Privacy Policy
This policy explains how JFM Incorporated ("JFM", "we", "us") handles information in MarginHeat: the reporting service at marginheat.ai and the MarginHeat apps for iPhone and Android (together, "MarginHeat").
1. Information we collect
- Account information. Your work email address, a user ID, the account type and sites your administrator assigns to you, and whether your account is enabled.
- Sign-in and security records. One-time sign-in codes we email to you (valid for 10 minutes), records of your sessions (when you signed in, when you last used MarginHeat, and whether you signed in from the app), and an access history of account changes, sign-outs and app sign-ins.
- Site Support visits. If your account uses Site Support: checklist answers, notes, follow-up owners and due dates, and the photos you add to a visit. Completed visit reports are emailed to the accounts assigned to that location.
- Ask Cayenne (sign-in page). Questions you type into Ask Cayenne before signing in. We send each question, with the earlier questions and answers in that conversation, to our AI provider to produce an answer from public information about Creole Fried Chicken and MarginHeat. We don't keep a copy of the question or the answer. To limit misuse we count questions per network, using a one-way hash of the network address, never the address itself.
- Data Analytics help. Questions you type into Data Analytics help. We send each question, with the report figures your account can see, to our AI provider to produce an answer. We don't keep a copy of the question or the answer.
- Demo requests. If you ask for a demo: your name, work email, company, phone number (optional), number of sites and message.
- Technical information. Our hosting providers log requests to MarginHeat, including IP address, device and browser type and time, to keep the service secure and working. The apps don't use advertising identifiers or third-party analytics, and we don't track you across other companies' apps or websites.
MarginHeat also shows business reporting data, such as estimated sales, purchases, invoices, out-of-stocks and credits for restaurant sites. That information describes sites, not you, and comes from operator workbooks and supplier invoices.
2. What stays on your device
If you turn on Face ID, Touch ID or fingerprint unlock in the app, the app keeps a sign-in token in your device's secure keychain (iPhone) or keystore (Android), protected by your device's biometric check, so it can reopen without a new emailed code. Your device checks your face or fingerprint; neither the app nor MarginHeat ever receives biometric data. The token isn't backed up or moved to another device, and it's deleted when you sign out, turn unlock off, remove your device's screen lock or change its enrolled face or fingerprints (you then sign in again with a code). App sessions end after 30 days, or after 14 days without use.
3. How we use information
- To sign you in, confirm who you are and show only the sites your account is allowed to see.
- To operate, secure and support MarginHeat, including investigating problems and keeping the access history.
- To record Site Support visits and deliver their reports.
- To answer Data Analytics help and Ask Cayenne questions.
- To respond to demo requests and support messages.
We don't sell personal information, share it for cross-context behavioral advertising, or use it for advertising of any kind.
4. Service providers
These companies operate parts of MarginHeat for us and may process information only to provide their service:
- Supabase: database, sign-in and private photo storage.
- Vercel: hosting for marginheat.ai.
- Resend: delivery of sign-in codes and Site Support emails.
- Google Cloud: storage and processing of reporting data (Google Sheets and BigQuery).
- Anthropic: AI processing for Data Analytics help and Ask Cayenne.
- Apple and Google: app distribution, plus the Face ID and fingerprint checks that run on your device.
We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or as part of a sale or reorganization of the business.
5. How long we keep information
- Account information: while your account exists.
- Session records and access history: as long as needed for security and auditing.
- Site Support records and photos: as long as the CFC field operations program needs them.
- Demo requests: until we've responded, and a reasonable time after.
- Sign-in codes: they expire after 10 minutes.
6. Your choices and rights
- Access, correction or deletion. Email support@creolefried.com from the email address on your account.
- Delete your account. Follow the steps on our support page. We confirm the request and delete the account within 30 days. We may keep records the law requires or allows us to keep, such as security logs, and Site Support records that belong to your organization's operations.
- App unlock. Turn it off at any time under More → Unlock with Face ID (or fingerprint), or sign out.
Depending on where you live, you may have more rights under local law. Contact us to use them.
7. Security
Sign-in uses one-time emailed codes. Our servers check your permissions on every request, information travels over encrypted connections, and the app keeps its sign-in token only in your device's secure storage. No system is perfectly secure. If you think your account has been misused, tell us right away at support@creolefried.com.
8. Children
MarginHeat is a business service for adults. It isn't directed to children, and we don't knowingly collect information from children under 16.
9. Changes to this policy
When our practices change, we'll update this policy and the date at the top. We'll point out significant changes in the app or on marginheat.ai.
10. Contact
JFM Incorporated
support@creolefried.com