Privacy Policy

1. How We Use Information

We collect and use information to run the ibakepro platform and provide our services to you.

• For Bakery Owners (Merchants): We collect your name, business details, and contact info to manage your subscription. We store your “Operational Data” - including customers, orders, recipes, inventory/pantry stock, production tasks, blocked dates, compliance logs, supplier details, sales reports, and staff schedules - to provide and improve the services you signed up for.
• For Bakery Customers (End Users): We process data on behalf of the bakery (as a processor). This includes names, contact details, delivery addresses, order history, dietary and allergy notes, messages, and any Custom Fields created by the bakery. End users should direct access or deletion requests to their bakery; we assist the bakery in fulfilling these as required.
• Information collected automatically: When you use the platform or visit our website, we collect standard technical information such as IP addresses, browser and device information, and server logs, for security, fraud prevention, and troubleshooting. If an error occurs, we collect diagnostic details (with on-screen text and inputs hidden) to fix it. We also use cookieless analytics that collect only anonymous, aggregated page-view data. If you contact us, we keep what you send so we can reply. See our Cookie Policy for how we use cookies.
• Safety, abuse and legal compliance: We use account, usage, content, and transaction information (including storefront listings, order forms, message logs, and payment patterns) to detect, prevent, and investigate fraud, spam, abuse, security incidents, and breaches of our Terms of Service and Acceptable Use Policy. Where we ask you to verify your identity, business, or licensing, we use the documents you provide only for that check and keep them only as long as needed for it. We disclose information to payment providers, regulators, or law enforcement only where the law requires or permits it, such as to prevent fraud or serious harm.
• Your Rights: You have rights to access, correct, delete, and otherwise control your personal information. See Section 6 for the full list and how to exercise them.

2. Payments & Financial Security

• Processing: Your ibakepro subscription is billed through Stripe. Payments from your own customers are handled by the payment provider you choose to connect: Stripe, PayPal, or Square.
• Security: ibakepro never sees or stores your credit card number, CVV, or full payment details. We receive payment references, amounts, and status from your payment provider.

3. Data Security & Encryption

We protect data with encryption in transit and at rest, access controls, and hosting on Google Cloud, in line with the Australian Privacy Principles. Credentials for integrations you connect are additionally encrypted.

4. AI Features & Aggregate Statistics

The AI features in ibakepro (collectively, “Choux”) are powered by third-party cloud AI providers, contracted under terms that prohibit using customer inputs to train their models, with any retention limited to short-term caching by the provider. Text and analysis features are processed by our primary cloud AI provider. Image generation is processed by a separate provider that operates United States infrastructure only, so image generation is processed in the United States regardless of the data region you selected at signup. Both are identified on our Sub-processors page. In summary:

• Strictly voluntary: No data is processed by our AI features unless you explicitly trigger one (e.g., clicking “Generate” or “Analyse”).
• Pseudonymisation before transmission: Where a feature sends records from your account to an AI provider, such as the analytics assistant, direct identifiers (customer names, business names, emails, phone numbers, and addresses) are pseudonymised or redacted by the Service before transmission. Names are substituted with neutral placeholders (e.g. “Customer 1”) and restored only in the response shown to you. Features where you supply the input directly, such as generating an image from a description you write, transmit what you provide.
• Smart Import: To map and repair a file you import, Choux receives a small sample of rows, and any rows that fail to import, which can include customer names and addresses. Notes and free-text fields are removed first. You are asked to agree before using it for the first time.
• No model training: We do not train AI models on your data, and we do not use your data to improve the underlying AI models.
• Human oversight: Our AI provides “insights” and “mockups” for decision support only; it does not make automated legal, financial, or food-safety decisions on your behalf.
• Industry benchmarks: Where Choux references “industry benchmarks” (e.g., typical bakery profit margins or average order values), these are static reference figures we maintain and update internally. They are not computed from your data or from any other customer's data.
• Aggregate statistics: We may compute aggregate or statistical measures across the platform (e.g., total orders processed, popular product categories, end-of-year usage summaries) for product analytics and to surface non-identifying insights to users. Aggregates do not identify you, any individual, or your specific business.

5. Data Retention

We retain information only as long as necessary to provide our services and meet legal obligations:

• Operational Data: Retained while your account is active. Following account closure, we retain this data for up to 2 years to support reactivation or export. We provide two advance warnings (approximately 6 months and 1 month before the 2-year period ends) before permanent, unrecoverable deletion.
• Subscription and billing records: Retained for up to 7 years after closure for tax and accounting purposes.
• End-User Order Data: Retained in line with the 2-year post-closure period unless the bakery (the controller) provides different instructions.
• Backups: We keep encrypted backups of our databases for disaster recovery - restoring the Service as a whole after a major failure. Deleted data may persist in these backups for a limited period until they are automatically overwritten on our backup cycle. Backups are not used to recover individual records (for example, an order deleted by mistake), and data restored from a backup is subject to the same retention and deletion rules.

6. Your Rights & Lawful Bases

Your rights. Depending on where you live, you have some or all of the following rights in relation to personal information we hold about you:

• Access - a copy of the personal information we hold about you.
• Correction - to update or correct inaccurate information.
• Deletion - to request erasure, where applicable (subject to legal or contractual retention obligations such as tax records).
• Portability - a copy of information you provided to us in a structured, commonly used, machine-readable format.
• Restriction - to limit how we process your information in specific circumstances.
• Objection - to processing based on legitimate interests, including direct marketing (you can always unsubscribe).
• Withdraw consent - at any time, without affecting the lawfulness of processing before withdrawal.
• Not be subject to solely automated decisions producing legal or similarly significant effects. We use automated systems to suspend an account when a subscription payment fails, and to limit features (such as outbound SMS) when we detect potential fraud or abuse. You can ask us to have any automated restriction reviewed by a person.

To exercise any of these rights, email hello@ibakepro.com. We respond within 30 days (sooner where required by law). We may need to verify your identity before acting on a request.

Lawful bases for processing (EU / UK GDPR). Where the EU or UK GDPR applies, we rely on the following lawful bases:

• Performance of a contract - to provide the Service you signed up for, including operating your account, processing orders, and sending transactional emails.
• Legitimate interests - for service security, fraud prevention, enforcing our Terms of Service and Acceptable Use Policy, product improvement, aggregate analytics, and customer support, balanced against your rights and freedoms.
• Consent - for marketing communications, optional third-party integrations, and cookies that are not strictly necessary; you may withdraw consent at any time.
• Legal obligation - to comply with tax, accounting, anti-money-laundering, and data-breach notification laws.

7. Data Breach Notification

In the event of an eligible data breach likely to cause serious harm, we will assess the breach promptly and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breach (NDB) scheme. Where the EU or UK GDPR applies, we will notify the relevant supervisory authority and affected individuals in accordance with those laws, and where we act as a processor we will notify the affected bakery without undue delay so it can meet its own obligations.

8. Global Data Residency

We offer local data hosting to support compliance with regional laws (e.g. the UK GDPR, EU GDPR, and Australian Privacy Principle 8):

• Primary hosting: You select your data region at signup: Australia (Sydney), the United States, or the United Kingdom (London). The London region serves European customers and is governed by the UK GDPR and the UK Data Protection Act 2018. Transfers from the EU/EEA to our London region are currently permitted under the European Commission's adequacy decision for the United Kingdom.
• Cross-region processing: In limited cases (for example, AI feature processing, customer support, or backups), data may be processed outside your selected region. In those cases, identifiers are pseudonymised or redacted before transmission where feasible, and transfers are governed by appropriate safeguards, namely the European Commission's Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum, or other contractual measures consistent with the Australian Privacy Principles. Our team is based in Australia, and our service providers process data in Australia, the United States, and the United Kingdom. Some providers run global networks and may process data in other countries under the same safeguards. See our Data Processing Addendum for full transfer terms.

9. Integrations & Third Parties

When you enable an integration, you authorise secure data sharing with the relevant third party. All integrations are optional and can be disconnected at any time from your ibakepro Settings.

• Social & Search: Meta (Instagram, Facebook), TikTok, and Google (Calendar, Tasks, and Google Business Profile).
• Accounting: Xero, MYOB, or QuickBooks (one-way export of expenses, orders, and sales to your accounting software).
• E-commerce: Shopify (linking products and syncing orders with your Shopify store).
• Payments: Stripe, PayPal, or Square, whichever you connect to accept payments from your customers.
• Logistics: Shipping providers you connect with your own account (e.g. Interparcel) for quoting and purchasing shipping labels, and delivery data shared with authorised drivers via the Driver Portal.

Google Workspace integrations

ibakepro offers optional integrations with Google Calendar, Google Tasks, and Google Business Profile so you can sync your bakery schedule and manage your business listing. Connecting these is voluntary and is not required to use ibakepro.

Google API Services User Data Policy. ibakepro's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features you have requested (calendar sync, task sync, and Google Business Profile reviews management).
• We do not transfer this data to others except as necessary to provide or improve those features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you.
• We do not use this data for advertising.
• We do not allow humans to read this data unless we have your affirmative agreement for specific messages, it is necessary for security purposes (such as investigating a bug or abuse), or to comply with applicable law.

You can disconnect any Google integration at any time from your ibakepro Settings, or revoke ibakepro's access directly in your Google Account permissions.

We do not sell personal information. We share it only as described in this policy, including with our service providers and where needed for legal, security or fraud prevention purposes.

10. Contact & Complaints

If you have questions or wish to make a complaint:

Privacy Officer, CRADD PTY LTD
Email: hello@ibakepro.com

If you are not satisfied with our response, you may contact the OAIC. If you are in the United Kingdom, you may complain to the Information Commissioner's Office (ICO), and if you are in the EU/EEA, to your local data protection supervisory authority.