Privacy Policy

1. What we store

About a person: your name, email address, a hash of your password (never the password itself), whether your email is confirmed, an avatar if you signed in with Google or uploaded one, your profile handle and whether the profile is public, when you last signed in, and which version of our Terms you agreed to and when, so we know whether to ask you again after they change. And anything you add to your profile yourself: a headline, a few lines about you, where you are, your skills, schools and courses, jobs and certificates from before Credplate (with a photograph of the card, if you add one), and links to other websites.

About your training: every test attempt, with the score, the answers, the date and the restaurant it was taken at; and every credential you earned, with a copy of the restaurant's name and the test's terms as they stood that day.

Restaurant tablet: if you or a manager set a PIN for taking tests on your restaurant's tablet, we store it scrambled (hashed, like a password), never the PIN itself, and we never read your Toast PIN. We record which devices a restaurant has set up as its tablet, who set each one up and when (the tablet keeps a cookie that says so), and that a test was taken on the tablet.

Tests for a job: a restaurant can send a test to somebody it might hire by typing their name and email address. It stores what its manager typed, who sent the test and when, and, once you take it in front of them, your answers and your score on each test. Besides you, only that restaurant's managers see it: the name they typed and your scores, never your Credplate account, your profile or your other credentials, and we never tell them whether your address has an account. It is never public, it is not part of the restaurant's training records, and nothing about it appears on your profile unless you press "Add to my profile" on a pass, which makes that pass a credential like any other. Like any other, the restaurant that watched it can revoke it later: if it is on your profile it then shows as revoked, and if it is not you can no longer add it. If you have since joined that restaurant and passed the same test on its team, that pass is yours from the team and revoking the job test does not touch it. Either way the restaurant is not told whether you had added it. The copy of your data in Settings includes these tests and your scores, but not your answers: those would give the test away to the next person who takes it. If you delete your account, the restaurant keeps its record of the test, because it is that restaurant's record of an interview it held. What goes is the link to your account, so a new account on the same address does not get the test or its scores back.

Jobs, and applying: a restaurant's managers can post jobs, which anybody can see on the restaurant's page and in Jobs. When you tap "Apply" on one and confirm, we keep that you did and when, and the managers who look after that job can see your profile: your name, photo, headline, where you are, your skills, your work history and your credentials, even if you have switched your profile off for everyone else. They are told in their notifications. We do not send them your email address, we email nobody, and they cannot see which other jobs you applied to. Tap "Withdraw" to take it back, and they no longer see your profile for that job. A job that closes or is taken down stays on your own list of jobs you applied to, seen by nobody else, so you can still withdraw. "Jobs for you" on the Jobs page is worked out from your town and the jobs you've had, and only you see it. Deleting your account takes back every one.

About a restaurant: its name, address, colours and wordmark; its locations, tests and questions; any menus, photos, documents or web addresses a manager uploads to draft questions from; who is on the roster and in what role; and billing state (which plan, how many locations, whether it is paid), but never card details.

Connections and messages: who you asked to connect with, who asked you, who accepted, any note sent with an invitation, and the messages you send and receive. Anyone who can write to you can add you to a group chat of up to 64 people. Everyone in it sees your name, your photo and what you write there from when they joined, so a group chat also shows who is in it. If your profile is switched off, you are asked first and nobody in the chat sees anything about you unless you join. You can leave any chat, and nobody can add you back to a chat you left. Blocking someone hides their messages in group chats for you, and they are not told. We email you when somebody asks to connect and when a conversation you have nothing waiting in gets a message — never for a reply, never as a reminder, and the message itself is not in the email. For a group chat, at most one email a day, and only when you have nothing waiting there. Turn those off in Settings. Somebody can also invite you by typing your email address; we never tell them whether that address already has an account. Who you are connected to is yours: your public profile shows how many connections you have, but never who they are, and none of it is in the audit trail. The number counts only connections both of you accepted, and leaves out anyone who has switched their own profile off. One exception: when somebody signed in looks at your profile, they can see which of their own connections are also connected to you ("people you both know"). They never see anyone they are not connected to themselves, never anyone who has switched their own profile off, and nobody at all if either of you has blocked the other.

Audit trail: a log of who changed what and when in each workspace, so a score cannot be quietly rewritten and a dispute can be settled from the record.

Technical: a session cookie so you stay signed in, a count of failed sign-in attempts per email address (kept 15 minutes, for rate limiting), and the standard request logs Cloudflare keeps for a short period to run the service.

We do not use analytics trackers, advertising pixels or third-party cookies. The only cookies are the session, a one-time value that protects Google sign-in, and, in local development, a helper that is never set in production.

2. Where it lives

Everything is stored in Cloudflare D1 databases and served from Cloudflare's network. Data is encrypted in transit and at rest. Cloudflare is our infrastructure provider and does not use your data for its own purposes.

3. Who else touches it

Four companies handle pieces of your data so the product can work. None of them is allowed to use it for anything else.

• Resend sends our email: invites, password resets, email confirmation and billing notices. It receives the recipient address and the message.
• Google, if you choose to sign in with Google. Google tells us your email, name, and picture, and we store the identifier that links your Google account to your Credplate account. Google's own privacy policy covers what Google does.
• Stripe handles subscription payments. The restaurant's name, the owner's email and the workspace identifier go to Stripe; card details go directly to Stripe and never reach us. Stripe's privacy policy covers the rest.
• Anthropic, when a manager asks Credplate to draft questions. The material the manager uploaded for that purpose (menu photos, documents, pasted text, the restaurant's own website) is sent to Anthropic's API and the draft questions come back. Nothing about your staff, your roster or your results is sent, and it goes through Anthropic's commercial API, whose terms do not allow the material to be used to train models.

That is the whole list. We do not sell personal data, we do not share it with advertisers or data brokers, and we do not share it with anyone else unless the law requires us to.

4. Who can see what

Your restaurant's managers see your name, your role, your attempts and your scores at that restaurant, and nothing from any other restaurant you have worked at.

Anyone signed in can search for people by name, profile name or headline, and find you the same way — but only while your profile is public. That one switch governs both. Email addresses are never searchable: Credplate does not tell anyone which addresses have an account, which is also why signing in, resetting a password and signing up all answer the same whether or not an account exists.

Nobody sees a profile you have not claimed. Being invited — to a restaurant, or by somebody typing your email address — creates an account for you, but it publishes nothing: the page at credplate.com/u/your-handle does not exist, and you are not in search, until you set a password or sign in with Google. Whoever typed your address does not get to put a page about you on the internet.

A restaurant's page at credplate.com/restaurant/its-name is public. It shows what the restaurant's managers wrote, its locations, its open jobs, and how many people on its team hold a pass, as a number. It never names anybody on the team.

The public sees your profile at credplate.com/u/your-handle only if you have it turned on. A public profile shows your name, your credentials and the restaurants that issued them, how many connections you have, and anything you added to it yourself, marked as yours. It never shows your email, who you are connected to (beyond the people you both know, to someone signed in), your individual answers or your failed attempts. Its latest activity lists only what the profile already shows: credentials you hold, jobs a restaurant confirmed, and what employers said that you have not hidden. Your own activity — every test you have taken, passed or not — is on your profile only when you are signed in and looking at it yourself. It is on when you sign up, and you can turn it off in Settings at any time.

Colleagues at the same location can see its scoreboard: the top of it, with each person's name, how many tests they hold, their average score, how many tests they have taken and the badges they have earned there, and where they themselves stand on it. Staff at the restaurant's other locations do not see that location's board. Other than the scoreboard, other staff see nothing about your training — no individual attempts or answers, no credentials, no roster to browse and no dropdown of names. Somebody you have worked with — at the same restaurant, at the same time, now or in the past — can see your name and your public profile among the people they might connect with, and can list the people they overlapped with at a restaurant they worked at themselves. That comes from the rosters and nothing else, and turning your public profile off in Settings takes you out of it. Only somebody you currently work with can start a conversation with you without connecting first. People in a group chat with you can write there. Anyone you have connected with can message you, and you can block anyone, at which point they can neither message nor invite you and are not told.

Online status. While you have Credplate open and in front of you, we note the time, at most once a minute, and keep only the latest one. From it, people you are connected to and people you currently work with (your restaurant's managers among them) see a dot on your picture: Online, Away, or Offline with when you were last here. Nobody else sees it: not strangers, not anybody signed out, not anybody you have blocked or who has blocked you, and never the public copy of your profile. The restaurant tablet never shows anyone as online. You can turn it off in Settings with "Show when I'm online"; then you look offline to everyone, we stop noting the time and forget the last one, and you do not see anybody else's status either.

Reports and moderation. When you report something — a post, a comment, a profile, a message or a job — we see what you reported, including a reported message (that one message and how many people were in the conversation, not the rest of it), along with your reason and any note, and we keep the report. The person you reported is not told who reported them. Reports are read by Credplate's own moderators, never by a restaurant's managers. Moderators can remove a post, comment or message, which hides it from everyone except the person who wrote it, and can suspend an account, which signs it out, stops it signing in and hides its profile and posts. If you delete your account, the reports you sent stay with your name and note taken off them, and reports about what you wrote are deleted.

5. Credentials belong to the person

A credential is a record about you. It lives on your profile, not in the restaurant's workspace. A restaurant cannot edit one it issued. It can revoke one it issued. If a restaurant leaves Credplate or stops paying, its workspace closes and your credentials stay exactly where they are.

6. How long we keep it

Your account and everything on it, for as long as the account exists. Attempts and credentials are kept because they are the record; that is the product. Sessions expire and are removed. A one-to-one conversation stays until one of the two accounts in it is deleted. A group chat stays while anyone is in it. Failed sign-in counts are kept 15 minutes. Stripe event records are kept to stop a webhook being replayed. The audit trail stays with the workspace.

7. Deleting your account

Delete it yourself from Settings, at any time, or email hello@credplate.com from the address on your account and we will do it within 30 days. Deleting a person's account removes the name, email, password hash, Google link, profile, avatar and the record of which Terms you agreed to, ends every job, takes back every job you said you were interested in, deletes your connections and every one-to-one conversation you were part of — the other person's copy included, because a conversation is two people's — and signs you out everywhere. In a group chat, only what you wrote is deleted; the others keep the rest of their conversation. The restaurants you trained at keep their own test records with your name taken off them, along with a de-identified line in their audit trail, because those describe their tests rather than you. A restaurant that tested you for a job keeps that test, with the name and email its manager typed and your scores, no longer linked to your account. Settings also gives you a copy of everything we hold about you as one file.

An owner can ask for a restaurant workspace to be deleted the same way. Deleting a workspace removes its content, roster and billing record. It does not remove the credentials its staff earned, because those are theirs; the restaurant's name stays on them as it was.

8. Your rights

Wherever you are, you can ask us what we hold about you, ask for it corrected, ask for a copy, and ask for it deleted. If you are in the EU, UK, California or another place with its own privacy law, those rights are yours in law as well as by our choice, and you can complain to your local regulator. We answer requests at hello@credplate.com within 30 days.

9. Security

Passwords are hashed with PBKDF2 and are never visible to us or to an employer. Sign-in is rate-limited. Invite and reset links work once and expire. Changing your password ends every other session. All traffic is HTTPS. Attempts are append-only. If we ever have a breach that affects you, we will tell you promptly and plainly.

10. Children

Credplate is for people old enough to work in a restaurant and is not directed at children under 16. If you think a child has an account, tell us and we will remove it.

11. Changes

When this policy changes we update the effective date at the top. For any change that reduces your privacy, we email account holders at least 14 days before it takes effect.

12. Contact

hello@credplate.com. Credplate is operated from Texas, United States, and this policy is governed by Texas law.