Privacy Policy

1. Who we are

Forkly ("Forkly", "we") provides a recipe-costing and food-cost management platform to food businesses across Canada. This policy explains what personal information we handle, why, and what you can do about it.

We have designated a Privacy Officer, who is accountable for our compliance and is reachable at privacy@forkly.io.

2. Two different roles

This distinction decides who you should contact:

Information we decide about. Account details, billing records and the logs we keep to run and secure the Service. We are accountable for these.
Information our customers put in. Recipes, suppliers, invoices, and details about a customer's own staff. We handle this on the customer's instructions, on their behalf. If you are an employee of a business that uses Forkly and want to see or correct your information, ask your employer first — we will help them respond.

3. What we collect

Account information — name, work email, the company you belong to, your permission level, and a securely hashed password. We never store passwords in readable form.
Business information — recipes, ingredients, packaging, labour rates, suppliers, prices and margins. This is mostly commercial rather than personal, but staff names can appear in it.
Supplier invoices — the emails and attachments sent or forwarded to the invoice address set up for your business, and the data read from them.
Activity records — what changed, who changed it and when, plus sign-in and sign-out events. This exists so a business can audit its own data, and so we can investigate problems and misuse.
Technical information — IP address, browser and device type, timestamps, and error diagnostics.
Usage information — which screens are opened, how long they are open, and which buttons are pressed. This is first-party and used only to improve the product. It records the name of a control, never what you type into it: no recipe names, prices, suppliers or notes are collected this way, and it can be switched off for the whole platform.
Support correspondence — what you send us when you ask for help.

We do not knowingly collect information from anyone under 18, and the Service is not directed at children.

4. The invoice mailbox, specifically

Because it is the least obvious thing we do, it is worth stating plainly. Each business is given its own invoice address. Mail sent or forwarded there arrives in a mailbox we operate, and Forkly reads only the messages addressed to your business's address. It extracts supplier, item, quantity and price information, keeps the original message and attachment so you can check the source, and does not read or act on mail belonging to any other business.

Forward only what you intend us to process. If personal correspondence reaches that address by mistake, tell us and we will delete it.

5. Why we use it

To provide the Service — costing, invoice processing, reporting, and access control.
To keep it secure — detecting misuse, investigating incidents, and maintaining an audit trail.
To support you when you ask for help.
To bill you, and to meet tax and accounting obligations.
To improve the Service, using aggregated information that does not identify anyone.

We do not sell personal information, we do not share it for advertising, and we do not use one customer's data to build features or benchmarks for another.

6. Consent

We collect and use personal information with consent, or where Canadian law otherwise permits it — including where it is for the purpose of managing a business relationship with you. Where you gave us consent, you can withdraw it, subject to legal and contractual limits; if withdrawing means we cannot provide the Service, we will tell you before acting on it.

7. Who else sees it

We share personal information only with:

Service providers who host our infrastructure, deliver and receive email, and process payments — each under contract, limited to what they need, and not permitted to use it for their own purposes.
Professional advisers, such as accountants and lawyers, where necessary and under a duty of confidence.
Authorities, where we are legally required to. Where we are lawfully able to tell you first, we will.
A successor, if our business is sold or reorganised — under confidentiality, and with notice to you.

8. Where it is stored

Customer data is stored on servers located in Canada. Some service providers — email delivery and payment processing in particular — may process limited information outside Canada, including in the United States.

Information stored in or accessible from another country may be available to the courts and law enforcement of that country under its laws. We use contractual and technical protections comparable to those we apply here, and you can ask our Privacy Officer where a particular category is held.

9. How long we keep it

While you are a customer — for as long as your account is active.
After you leave — available for export for 30 days, then deleted in the ordinary course. Backups expire on their own cycle, typically within 35 days.
Billing records — kept as long as tax and accounting law requires, generally seven years.
Activity and security logs — kept for 24 months so a business can audit its own history.
Usage information — kept for 90 days by default, then deleted automatically.

10. How we protect it

Encryption in transit, hashed passwords, permission levels set by each business, strict separation between businesses so one can never see another's data, recorded administrative access, and backups.

No system is perfectly secure, and we will not claim otherwise. If a breach creates a real risk of significant harm, we will notify affected customers and the Office of the Privacy Commissioner of Canada as the law requires, and keep records of breaches as required.

11. Your rights

Subject to the limits in the applicable law, you may:

Ask what personal information we hold about you and why.
Ask us to correct it if it is wrong.
Ask for a copy in a portable format.
Ask us to delete it, where we are not required to keep it.
Withdraw consent, as described in section 6.
Complain to us, and — if you are not satisfied — to the Office of the Privacy Commissioner of Canada or your provincial regulator.

Write to privacy@forkly.io. We respond within 30 days, and will tell you if we need longer and why. We may need to verify who you are first.

12. Email we send

We send service messages — password resets, billing notices, and things you need to know to use Forkly. These are part of the Service and are not marketing. Any commercial message we send will identify us and include an unsubscribe link, as Canada's anti-spam legislation requires. Unsubscribing from marketing does not stop service messages.

13. Cookies

We use cookies that are necessary to sign you in and keep your session secure, and to remember preferences. We do not use advertising cookies, we do not run third-party analytics, we do not track anyone across other websites, and we do not sell information to ad networks. Blocking essential cookies will prevent you from signing in.

We do measure how our own app is used — see "Usage information" in section 3. That measurement is first-party, stays within Forkly, and never records what you type.

14. Automated decisions

Forkly calculates costs and flags price changes, but it does not make decisions about people. Nothing in the Service produces automated decisions with legal or similarly significant effects on an individual.

15. Changes

We will post any update here with a new date, and for material changes we will notify customers by email or in-app notice before it takes effect.

16. Contact

Privacy Officer
Forkly
Ontario, Canada
privacy@forkly.io