Pinch

Privacy Policy

Last updated 2026-10-21

This is a draft. It's written to be accurate about what Pinch actually does today, but it hasn't been reviewed by a lawyer yet. Don't treat it as final until that review is done.

What we collect

We collect three kinds of information:

  • Account information — your email address and password (stored securely, never in plain text) when you create a Pinch account.
  • Operational data you enter manually — end-of-shift notes, your team roster, labor rates, menu items, and inventory counts.
  • Data pulled automatically from systems you connect — if you connect a point-of-sale or scheduling provider (currently Toast, with 7shifts, Square and MarginEdge in beta), we pull sales, labor hours, and comp/discount records from your account there. Some of this data may be attributed to named staff members (for example, which employee's shift a comp or a labor hour is tied to).

How we use it

We use your data to operate the core product: turning your shift notes and connected POS/scheduling data into specific recommendations, each with an estimated dollar impact. Generating those recommendations involves sending relevant operational data to Anthropic (maker of the Claude AI models) for analysis — Anthropic acts as a data processor for this purpose and does not use your restaurant's data to train its models. We also use your data for ordinary product operation: authentication, displaying your dashboard, and sending account-related emails (password resets, invites).

Who we share it with

We don't sell your data. We share it only with the vendors Pinch is actually built on, each for a specific purpose:

  • Anthropic — processes your restaurant's operational data to generate insights and recommendations.
  • Supabase — hosts our database and handles authentication; this is where your data is stored.
  • Toast, 7shifts, Square and MarginEdge — these are the source of data you choose to connect, not a destination; Pinch reads from them, it doesn't send your data to them.
  • Stripe — processes payment if you subscribe to a paid plan. Pinch never sees or stores your full card number.
  • Resend — delivers account emails (password resets, team invites) on our behalf.
  • Vercel — hosts the Pinch website and, on our public pages only, counts page views (see “Analytics on our public pages” below).

We may also disclose data if required by law, or to protect Pinch's or others' rights and safety.

Analytics on our public pages

On our public pages (the home page, the Terms of Service and this Privacy Policy) we use Vercel Web Analytics to count page views, so we can see which pages visitors read and where they came from. It does not use cookies and does not follow you across other websites. It records the page address (without anything after the page name, such as search terms or tags in a link), the website that sent you, your approximate location, and basic device information such as browser and screen size. It does not collect your name, your email address, or anything you type into a form. It is not used inside Pinch once you are signed in, or on the sign-up and log-in pages.

Cookie for referral and source links

If you reach Pinch through a link or QR code that carries a source tag (such as ?ref= or ?s=), we save that tag, and the date you opened the link, in a cookie set by our own site for up to 30 days. When you create a restaurant we record the tag against it, so we can tell how you found us and credit the person who referred you; it is visible only to Pinch staff, never to restaurants, and the cookie is then deleted. The cookie contains no name or email address. We don't use it for advertising or to follow you to other sites.

Employee data specifically

When shift notes or connected POS/scheduling data name a specific staff member — for example, tying a comp, a void, or a labor entry to a named employee — that data is collected and processed on behalf of the restaurant account that employs them, not on behalf of the employee directly. The restaurant account is responsible for the accuracy of what it enters and for having any notice or consent in place with its own staff that local law requires for this kind of workplace data. Depending on where a restaurant operates, handling data about employees can trigger different legal obligations than handling data about consumers — this section, in particular, should be reviewed by a lawyer familiar with the relevant jurisdiction before this policy is treated as final.

Data retention and deletion

We retain your restaurant's data for as long as your account is active, so Pinch can keep finding patterns across your history. If you cancel or close your account, we will delete or anonymize your restaurant's data within a reasonable period, except where we're required to keep it longer (for example, financial records needed for tax or accounting purposes).

Contact us

Questions about this policy, or a request about your data, can be sent to hello@getpinch.co.