Privacy Policy
This policy explains what information Pantry collects, how it is used and shared, and the choices available to the businesses that use it. Please read it together with the Terms of Service.
1. Who we are and what this covers
Pantry is operated by First Bite, Inc. ("First Bite", "we", "us"), a Delaware corporation with its principal office in Redwood City, California. This policy describes how we handle information when you visit pantry.ai, use the Pantry web application, or talk to us about the service. Together we call these the "Service".
Pantry is built for restaurants and other foodservice businesses ("operators") and for the food and beverage suppliers who fund offers on Pantry. It is not intended for personal or household use. Where a supplier uses a separate Pantry supplier account, this policy applies to the personal information we collect through it.
By using the Service you also agree to our Terms of Service, which describe the responsibilities you take on when you connect a Portal. A "Portal" is a third-party online account or ordering system your business already uses and where your purchase records are kept.
2. Information we collect
Information you give us
- Account and contact details. Name, work email, mobile number, your role, a password, and the restaurant or company you represent.
- Restaurant details. The restaurant you select or confirm, its locations, cuisine, menu, and the goals you tell us you care about (for example lowering protein cost or getting cash back).
- Portal connection details. Which Portals you buy through and the account you connect, as described in section 3.
- Cash back and payment details. Proof of purchase you submit, the payout method you choose, and tax information such as a Form W-9 where the law requires it.
- Messages. Anything you send us by email, text, form, or during a demo or support conversation.
Information we retrieve at your direction
- Purchase records. Invoices, credit memos, order history, order guides, delivery records and the prices you pay, retrieved from a Portal you connect or from invoice files you upload or forward to us.
- Account identifiers. Your customer or account number with each Portal, ship-to locations, and the name on the account.
Information we collect from public and third-party sources
- Restaurant profile data. To set up your profile quickly we look up your restaurant in public sources such as your website, online menus, business listings and reviews. We use this to build a first pass at your menu and buying categories, which you can edit.
- Supplier offer data. Suppliers give us the terms of their offers, the products they cover and, when you redeem, confirmation of any payment.
- Referral and partner data. If you reach Pantry through a sales representative, a buying group or another partner, they may tell us who you are so we can set you up.
Information collected automatically
- Usage and device data. Pages viewed, features used, sync activity, approximate location from your IP address, browser and device type, and error logs.
- Cookies and similar technologies, described in section 7.
3. Portal connections
Connecting a Portal is the heart of Pantry, so we describe it in detail.
What a connection is
When you connect a Portal, you direct Pantry to retrieve your own purchase records from your account in that Portal and to keep them current. You do this by signing in to the Portal with the login you already use. You initiate each connection, you can pause or disconnect at any time by emailing us, and Pantry only retrieves records for the account you connected.
What Pantry reads
- Invoices and credit memos, including line items, quantities, pack sizes, item numbers and prices
- Order history and order guides
- Account identifiers such as your customer number and ship-to addresses
What Pantry does not do
- Place, change or cancel orders, or change anything in your Portal
- Read or store payment card, bank or credit application details held in your Portal
- Bypass a security step. If a Portal asks for a verification code, a CAPTCHA or a new password, you complete it. Pantry does not.
- Browse or collect data outside your own account
Account details
When you connect a Portal, such as a distributor account, you authorize Pantry to retrieve your purchase records (such as invoices, orders and credits) from that account for you. Any account details you give us to do this, and the sign-in session information needed to keep the connection working, are encrypted, used only to retrieve your records, accessible only to systems and personnel that need them to operate the Service, not shared with third parties except the service providers that host and secure our infrastructure, and deleted within a reasonable time after you disconnect. Connection methods vary by Portal and may change.
Requests from Portal providers
Some Portal providers offer a formal way for a customer to authorize a service provider to receive purchase data, such as a letter of participation. Where one exists we will ask you to complete it. If a Portal provider asks us to stop retrieving records for its customers, or if we decide a connection method presents a legal, security or operational risk, we may pause or end that method at any time. Where practical we will tell you and describe another way to keep your records current, such as forwarding invoice emails or uploading PDFs.
4. How we use information
- To run the Service. Set up your restaurant, connect your Portals, and keep your purchase records current.
- To find savings. Compare what you pay against the alternatives available through the Portals you already use, flag price changes, and match supplier offers to what you already buy.
- To pay cash back. Verify your purchases against a supplier's offer, calculate what is owed, and pay you.
- To communicate. Send alerts you turn on, service messages, and replies to your questions, by email and, if you opt in, by text message. Marketing emails include an unsubscribe link.
- To improve Pantry. Understand which features are used, fix problems, and develop new matching and pricing tools. Some processing uses machine learning models, including models from third-party providers, to read menus and match products. Our agreements with those providers restrict them from using your data to train their general models.
- To protect the Service. Detect fraud, abuse and security incidents, and enforce our terms.
- To comply with law. Meet tax, accounting and legal obligations, and respond to lawful requests.
Pantry text alerts (SMS)
Pantry text alerts is Pantry's text-message program. Pantry texts you only if you opt in, or about a setup call you booked and gave us your number for. You opt in to alerts by entering a mobile number at sign-up and checking the text-messages box, which is unchecked by default. We do not text numbers we get from any other source. The program has three parts:
- Alerts. New cash back that matches your orders, the status of a claim you submitted, and account notices such as a Portal connection that needs your attention.
- Setup call. If you book a call with a Pantry specialist and give us a mobile number, we text you about that call: confirmations, reminders and time changes.
- Two-way conversation. You can reply to an alert or text Pantry a question, and we text you back.
Expect up to 8 alerts per month, plus replies to messages you send us. Message and data rates may apply. Reply STOP at any time to opt out; you will get one message confirming you are unsubscribed and nothing after that. Reply HELP for help, or email support@firstbite.io. Mobile carriers are not liable for delayed or undelivered messages. Opting out of texts does not affect email or your Pantry account. Section 5 describes how we handle your mobile number.
5. When we share information
| Who | What and why |
|---|---|
| Suppliers whose offers you redeem | The purchase lines for that supplier's products (product, quantity, date, the Portal it was bought through, your restaurant name and location) so they can confirm the redemption and fund your cash back. Suppliers do not see what you pay for other products or the rest of your basket. |
| Your Portal providers | Only when you ask us to, for example when you sign a letter of participation that directs the Portal provider to release your purchase data to us, or when you ask us to raise a pricing question on your behalf. |
| Service providers | Companies that host our infrastructure, store files, send email and text messages, schedule calls, run analytics, process payments and provide machine learning services. They act on our instructions and may not use your information for their own purposes. |
| Professional advisers | Lawyers, accountants and insurers, under confidentiality. |
| Authorities and others as required by law | To comply with a subpoena, court order or similar process, to protect the rights and safety of operators, suppliers, First Bite or the public, or to enforce our terms. |
| A successor business | If First Bite is involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction. This policy would continue to apply until it is changed under section 11. |
| Anyone you direct | For example a bookkeeper, buying group or franchisor you add to your account. |
We do not sell personal information, and we do not share it with third parties for their own advertising.
Mobile numbers and text-messaging consent. We do not share mobile phone numbers or text-messaging opt-in consent with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are excluded from every sharing category above and are not shared with any third party. The one exception is the service provider that delivers our text messages, which receives the number on our instructions, uses it only to send and receive those messages, and may not use it for anything else.
6. Aggregated and de-identified data
We create aggregated and de-identified data from the records that flow through Pantry, such as average price movements for a product category in a region or the share of restaurants buying a type of product. This data does not identify you, your restaurant or your account, and we commit not to try to re-identify it. We use it to power price-change alerts, to show suppliers how their offers perform, and to publish market insights. Your item-level prices are never shown to another restaurant.
7. Cookies, analytics and advertising
We use cookies and browser storage to keep you signed in, remember where you left off in setup, and understand how the Service is used. We use PostHog, a product analytics tool, to see which features are used and where people run into problems. PostHog may record how pages are used (session replay), with anything you type in form fields masked. Our scheduling page embeds a third-party calendar tool, which sets its own cookies under its own privacy policy.
On our public marketing pages and in the Pantry app, we use advertising tags, loaded through Google Tag Manager, to measure whether our ads lead to sign-ups and to show our ads to people who have visited the site. These tags, such as the Meta Pixel, receive the page visited, which sign-up steps were completed, whether a sign-up or booking happened, and browser and device information. Google also receives basic information about the visit. We do not send them the contents of our forms, your contact details or your distributor logins. If your browser sends a Global Privacy Control signal, we do not load Google Tag Manager or the Meta Pixel. You can also block third-party cookies in your browser or change your Meta ad preferences.
You can control cookies through your browser settings. Blocking cookies that keep you signed in will prevent the Service from working. We do not currently respond to browser "Do Not Track" signals.
8. Retention and deletion
We keep your account information while your account is active. We keep purchase records for as long as they are needed to provide the Service and for up to seven years after, because cash back payments and the supplier funding behind them are subject to tax and audit requirements. When you delete your account we disconnect every Portal, delete stored credentials within a reasonable time, and delete or de-identify the rest within a reasonable period, generally 90 days, except where we must keep a record to meet a legal, tax or audit obligation or to resolve a dispute.
9. Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold. These include encryption in transit and at rest, access controls that limit who at First Bite can see operator data, logging of access to purchase records, and periodic review of our vendors. No system is perfectly secure, and we cannot guarantee that unauthorized access, loss or alteration will never occur. You are responsible for keeping your Pantry password and your Portal logins confidential. If we learn of a security incident that affects your information, we will notify you as the law requires.
10. Your choices and rights
- Access and correction. You can ask to see or correct your restaurant profile, goals and contact details by emailing us at support@firstbite.io.
- Disconnect. You can disconnect any Portal at any time by emailing us. Disconnecting stops new retrieval and deletes any account details and sign-in session information for that Portal within a reasonable time.
- Delete. You can delete your account by emailing us. Section 8 describes what happens next.
- Alerts and marketing. To turn alerts off, email us. Unsubscribe from marketing email with the link in any message. Reply STOP to any text to opt out, or HELP for help. The text program is described in section 4.
California residents. The California Consumer Privacy Act gives you the right to know what personal information we collect and how we use and share it, to access it, to correct it, to delete it, to opt out of its sale or sharing, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you. You may make a request by emailing support@firstbite.io. We will verify your request using the email address on your account. An authorized agent may make a request on your behalf with your written permission.
Residents of other states with similar laws may exercise the same rights through the same address.
11. Other things to know
Children. The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.
Where data is stored. We operate in the United States and store data on servers in the United States. If you use the Service from elsewhere, you agree to this.
Third-party sites. Portals, supplier sites and other services linked from Pantry have their own privacy policies. We are not responsible for them.
Portal data. Purchase Records are created and maintained by your Portal providers. We present them as received and are not responsible for their accuracy or completeness, or for a Portal provider's own handling of your information.
Changes. We may update this policy. We will post the new version here with a new effective date and, for material changes, make reasonable efforts to tell you by email or in the Service. Continued use of the Service after the effective date means you accept the updated policy.
12. Contact
First Bite, Inc.
Attn: Privacy
Redwood City, California
support@firstbite.io