavioral advertising. We disclose information only as described here:

• Your organization: administrators and authorized users within your own business can access records according to their role and warehouse permissions.
• Service providers (subprocessors): vetted vendors that host, operate, secure, and support the Service under data-protection contracts, and only on our instructions: cloud hosting (Google Cloud), payment processing for invoice payments received (Stripe and NexCharge), email delivery (Google Workspace / Mailgun), and SMS delivery (Twilio).
• Integration partners: when you connect an outside system (such as QuickBooks Online for accounting), we exchange the data needed to keep the two systems in sync, only as you direct (see Section 5).
• Professional advisers: auditors, lawyers, and accountants, where reasonably necessary and under confidentiality obligations.
• Legal & safety: authorities or others where required by law, to enforce our terms, or to protect the rights, safety, and property of APFoods, our customers, or the public. We will comply with subpoenas and court orders, and we will tell you about it unless legally prohibited.
• Business transfers: a successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

5. Connected services and integrations

The Service lets your organization connect outside accounts so data can flow between systems. The primary example is QuickBooks Online. When you connect it, we sync your accounts-payable data to QuickBooks, specifically your vendor records, bills, bill payments, and the chart-of-accounts references you map. You manage and make bill payments in QuickBooks; APFoods does not move money on your behalf. We do not use data obtained from QuickBooks for any purpose other than running the integration you enabled.

• When you authorize a connection, we store the access tokens securely and use them only to provide the integration you enabled.
• We request only the access needed for that integration. You can disconnect at any time from your settings or by contacting us. On disconnect, we delete the stored access tokens. Bills, payments, and other records already in APFoods remain, because APFoods is your book of record.
• Information you send to a connected provider becomes subject to that provider’s own privacy policy and terms.

6. Data retention

We keep information for as long as your organization’s account is active and as needed to provide the Service. Because APFoods maintains financial, inventory, and food-safety records, some data is retained longer to meet accounting, tax, recall-traceability, and other legal obligations, and to resolve disputes and enforce agreements. Tenant accounting records are retained for 7 years to comply with tax law. When data is no longer needed, we delete it or de-identify it.

7. Security

We use technical and organizational measures designed to protect information: encryption in transit (TLS 1.2+) and at rest (AES-256), access controls scoped to a user’s role and warehouse, tenant isolation between customers, audit logging, MFA on production systems, and secure handling of credentials and integration tokens. Payment credentials are handled by our payment processor rather than stored by us. A SOC 2 audit is in progress; see our security page for details.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your information, we will notify affected parties and authorities as required by law. Please keep your login credentials and PIN confidential and notify us of any suspected unauthorized use.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain uses. You can also opt out of non-essential communications.

Exercising your rights. Where APFoods acts as a processor for your employer or another business, please direct your request to that organization, and we will assist them in responding. Where we act as a controller, contact us at admin@apfoodz.com and we will respond as required by law. We will not discriminate against you for exercising these rights.

United States (including California)

We do not sell personal information and do not share it for cross-context behavioral advertising. California and other U.S. state residents may request access to, correction of, or deletion of personal information, and may designate an authorized agent to act on their behalf. We verify requests before acting on them.

Europe, the UK, and similar regimes

If you are in the EEA, UK, or a comparable jurisdiction, you have the rights described above and may lodge a complaint with your local data-protection authority. Our lawful bases are set out in Section 3. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

9. Cookies and similar technologies

We use cookies and similar technologies that are necessary to sign you in and keep your session secure, to remember your preferences, and to understand and improve how the Service performs. We do not use advertising cookies. You can control cookies through your browser settings; blocking strictly necessary cookies may prevent parts of the Service, such as signing in, from working.

10. Children’s privacy

The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will delete it.

11. International data transfers

APFoods operates in the United States, and information we process may be stored and handled in the U.S. and other countries where we or our service providers operate. Where we transfer personal data across borders, we use appropriate safeguards required by law, such as standard contractual clauses, to protect it.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice through the Service or by email. Your continued use of the Service after an update means you accept the revised policy.

13. How to contact us

ApFoodz LLC is the data controller for the personal data described in this policy. Questions, requests, or complaints about this policy or your information: admin@apfoodz.com or apfoodz.com.