Privacy Policy

1. Who we are

The company responsible for your personal information (the “controller”) is HIRE LOCAL LLC, an Idaho limited liability company in the United States. You can reach us at support@bokolator.com.

Organizations, whether businesses or households, use the Service to store their own inventory records (“Customer Data”), which can include personal information such as the names of members recorded in stock history. For that information, the organization decides why and how it is processed, and we process it on the organization's behalf as its service provider (or “processor”), following its instructions and our Terms. Requests about that information should go to the organization, and we will help it respond.

2. Information we collect

• Account information: your name, email address, password (stored only in hashed form by our authentication provider), preferred language, and the organizations and roles you belong to.
• Organization information: the organization's name, default language, plan, trial and subscription status, and billing identifiers from our payment processor.
• Customer Data: inventory information you and your team enter or upload, such as items, descriptions, quantities, units, barcodes, item photos, locations, categories, custom fields, and a history of stock changes that records who made each change and when, as well as files you import or export.
• Invitations: the email addresses and roles of people you invite to your organization.
• Payment information: subscriptions are processed by Stripe. You enter card details directly with Stripe; we do not receive or store them. We receive limited information such as a customer ID, subscription status, and payment results.
• Communications: messages you send us and the notification preferences you choose.
• Technical and security information: your IP address (used briefly to limit repeated sign-in, sign-up, and password-reset attempts, and processed by our hosting provider to deliver the Service), your browser and device type, and error diagnostics when something goes wrong. We configure error reporting to exclude IP addresses, cookies, form contents, web address parameters (where security tokens can appear), and other personal information.
• Information stored on your device: data that keeps you signed in and lets the Service work offline, described in our Cookie Notice.
• Camera: when you use the barcode scanner, the camera image is processed on your device to read barcodes and is not uploaded or stored by us. Item photos are uploaded only when you choose to add one.

We do not use advertising or analytics trackers, and we do not buy personal information from third parties.

3. How we use information

We use personal information for the following purposes. Where the law requires a legal basis (for example, under the EU General Data Protection Regulation), we list it in parentheses.

• Providing the Service (performance of our contract with you): creating accounts, storing and syncing inventory, showing an organization's data to its members, and supporting offline use.
• Service emails (contract; legitimate interests): account confirmation, sign-in links, password resets, team invitations, and the low-stock alerts or digests you turn on. You can turn off low-stock emails in your notification settings; account and security emails are part of the Service.
• Billing (contract; legal obligation): processing subscriptions, preventing payment fraud, and keeping tax and accounting records.
• Security and abuse prevention (legitimate interests): limiting repeated attempts, detecting misuse, and protecting accounts.
• Troubleshooting and improvement (legitimate interests): diagnosing errors and improving reliability.
• Legal compliance (legal obligation; legitimate interests): complying with law and protecting our rights and those of others.
• With your consent where required, which you may withdraw at any time.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for automated decision-making that produces legal or similarly significant effects.

4. How we share information

• Within your organization: members can see one another's names and roles and the history of changes each member makes.
• Service providers that process information on our behalf under contracts: Supabase (database, authentication, and file storage, hosted in the United States); Vercel (application hosting); Stripe (payment processing); Resend (sending service emails); Sentry (error monitoring, with personal information excluded as described above); Upstash (short-lived rate-limit records keyed to IP addresses); and Hostinger (domain, DNS, and email hosting for our support inbox).
• Legal and safety reasons: when required by law or legal process, or to protect the rights, property, or safety of our users, the public, or us, and to prevent fraud.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to the protections in this policy.
• At your direction or with your consent.

5. International transfers

We are based in the United States, and our providers store and process information primarily in the United States; our database is hosted in the U.S. East region. If you use the Service from outside the United States, including from the European Union, Spain, Mexico, Brazil, or elsewhere in Latin America, your information will be transferred to and processed in the United States, whose data protection laws may differ from those of your country.

Where required, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses or our providers' certification under the EU-U.S. Data Privacy Framework, and on the transfer being necessary to provide the Service you request.

6. How long we keep information

• Account information: for as long as your account exists. When you delete your account, it is deleted from our live systems; your entries in an organization's stock history remain without your name attached.
• Customer Data: for as long as the organization exists. When the Owner deletes an organization, its Customer Data, including item photos, is deleted from our live systems.
• Backups: deleted information may remain in encrypted backups for a limited period, generally up to 30 days, until it is overwritten.
• Billing records: as long as needed to meet tax, accounting, and legal requirements, generally up to 7 years.
• Rate-limit records: a few minutes. Error reports are kept for a limited period under our provider's retention settings, generally up to 90 days.
• Invitations: until accepted, canceled, or expired.
• If we discontinue the Service: we will give notice as described in our Terms so you can export your data, and then delete Customer Data and account information, except where the law requires us to keep it or the Service is transferred to another operator as described in our Terms.

7. Security

We protect information with encryption in transit (HTTPS), database-level access controls that keep each organization's data separate, role-based permissions, hashed passwords, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Because the Service can keep an offline copy of your organization's data in your browser, protect your devices, sign out of shared devices, and clear your browser's site data on any device you no longer use.

If we learn of a security breach affecting your personal information, we will notify you and the relevant authorities as required by law.

8. Your rights and choices

In the app, you can update your name and language in your profile settings, export your organization's data to CSV, change your notification preferences, and delete your account. An Owner must first transfer ownership or delete the organization.

You can also email support@bokolator.com to request access to, correction or deletion of, or a copy of your personal information, or to object to or restrict certain processing. We may need to verify your identity, and we will respond within the time required by applicable law. We will not discriminate against you for exercising your rights.

European Union and Spain

Under the GDPR you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection (including to processing based on our legitimate interests), and the right to withdraw consent at any time. You may lodge a complaint with your local data protection authority (in Spain, the Agencia Española de Protección de Datos, https://www.aepd.es), although we would appreciate the chance to address your concern first.

Mexico

You may exercise your rights of access, rectification, cancellation, and opposition (ARCO rights), revoke your consent, and limit the use or disclosure of your personal data by emailing support@bokolator.com with your name, the right you wish to exercise, and a description of the data concerned. We will respond within the time limits established by Mexican law.

Brazil

Under the LGPD you may request confirmation that we process your data, access, correction, anonymization, blocking or deletion, portability, information about the entities we share data with, and revocation of consent, and you may petition the Autoridade Nacional de Proteção de Dados (ANPD).

Other Latin American countries

Residents of countries such as Argentina, Chile, Colombia, and Peru have similar rights under their local data protection laws, which we honor through the same request process.

United States

Depending on your state of residence, you may have the right to know, access, correct, and delete your personal information, to obtain a copy of it, and to opt out of its sale, sharing, use for targeted advertising, and certain profiling. We do not sell or share personal information or use it for targeted advertising. Where applicable, you may appeal our decision on your request by replying to our response, and if your appeal is denied, you may contact your state attorney general.

9. Children

The Service is for adults. Accounts are available only to people 18 and older, account holders may not invite anyone under 18, and the Service is not directed to children. We do not knowingly collect personal information from children, and you should not enter personal information about children into the Service. If you believe a child has given us personal information, contact us and we will delete it.

10. Changes to this policy

We may update this policy. We will post the new version with an updated date and, for material changes, notify account holders by email or in the Service before the changes take effect.

11. Contact us

HIRE LOCAL LLC (Bokolator), Idaho, USA. Email: support@bokolator.com.