Privacy Policy
This policy explains what information Pantry collects, how it is used and shared, and the choices available to the businesses that use it. Please read it together with the Terms of Service.
1. Who we are and what this covers
Pantry is operated by First Bite, Inc. ("First Bite", "we", "us"), a Delaware corporation with its principal office in Redwood City, California. This policy describes how we handle information when you visit pantry.ai, use the Pantry web application, install a Pantry browser extension, or talk to us about the service. Together we call these the "Service".
Pantry is built for restaurants and other foodservice businesses ("operators") and for the food and beverage suppliers who fund offers on Pantry. It is not intended for personal or household use. Where a supplier uses a separate Pantry supplier account, the Supplier Terms and this policy both apply.
By using the Service you also agree to our Terms of Service, which describe the responsibilities you take on when you connect a distributor account.
2. Information we collect
Information you give us
- Account and contact details. Name, work email, mobile number, your role, a password, and the restaurant or company you represent.
- Restaurant details. The restaurant you select or confirm, its locations, cuisine, menu, and the goals you tell us you care about (for example lowering protein cost or getting cash back).
- Distributor connection details. Which distributors you buy from and the account you connect, as described in section 3.
- Cash back and payment details. Proof of purchase you submit, the payout method you choose, and tax information such as a Form W-9 where the law requires it.
- Messages. Anything you send us by email, text, form, or during a demo or support conversation.
Information we retrieve at your direction
- Purchase records. Invoices, credit memos, order history, order guides, delivery records and the prices you pay, retrieved from a distributor account you connect or from invoice files you upload or forward to us.
- Account identifiers. Your customer or account number with each distributor, ship-to locations, and the name on the account.
Information we collect from public and third-party sources
- Restaurant profile data. To set up your profile quickly we look up your restaurant in public sources such as your website, online menus, business listings and reviews. We use this to build a first pass at your menu and buying categories, which you can edit.
- Supplier offer data. Suppliers give us the terms of their offers, the products they cover and, when you redeem, confirmation of any payment.
- Referral and partner data. If you reach Pantry through a distributor sales representative, a buying group or another partner, they may tell us who you are so we can set you up.
Information collected automatically
- Usage and device data. Pages viewed, features used, sync activity, approximate location from your IP address, browser and device type, and error logs.
- Cookies and similar technologies, described in section 7.
3. Distributor connections
Connecting a distributor is the heart of Pantry, so we describe it in detail.
What a connection is
When you connect a distributor, you direct Pantry to retrieve your own purchase records from your account with that distributor and to keep them current. You do this by signing in to the distributor with the login you already order with. You initiate each connection, you can pause or disconnect at any time from Settings, and Pantry only retrieves records for the account you connected.
What Pantry reads
- Invoices and credit memos, including line items, quantities, pack sizes, item numbers and prices
- Order history and order guides
- Account identifiers such as your customer number and ship-to addresses
What Pantry does not do
- Place, change or cancel orders, or change anything in your distributor account
- Read or store payment card, bank or credit application details held in your distributor account
- Bypass a security step. If your distributor asks for a verification code, a CAPTCHA or a new password, you complete it. Pantry does not.
- Browse or collect data outside your own account
Credentials and sessions
Depending on the connection method available for your distributor, you may sign in to the distributor directly in your own browser, or you may provide your login through Pantry. Where Pantry holds a credential or session token in order to keep your records current, it is encrypted, used only to retrieve your purchase records, accessible only to systems and personnel that need it to operate the Service, not shared with third parties except the service providers that host and secure our infrastructure, and deleted within a reasonable time after you disconnect. Connection methods vary by distributor and may change. Where a method allows your login to stay in your own browser, we may move your connection to it.
Requests from distributors
Some distributors offer a formal way for a customer to authorize a service provider to receive purchase data, such as a letter of participation. Where one exists we will ask you to complete it. If a distributor asks us to stop retrieving records for its customers, or if we decide a connection method presents a legal, security or operational risk, we may pause or end that method at any time. Where practical we will tell you and describe another way to keep your records current, such as forwarding invoice emails or uploading PDFs.
4. How we use information
- To run the Service. Set up your restaurant, connect your distributors, and keep your purchase records current.
- To find savings. Compare what you pay against the alternatives available from your own distributor, flag price changes, and match supplier offers to what you already buy.
- To pay cash back. Verify your purchases against a supplier's offer, calculate what is owed, and pay you.
- To communicate. Send alerts you turn on, service messages, and replies to your questions. Marketing emails include an unsubscribe link.
- To improve Pantry. Understand which features are used, fix problems, and develop new matching and pricing tools. Some processing uses machine learning models, including models from third-party providers, to read menus and match products. Our agreements with those providers restrict them from using your data to train their general models.
- To protect the Service. Detect fraud, abuse and security incidents, and enforce our terms.
- To comply with law. Meet tax, accounting and legal obligations, and respond to lawful requests.
5. When we share information
| Who | What and why |
|---|---|
| Suppliers whose offers you redeem | The purchase lines for that supplier's products (product, quantity, date, distributor, your restaurant name and location) so they can confirm the redemption and fund your cash back. Suppliers do not see what you pay for other products or the rest of your basket. |
| Your distributors | Only when you ask us to, for example when you sign a letter of participation that directs the distributor to release your purchase data to us, or when you ask us to raise a pricing question on your behalf. |
| Service providers | Companies that host our infrastructure, store files, send email and text messages, schedule calls, run analytics, process payments and provide machine learning services. They act on our instructions and may not use your information for their own purposes. |
| Professional advisers | Lawyers, accountants and insurers, under confidentiality. |
| Authorities and others as required by law | To comply with a subpoena, court order or similar process, to protect the rights and safety of operators, suppliers, First Bite or the public, or to enforce our terms. |
| A successor business | If First Bite is involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction. This policy would continue to apply until it is changed under section 11. |
| Anyone you direct | For example a bookkeeper, buying group or franchisor you add to your account. |
We do not sell personal information, and we do not share it with third parties for their own advertising.
6. Aggregated and de-identified data
We create aggregated and de-identified data from the records that flow through Pantry, such as average price movements for a product category in a region or the share of restaurants buying a type of product. This data does not identify you, your restaurant or your account, and we commit not to try to re-identify it. We use it to power price-change alerts, to show suppliers how their offers perform, and to publish market insights. Your item-level prices are never shown to another restaurant.
7. Cookies and analytics
We use cookies and browser storage to keep you signed in, remember where you left off in setup, and understand how the Service is used. We use a product analytics tool to see which features are used and where people run into problems. You can control cookies through your browser settings. Blocking cookies that keep you signed in will prevent the Service from working. Our scheduling page embeds a third-party calendar tool, which sets its own cookies under its own privacy policy.
We do not currently respond to browser "Do Not Track" signals. We do not use third-party advertising cookies on the Service.
8. Retention and deletion
We keep your account information while your account is active. We keep purchase records for as long as they are needed to provide the Service and for up to seven years after, because cash back payments and the supplier funding behind them are subject to tax and audit requirements. When you delete your account we disconnect every distributor, delete stored credentials within a reasonable time, and delete or de-identify the rest within a reasonable period, generally 90 days, except where we must keep a record to meet a legal, tax or audit obligation or to resolve a dispute.
9. Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold. These include encryption in transit and at rest, access controls that limit who at First Bite can see operator data, logging of access to purchase records, and periodic review of our vendors. No system is perfectly secure, and we cannot guarantee that unauthorized access, loss or alteration will never occur. You are responsible for keeping your Pantry password and your distributor logins confidential. If we learn of a security incident that affects your information, we will notify you as the law requires.
10. Your choices and rights
- Access and correction. You can see and edit your restaurant profile, goals and contact details in Settings.
- Disconnect. You can disconnect any distributor at any time in Settings. Disconnecting stops new retrieval and deletes any stored credential for that distributor.
- Delete. You can delete your account in Settings or by emailing us. Section 8 describes what happens next.
- Alerts and marketing. Turn alerts on and off in Settings. Unsubscribe from marketing email with the link in any message. Reply STOP to end text messages.
California residents. The California Consumer Privacy Act gives you the right to know what personal information we collect and how we use and share it, to access it, to correct it, to delete it, to opt out of its sale or sharing, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you. You may make a request by emailing support@firstbite.io. We will verify your request using the email address on your account. An authorized agent may make a request on your behalf with your written permission.
Residents of other states with similar laws may exercise the same rights through the same address.
11. Other things to know
Children. The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.
Where data is stored. We operate in the United States and store data on servers in the United States. If you use the Service from elsewhere, you agree to this.
Third-party sites. Distributor portals, supplier sites and other services linked from Pantry have their own privacy policies. We are not responsible for them.
Distributor data. Purchase Records are created and maintained by your distributors. We present them as received and are not responsible for their accuracy or completeness, or for a distributor's own handling of your information.
Changes. We may update this policy. We will post the new version here with a new effective date and, for material changes, make reasonable efforts to tell you by email or in the Service. Continued use of the Service after the effective date means you accept the updated policy.
12. Contact
First Bite, Inc.
Attn: Privacy
Redwood City, California
support@firstbite.io