Privacy Policy

Iraca is operations software for product businesses: inventory, orders, invoicing, delivery, online stores, email marketing, and the tools their customers use to order and pay. This policy explains what personal information we handle, why, who we share it with, how long we keep it, and what choices you have.

1. Who we are, and our two roles

Iraca is developed and operated by Amenable LLC, 1126 15th Avenue North, St. Petersburg, FL 33704, United States ("we", "us"). We handle personal information in two different capacities, and which one applies decides who you should talk to:

• As a controllerfor information about our own customers' accounts and billing, people who visit our website or contact our support, storefront buyers on the Iraca Marketplace, and the operation and security of Iraca itself. This policy governs that information directly.
• As a processor (service provider)for the records our customers keep in Iraca, including details of their customers, suppliers, staff and drivers, the people on their email lists, and shoppers on the online stores they run with Iraca. The business that uses Iraca decides what is collected and why, and its own privacy notice applies. We process that information only to provide Iraca to that business, on its instructions.

If a business holds your details in Iraca and you want them corrected or deleted, contact that business. We will help it act on your request.

2. Who this policy covers

• Iraca customers and their team membersthe businesses that use Iraca and the people they invite.
• People whose details a business keeps in Iracaits customers, suppliers and contacts.
• People who use a business's customer-facing pagescustomers who sign in to a business's ordering portal, pay by card or bank account, follow a delivery on a tracking page, rate a delivery, open a quote or invoice link, or sign up for a business's emails. These pages carry the business's name, not ours.
• Shoppers on a business's online storebuilt with Iraca. The store has its own privacy policy, written for that business; this policy describes our part.
• People who receive a business's marketing emailssent through Iraca.
• Delivery driversthat a business adds to Iraca's driver app.
• Storefront buyerspeople who register on an Iraca Marketplace storefront.
• Visitorsto iraca.app, and people who write to us.

3. Information we collect

• Iraca accounts.Name, email address, phone number, company name and business details, language and display preferences, and your role on each team. You sign in with a code sent by email; where an older account has a password, it is stored only as a secure hash.
• Business records a customer enters or imports.Products, recipes, inventory, purchase and sales orders, invoices, bills, payments, documents and images, and the contact details of the business's customers and suppliers: names, email addresses, phone numbers, billing and shipping addresses, purchase-order numbers, payment terms and credit limits, and resale or tax-exemption certificates.
• Data from services a business connects.Where a business connects a marketplace, online store or advertising account, the orders, listings, catalog, fees, transactions and reports that service returns, including buyers' names and shipping addresses where the service provides them.
• Customer portal and checkout.For people who sign in to a business's portal: name, email address, the company they buy for, their orders, carts, and saved preferences. Where a portal lets new customers create an account or join a business's email list, the details they give.
• Card and bank payments.Card details are entered on Stripe's page and never reach us. To pay by bank account, you connect your bank through Stripe's secure bank-login service; your bank sign-in details never reach us. In both cases we receive the payment's status, amount and reference, and for a bank account, the bank's name and the last four digits.
• Email marketing.For people a business emails through Iraca: whether they agreed to marketing email, how (for example a box ticked at checkout, or a confirmed sign-up), and when; the confirmation emails sent to them; which emails were sent and delivered; bounces, spam reports and unsubscribes; and whether an email was opened and which links were clicked (section 8).
• Online stores.For shoppers on a business's online store: what they put in the cart, their order, and the name, email address, phone number and addresses given at checkout; messages sent through the store's contact form; requests made on its "Request my data" page; and their cookie choices (section 9).
• Delivery.For people receiving a local delivery: the delivery address and its map position (we look up the coordinates from the address), the delivery window, instructions, and proof of delivery the driver captures (a photo, a signature and the name of the person who signed, notes). If you rate a delivery, your rating and comment. Your choices about delivery emails and texts, and if you agreed to texts, the number, when and where you agreed, and any STOP.
• Drivers.Name, email address, phone number, vehicle details, shifts, the routes and stops assigned, actions in the app (for example marking a stop delivered), and the phone's location while a route is in progress (section 7).
• Shipping.Where a label is bought through Iraca: the recipient's name, address and phone number, parcel details, and tracking information the carrier returns.
• AI features.What each feature sends and keeps is in sections 5 and 6. For Iris chat we keep no messages, only counts of use.
• Setup assistant.The website address a business gives us, the text and public product data we read from that site, the products read from a marketplace account it connects, and the files uploaded to the assistant (spreadsheets, supplier and customer invoices, brochures).
• Support.The tickets and messages you send our support team, the screen you wrote from, and, only if you choose to attach it, your Iris conversation.
• Storefront buyers.Name, email address, company, country, buyer role, verification status, any plan subscribed to, and inquiries sent to vendors.
• Billing.Plan, add-ons, invoices, payment status, fees charged, usage counts that are billed (for example text messages sent), and a non-identifying card or bank reference such as brand or bank and last four digits. Card numbers are handled by Stripe.
• Technical information.IP address, browser and device type, and server logs, used to run, secure and debug Iraca. We record the IP address at which our terms were accepted.

We do not use analytics, advertising or session-recording tools in the application or on iraca.app.

4. How we use it

• To provide Iraca: run the features a business uses, sync its connected services, plan routes, buy labels, send the emails and texts it sets up, publish its online store, and process payments.
• To operate accounts and billing, including our fees on payments, postage and other activity.
• To send service emails: sign-in codes, receipts, trial reminders, export links and important notices.
• To provide support, detect and prevent abuse and fraud, enforce sending limits and other limits, and keep Iraca secure.
• To improve Iraca using aggregated, de-identified statistics.
• To meet legal, tax and accounting obligations.

We do not sell personal information, do not share it for cross-context behavioral advertising, do not build advertising profiles, and do not use business records or the content our AI providers read to train AI models.

Legal bases (EEA and UK): for information we control, we rely on performance of our contract with you, our legitimate interests in running and securing Iraca (balanced against your rights), compliance with legal obligations, and consent where we ask for it. For information we process for a business, the business determines the legal basis.

5. AI features

Some Iraca features use AI models provided by Anthropic:

• The setup assistant,which reads text from a business's public website, its marketplace catalog and the files it uploads, to suggest settings and draft records that the business reviews before anything is saved.
• Reading supplier bills and recipesfrom uploaded documents.
• Iris,the in-app assistant and search box, which answers questions about the business and how to use Iraca.
• Writing help:drafts of email campaigns, menu announcements and online store text, which the business edits before using.
• Email list filters:turning a described group of customers into a filter.
• Explanations:short written explanations inside the app.

We send only the content the feature needs, at the moment it is used. Anthropic processes it to return a result to us, under terms that do not allow it to use that content to train its models.

Iris: to answer, we send Anthropic the conversation so far, the screen the person is on, the date and time zone, the screens they may open, the help articles Iris reads, and the results of the lookups she runs, which can include names from the business's records (for example the customer on an order). We do not send the person's own name or email address. We do not keep the conversation: it lives in the browser tab and ends when the tab closes. We keep only counts: that a message was sent, which lookups it used, and what it cost.

Other features: we keep the drafts a feature produces until the business accepts or rejects them, the short quotes that explain a suggestion, and a record of each call's size and cost; uploaded files are kept as section 16 describes. Images found on a website are fetched only if the business accepts them and confirms the website is its own.

6. AI assistants a user connects (Talk to Iraca)

A business can let its team connect their own AI assistant (such as Claude or ChatGPT) to Iraca, read-only. Each person connects their own assistant and approves it on our consent screen; the assistant sees only what that person can see in Iraca.

• What is sent, and to whom.When the assistant asks, we send it business figures, product names and SKUs, and the names of customers and suppliers. Customers' and suppliers' email addresses, phone numbers and addresses are sent only if an owner or admin of the business turns that on (it is off by default). We never send order notes, product descriptions, payment references, files, passwords or keys.
• The assistant's provider(for example Anthropic or OpenAI) receives that data at the user's direction, under its own terms and privacy policy with that user. It is not our service provider for this, and we do not control what it does with the data.
• What we record.For each lookup: which tool was used, whether it answered, when, how long it took, how many rows it returned, the person and connection, and the names (not values) of the search options used, plus the value of fixed-choice options such as "group by product". We do not store the question asked, search terms, or the answer. No IP address is kept in this log. We use it to show the business its activity, enforce rate limits, count questions during a trial, and improve the feature.
• Control.Anyone can see and revoke their own connections in Settings → Talk to Iraca, and owners and admins can see and revoke everyone's. Removing someone from a business stops their connections.

7. Delivery, driver location, and text messages

• Driver location.The driver app records the phone's location only while a route is in progress: from the moment the driver starts the route until it ends. It records nothing at other times. The business sees its drivers' positions, and a customer whose delivery is next can see the van approach on the tracking page. The customer never sees the driver's surname, phone number, other stops, or route. Location records are deleted after 30 days. The business is responsible for informing its drivers.
• Tracking pages.A delivery tracking page is reached by a private link and shows the delivery window, its status and estimated arrival, the driver's first name, and once delivered, the proof-of-delivery photo. It does not show the address, prices, or anyone else's delivery.
• Addresses on the map.To plan routes, we look up the map coordinates of delivery addresses with the U.S. Census Bureau's geocoding service, which receives the street address only.
• Text messages.A business can text its customers about deliveries, sent through Twilio from a number shared by Iraca businesses. A text is sent only to a number whose owner agreed to receive them. Message and data rates may apply. Reply STOP to stop texts (this stops texts from every Iraca business to that number) and HELP for help.
• Delivery emails.Every delivery email carries a link to change or stop them.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are not shared with any third party, except the providers that deliver the messages.

8. Email marketing a business sends through Iraca

A business can email its customers about its products. The business decides who to email and what to say; we send the emails for it, through Resend, from an address on a domain Iraca shares among businesses or from the business's own domain.

• Only with consent.A business can email only people who agreed to its marketing emails: by ticking a box when signing up or checking out, or by confirming a sign-up. Where someone's agreement wasn't given through Iraca, they are first sent one confirmation email and are emailed only if they confirm. We record how and when each person agreed.
• Opens and clicks.We record whether an email was opened and which links were clicked (links pass through Iraca on the way to the business's page), so the business can see what its emails led to.
• Unsubscribing.Every marketing email has an unsubscribe link, and unsubscribing takes effect at once.
• The shared do-not-email list.If an address hard-bounces or its owner reports a business's email as spam, we stop marketing email to that address from every business on Iraca, to protect the people receiving the mail and the shared sending service. Only the address and the reason are kept on that list.

9. Online stores a business runs on Iraca

A business can publish an online store built and hosted by Iraca, on an iraca.app address or its own domain. The business runs the store and is responsible for what it does with shoppers' information; we build and host it for the business. Each store has its own privacy policy, generated from the store's actual settings.

• Nothing optional loads before you agree.If the business uses Google Analytics, Google Ads or the Meta Pixel, those tags load only after you accept them in the store's cookie banner, and the information they collect goes to Google or Meta for the business. Declining is as easy as accepting, and a browser's Global Privacy Control signal is treated as declining advertising. Meta's automatic matching of emails and phone numbers is always off.
• Checkouthappens on Stripe's page, with the business as the seller (section 10). If a checkout is abandoned, the details held for it are deleted after 30 days.
• Contact messagessent through the store are kept for the business for up to two years, or less if the business chooses.
• Your data.Every store has a "Request my data" page where you can ask the business for a copy of your information, its correction or deletion, after confirming your email address with a code.

10. Payments

• Our own billing.Iraca's subscriptions, add-ons and fees are billed through Stripe. A business can also top up its shipping balance by bank transfer through Stripe.
• Paying a business by card or bank account.When you pay a business through Iraca (its portal, an invoice link or its online store), you pay on a Stripe page into the business's own Stripe account. The business is the seller and Stripe processes the payment for it; we receive the payment's status, amount and reference, and we charge the business a fee on the payment, which Stripe collects for us. A business that accepts payments gives its business and identity details to Stripe, which uses them for verification under its own privacy policy, as a separate controller.

11. Connected marketplaces and advertising accounts

Iraca can connect to services a business uses, including Amazon (Selling Partner and Ads), Shopify, WooCommerce, Etsy, Walmart and TikTok Shop. Each connection is started by the business and authorized with the provider.

• We request only the access the features in use require, and use the data only inside that business's own account.
• Advertising integrations are used for reporting only; we do not create, edit, pause or bid on campaigns.
• We never share data from these integrations with other Iraca customers, sell it, or use it to train AI models.
• Access tokens are encrypted at rest. A business can disconnect at any time in Iraca or at the provider. Disconnecting stops syncing; imported records stay until the business deletes them.

12. Iraca Marketplace storefronts

We operate public, co-branded storefronts on which Iraca businesses can list products, some run by us and some by independent operators under their own brand.

• Buyer accountsare held with the storefront, not with a vendor.
• Inquiries.When you contact a vendor, we pass your name, email address, company, country and message to that vendor so they can reply; from then on the vendor's own privacy practices apply.
• Operatorscan see the vendors, buyer accounts and inquiries on the storefront they run, and act as a separate controller for that.
• Listingsare public by the vendor's choice; some fields are visible only to registered or subscribed buyers.

13. Support

When you contact our support team, we keep the ticket and its messages so we can help you and look back on them. To solve a problem, a member of our team may sign in to a business's account. That access lasts at most one hour, and each time it is recorded in the business's own activity log, where the business can see it.

14. Who we share information with

Service providers that help us run Iraca, bound to use it only on our instructions:

Others, because the service requires it or a user directs it:

• Shipping carriers and courier networksa business uses (USPS, UPS, FedEx, Uber Direct and others): recipient and parcel or delivery details. They act as independent controllers.
• The U.S. Census Bureau geocoder:delivery street addresses, to find map positions.
• Services a business connects(section 11): what is needed to sync with them.
• Analytics and advertising services a business adds to its online store(section 9), only after the shopper accepts them.
• AI assistant providersa user connects (section 6).
• Storefront operators and vendors(section 12).
• The business itself:information you give through its portal, checkout, online store, sign-up form, tracking page or ratings is available to that business.
• Legal and safety:where the law requires it, or to protect the rights, safety and property of Iraca, our customers or others.
• Business transfers:to a successor in a merger, acquisition or sale of assets, under this policy.

15. How we protect it

All traffic is encrypted in transit with TLS. Marketplace, carrier and courier credentials and access tokens are encrypted at rest, and sign-in and connection tokens are stored only as hashes. Uploaded proof-of-delivery photos, certificates and onboarding documents are kept on private storage and served only through authenticated or private links. Each business's data is separated, and the application enforces that on every request. Access to production systems is limited to people who need it. No system is perfectly secure; if a breach affects your information we will notify the affected businesses, and you where we are the controller, as the law requires.

16. How long we keep it

The business that keeps your details in Iraca may delete them sooner, and its own retention policy governs its records.

17. Your rights and choices

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, to receive it in a portable format, to object to or restrict some processing, and to withdraw consent. You will not be treated differently for exercising them.

• Iraca userscan see and change most of their information in the app, and businesses can export all their records from Settings on any plan.
• Customers of a business:contact that business; we will help it.
• Shoppers on a business's online store:use the store's "Request my data" page, or contact the business.
• Marketing emails:use the unsubscribe link in any of them.
• Texts:reply STOP. Delivery emails: use the link in any of them.
• AI assistant connections:revoke them in Settings → Talk to Iraca.
• Requests to us:email privacy@iraca.app. We may need to verify your identity, and you may use an authorized agent where the law allows. We respond within the time the applicable law requires.

California: in the past 12 months we have collected the categories described in section 3: identifiers, customer records, commercial information, internet activity, geolocation (driver location and delivery addresses), and professional information. We disclose them for business purposes to the recipients in section 14. We do not sell or share personal information as those terms are defined in California law. Precise geolocation is used only to provide the delivery features described in section 7.

Outside the United States: Iraca is offered to businesses in the United States, and your information is processed there. If you live elsewhere you may have the rights above under your own law, and you may complain to your data protection authority.

18. Cookies and browser storage

Iraca uses cookies and browser storage that are strictly necessary: keeping you signed in, remembering preferences such as language, holding an Iris conversation while its tab is open, and letting the installable app and the driver app work offline (including actions saved on the device until a connection returns). We do not use advertising or third-party tracking cookies.

Online stores a business runs on Iraca use only a cart cookie and a record of your cookie choice unless you accept the business's analytics or advertising tags (section 9).

19. Children

Iraca is business software and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

20. Changes to this policy

We may update this policy as Iraca changes. The date at the top shows the current version. If a change materially affects how we handle your information, we will tell Iraca customers by email or in the app before it takes effect.

21. Contact

Email privacy@iraca.app, or write to Amenable LLC, 1126 15th Avenue North, St. Petersburg, FL 33704, United States.