Privacy Policy

1. Scope

CAI Solutions LLC (“CAI Solutions”, “we”, “us”, or “our”) operates a portfolio of software products and services. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to caisolutions.org and to every product and service we operate, including CAI Retail, MenuBrat, and PepperVBall (each, a “Service”).

Where an individual Service publishes its own supplemental privacy notice, that notice applies in addition to this policy. If the two conflict, the Service-specific notice controls for that Service.

2. Information we collect

Information you provide

• Account information — name, email address, mobile phone number, password, business name, and role.
• Billing information — billing contact, billing address, and the last four digits and expiration date of your payment card. Full card numbers are collected and stored by our PCI‑DSS compliant payment processor, not by us.
• Content you submit — records, menus, rosters, schedules, photos, messages, and other data you or your organization upload to a Service.
• Support communications — the contents of emails, forms, and chat sessions you send us.

Information collected automatically

• Device and usage data — IP address, browser type, operating system, device identifiers, referring URLs, pages viewed, features used, and timestamps.
• Log data — diagnostic and crash information generated when a Service is used.
• Cookies and similar technologies — see Section 6 and our Cookie Policy.

Information from third parties

• Authentication providers, if you sign in using a third‑party identity service.
• Payment processors, which confirm transaction status to us.
• Your organization, if your employer or a business customer creates an account on your behalf.

3. How we use information

We use personal information to:

• provide, operate, maintain, and improve the Services;
• create and administer accounts and authenticate users;
• process transactions and send billing notices, receipts, and renewal reminders;
• send transactional and service messages, including by SMS where you have consented (see Section 4);
• respond to support requests and communicate about the Services;
• monitor for, investigate, and prevent fraud, abuse, and security incidents;
• produce aggregated, de‑identified analytics that do not identify any individual; and
• comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use your content to train third‑party generative AI models.

4. SMS & mobile information

Where a Service offers SMS notifications, we collect your mobile phone number and your record of consent (including the date, time, and method of opt‑in). We use this information solely to deliver the messages you asked for and to honor opt‑out requests.

Mobile information may be shared with subcontractors in support roles — such as our licensed messaging provider, which transmits messages on our behalf — strictly for the purpose of delivering those messages. Those subcontractors are contractually prohibited from using the information for any other purpose.

Message frequency varies by Service and by the notifications you enable. Message and data rates may apply. Reply STOP to any message to cancel, or HELP for assistance. Full details are in our SMS Terms & Conditions.

5. How we share information

We share personal information only in the following circumstances:

Recipient	Purpose
Service providers	Cloud hosting, database, email delivery, SMS delivery, error monitoring, analytics, and customer support tooling. Each is bound by contract to process data only on our instructions.
Payment processors	To take payment and prevent fraud. They act as independent controllers of card data.
Your organization	If you use a Service through an employer or business account, its administrators may access your account data and content.
Legal and safety	When required by law, subpoena, or court order, or where necessary to protect the rights, property, or safety of CAI Solutions LLC, our users, or the public.
Business transfers	In connection with a merger, acquisition, financing, or sale of assets. We will notify you before your information becomes subject to a materially different privacy policy.

We do not sell personal information, and we do not share personal information for cross‑context behavioral advertising.

6. Cookies & analytics

We use strictly necessary cookies to keep you signed in and to secure the Services, and limited analytics cookies to understand aggregate usage. You can control cookies through your browser settings; disabling strictly necessary cookies may prevent parts of the Services from working. See our Cookie Policy for the full list and your options.

7. Data retention

We retain personal information for as long as your account is active and for as long as needed to provide the Services. After account closure we delete or de‑identify personal information within 90 days, except where a longer period is required for tax, accounting, legal, or fraud‑prevention purposes. Backup copies are purged on our regular backup rotation schedule.

8. Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and request a copy;
• request correction of inaccurate personal information;
• request deletion of your personal information;
• opt out of the sale or sharing of personal information (note: we do not sell or share personal information);
• limit the use of sensitive personal information; and
• not be discriminated against for exercising any of these rights.

Residents of California (CCPA/CPRA), Colorado, Connecticut, Virginia, Utah, Texas, and other states with comprehensive privacy laws, as well as individuals in the EEA and UK, may exercise these rights by emailing [email protected]. We will verify your identity before acting on a request and will respond within the period required by applicable law (generally 45 days). You may designate an authorized agent to submit a request on your behalf.

9. Account & data deletion

You can delete your account and associated personal data at any time from within each Service, or by submitting a request through our Account & Data Deletion page. We honor deletion requests submitted from within our mobile apps and from the web, at no cost.

10. Security

We use encryption in transit (TLS) and at rest, role‑based access controls, least‑privilege administrative access, and routine patching. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

11. Children's privacy

Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Where a Service is used in a youth sports or school context, accounts are created and managed by a parent, guardian, or authorized adult administrator. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

12. International transfers

We operate in the United States and our infrastructure is located there. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date above and, where required, provide additional notice by email or in‑product. Your continued use of the Services after an update constitutes acceptance of the revised policy.

14. Contact us