Privacy Policy

1About this policy

This policy explains what Skibble does with personal information. It covers three different situations, and which one you are in changes what applies to you.

• You are reading our website. Sections 4, 7, 11 and 12 are the ones that concern you.
• You run a food business that uses Skibble. All of this applies to you, and section 3 explains the responsibility you carry for your own customers' information.
• You bought something from a business that uses Skibble. Your information is held by that business. We hold it for them. Section 3 explains what that means and who to ask when you want something done about it.

We have written this in plain language on purpose. If anything here is unclear, ask us and we will explain it.

2Who we are

Skibble is a software company in Charlottetown, Prince Edward Island, Canada. We make software for independent food businesses in Canada and the United States.

For questions about this policy, about the information we hold, or to make a request or a complaint, write to hello@skibble.app. Mark it for the attention of the privacy officer and we will route it properly.

3The two roles we play

This is the most important section in this policy, so it comes early.

Information about the businesses that use Skibble

When a food business signs up, we decide what we collect and why. We are responsible for that information and you can hold us to this policy for it. That covers the people who run the business, the staff they invite, and the records of their account with us.

Information about that business's customers

When someone orders from a business through Skibble, the information they give belongs with that business. The business decides what to collect, what to do with it and how long to keep it. We hold and process it on their behalf and on their instructions, so that their storefront, orders, deliveries and messages work.

In practice that means if you want your information corrected or deleted, the business you ordered from is the right place to start, because it is their record and they control it. If you do not know who to ask, or you cannot reach them, write to us and we will help you find them and pass your request on.

We do not sell anyone's personal information. Several privacy laws define a sale as an exchange for money or for anything else of value, not only for cash, and we do not do it on either reading. We do not use a business's customer records to market to those people for ourselves, and we do not use them for targeted advertising.

4What we collect

If you visit our website

• Technical information your browser sends: your IP address, browser and device type, language, the pages you visited and when, and the site you came from.
• Anything you type into a form, such as a support message or a demo request.

If you run a business on Skibble

• Your name, email address, phone number, business name, business address and business details.
• Verification information required before you can take card payments. This can include your date of birth, a government identification number such as a Social Insurance Number or Social Security Number, a photograph of an identity document, and the names and ownership shares of the people who own or control the business. These are sensitive, we ask for them because the law and the card networks require it, and we do not use them for anything else.
• Your bank account or card details for payouts and for billing. These are collected and held by our payment provider, not by us. We see only enough to identify the account, such as the last four digits.
• Everything you put into the product: your menu, prices, photographs, orders, quotes, experiences, expenses, receipts you scan, customer records, messages and settings.
• Records of how you use Skibble: what you opened, what you changed and when, which we keep for security and support.

If you buy from a business that uses Skibble

• Your name, email address and phone number.
• Your delivery address, and the notes you give about access or where to leave an order.
• What you ordered, when, for how much, and whether it was collected or delivered.
• Dietary requirements or allergy information, if you give it. This can be sensitive, and it is used to fulfil your order.
• Payment information, which goes to our payment provider. We do not receive or store your full card number.
• Messages between you and the business, including messages sent through Instagram where the business has connected it.

5Why we use it

We use personal information to do the things you would expect:

• to run the product: storefronts, orders, quotes, tickets, deliveries and payments;
• to take payments and pay businesses out, and to bill our own fees;
• to verify a business's identity, meet anti-money-laundering and card network requirements, and prevent and investigate fraud;
• to answer support requests and tell people about problems with the service;
• to keep the service secure and to investigate abuse;
• to improve the product, by understanding which features are used and where people get stuck;
• to send service messages, and marketing to people who have agreed to receive it;
• to meet our legal, tax and accounting obligations.

We rely on consent where the law requires it, and otherwise on the need to perform our agreement with a business, on our legitimate interests in running and protecting the service, and on legal obligations. Where we rely on consent, you can withdraw it at any time, and we will tell you if that means we can no longer provide something.

6Cookies

Our website and the product use cookies and similar technologies. We use them for two things:

• Making it work. Keeping you signed in, remembering your region and your preferences, keeping a basket together, and security. These are necessary, and the site does not work properly without them.
• Understanding usage. Counting visits and seeing which pages are read, so we know what to improve.

You can block or delete cookies in your browser settings. If you block the necessary ones, parts of Skibble will stop working. A storefront run by a business may also set cookies under that business's own settings.

7Who we share it with

We do not sell personal information. We share it with the companies that help us run Skibble, only as far as they need it, and under contracts that require them to protect it and to use it only for the work we give them. These are the kinds of services we use.

We also share information where the law requires it, where we need to establish or defend a legal claim, or to prevent harm. If Skibble is ever sold or merges with another company, information may transfer as part of that, and we will tell you before it does.

A business that uses Skibble can connect other services to its own account. When it does, information flows to those services under their terms, and we do not control what they do with it.

8Where information is kept

Skibble is a Canadian company, but our systems run on Google Cloud in the United States. So although we are in Prince Edward Island, the information we hold about you is stored and processed in the United States, and some of the other services we use operate there and elsewhere too.

While information is in another country, it is subject to the laws of that country, and the courts, law enforcement and national security authorities there may be able to require access to it. That is true of any service that uses international infrastructure, and we are telling you plainly because Canadian privacy law expects us to.

Wherever it goes, we remain accountable for it. We use contracts that require a comparable level of protection from every company we send it to.

9How long we keep it

We keep personal information for as long as we need it for the purpose we collected it, and then for as long as the law requires.

• While an account is open, we keep the information in it so the product works.
• When an account closes, the business can export its data for thirty days. After that we delete or anonymise what we are not required to keep.
• Records of sales, payments, payouts and our own fees are kept for at least six years, because tax law requires it.
• Verification records are kept for as long as financial regulation requires.
• Backups are kept on a rolling cycle and are overwritten in the normal course, so deleted information can persist in a backup for a short time after it is gone from the live service.

A business using Skibble sets its own retention for its customer records within the product, and can delete them.

10How we protect it

Information is encrypted in transit and at rest. Access is limited to the people who need it to do their job, and it is logged. We do not store full card numbers anywhere. Payment details are handled by our payment provider under the payment card industry standards.

No service is perfectly secure, and we will not pretend otherwise. If something happens that creates a real risk of significant harm to someone, we will report it to the authorities the law requires us to report it to, and we will tell the people affected, and the businesses affected, as quickly as we reasonably can.

If you think you have found a security problem in Skibble, please tell us at hello@skibble.app before telling anyone else, and we will work with you.

11What you can ask us to do

Wherever you live, you can ask us to do any of the following, and we will do our best to help whether or not the law where you are requires it.

• Tell you what personal information we hold about you and why.
• Give you a copy of it.
• Correct it if it is wrong.
• Delete it, where we are not required to keep it.
• Stop sending you marketing.
• Withdraw a consent you gave us.
• Explain a decision we made about you that was made automatically.

Write to hello@skibble.app. We will confirm we have your request, ask for what we need to identify you, and respond within thirty days. If we need longer we will tell you why. We do not charge for this.

One important limit. If your request is about information held by a business that uses Skibble, for example because you ordered from them, we have to pass it to that business rather than act on it ourselves. It is their record. We will tell you who they are and make sure they get it.

If we say no

If we refuse a request, we will tell you why in writing. You can appeal that decision by replying to us and asking us to look again. We will reconsider it and write back within sixty days with our decision and our reasons. Appealing is as easy as making the request in the first place, and it costs nothing.

If you are still not satisfied after an appeal, you can take it to a regulator. In Canada that is the Office of the Privacy Commissioner of Canada, or your provincial privacy regulator. In Quebec it is the Commission d'acces a l'information, and Quebec law gives you additional rights, including about automated decisions and about information leaving the province. In the United States it is the attorney general of your state, and we will point you to the right office if you ask.

12Marketing messages

Messages from Skibble

We send service messages about your account, and those are not marketing. We only send marketing where you have agreed to it, and every marketing message has an unsubscribe link that works. Unsubscribing does not stop service messages.

Browser opt-out signals

If your browser sends an opt-out preference signal, such as Global Privacy Control, we treat it as a request to stop using your information for targeted advertising and to stop sharing it in any way that counts as a sale. We honour it wherever you are, not only where the law requires it, and it overrides any setting you have chosen with us. We will not make you enable it a second time to be taken seriously.

Messages from a business that uses Skibble

When a business sends you a campaign through Skibble, that business is the sender. It is responsible for having your consent and for identifying itself, and it must honour your unsubscribe. We provide the unsubscribe mechanism and keep it working.

If you get a message you did not agree to, tell us at hello@skibble.app and we will look into it. We can pause a business's sending while we do.

13Pepper and your information

Pepper is our assistant. It works from the information in a business's own account, such as its menu, orders, experiences and customer records, so that what it drafts is about that business rather than generic.

• Pepper runs on AI models, some of which are operated by other companies on our behalf. Information sent to them is sent to produce a result for the business, and nothing more.
• We do not allow those companies to use a business's content to train their general models.
• Where Pepper drafts a reply to a customer message, it reads that conversation in order to answer it.
• A business chooses what Pepper may do on its own and what needs approval, and can turn it off.

Pepper does not make decisions about people that have a legal or similarly significant effect on them. It drafts, and a person decides.

Training large language models

To say it as plainly as we can, because some laws now require it in exactly these terms: we do not collect, use or sell personal information for the purpose of training large language models. We use models built by other companies to produce a result for the business asking for it, and our agreements with those companies do not permit them to train their general models on what we send.

14Children

Skibble is for businesses, and it is not directed at children. We do not ask anyone's age, and we do not knowingly collect personal information from a child.

Where the law sets an age, we work to the highest one that applies to us. In Quebec that is fourteen, and information may not be collected from a child under fourteen without a parent's or guardian's consent. Elsewhere in Canada and in the United States the line is usually thirteen.

If you are a parent or guardian and you believe a child has given us information, write to hello@skibble.app and we will delete it.

15If you are outside Canada and the United States

We sell Skibble in Canada and the United States. We do not offer it in the European Union, the European Economic Area or the United Kingdom, and we do not target people there.

If you are in one of those places and you contact us or read our website, we will handle your information under this policy and give you the rights in section 12 on request. If we ever start offering Skibble in those markets, we will update this policy before we do and put the additional arrangements in place that the law there requires.

16Changes to this policy

We will update this policy as the product changes and as the law does. The date at the top tells you when it last changed.

If a change materially affects you, we will tell you before it takes effect, by email to the address on your account or a notice in your dashboard. For anything else, the change takes effect when we post it.

17How to reach us

Skibble
Charlottetown, Prince Edward Island, Canada
hello@skibble.app

For a privacy question, a request about your information, or a complaint, write to that address and mark it for the privacy officer.

You can also read our Terms of Service.