What we collect, and why.
CompanyCodex is an operating platform for small businesses, built in a working restaurant. It holds your company's documents, your menu, your prep and your numbers so your team can run the business. This page says what we collect to do that, where it goes, who can see it, and how to get it back or have it deleted. We wrote it to be read, not skimmed.
1. Who we are
CompanyCodex ("CompanyCodex", "we", "us") operates the service at companycodex.com and the application your team signs in to. Questions about this policy go to andrew@waverlystone.com.
2. The two kinds of people this covers
- Account holders — the owner or manager who signs up a company and the staff accounts they invite. We collect your name, email address and a password (stored only as a one-way hash), plus the role you hold in the company.
- Employees — the people on your roster. Employees are not users: they have no login and no password. A manager enters their name and job, and an employee identifies themselves with a short PIN to record that they did something — a prep count, a policy sign-off. The PIN says who; it never grants access on its own.
If you are an employee of a business that uses CompanyCodex, your employer is the one who decided to put your name in the system. Ask them first; we act on their instructions.
3. What the service holds for your company
Everything below is entered by your company, or pulled from a system your company connected on purpose. It belongs to your company, and we use it only to run the service for you.
- Documents — handbooks, policies, procedures, recipes, menu data sheets, their versions, and who signed what.
- Operations — the menu, ingredients, prep counts, station layouts, 86 lists, labor budgets, schedules and reviews, with who recorded them and when.
- Point-of-sale data — if you connect your POS (Toast today), we pull sales, discounts, tenders, taxes, settlements, stock status and the menu catalog for the business days you ask about. We never see card numbers; the POS keeps those.
- Accounting data — if you connect QuickBooks Online, we read your chart of accounts, company preferences and (when you ask) existing bills, payments and balances, and we write the entries you approve. More on QuickBooks in section 6.
- Vendor documents — invoices and credits you upload or forward to your company's intake address, and what we read off them.
- Payroll and labor files — exports you choose to upload from your scheduling or payroll provider, which carry employee names, hours and pay.
- Google Business Profile — if you connect it, your listing, reviews and any reply you post through CompanyCodex.
- Photos and files — plate photos, menu PDFs, logos and the like.
4. What we collect about how you use it
- An audit trail. The service records who changed what and when — a document published, an entry posted, a credential replaced. This is a feature your managers rely on, and it is why nothing here is anonymous inside your company.
- Server logs with the IP address, time and route of each request, kept briefly for security and debugging.
- Nothing from third-party trackers. The marketing site sets no cookies. The application keeps your sign-in token and your display preferences (theme, sidebar) in your own browser's storage so you stay signed in; that is all.
5. AI features
Dex, the help desk inside CompanyCodex, and the drafting features (menu definitions, ingredient estimates, invoice reading, proofreading) send the relevant text, document or image to Anthropic's Claude models to produce an answer. Every such call is recorded against your company with what it was for. What is sent is the material needed for the task — a document, a menu, an invoice image — never your employees' HR or pay records, which are kept out of the AI's reach by design. Anthropic processes these requests under its commercial terms, which do not permit it to train on your data.
6. QuickBooks Online and other connected services
You connect a service by signing in to it and granting CompanyCodex access. For each one:
- We ask only for the scopes the feature needs. For QuickBooks Online that is the accounting scope plus your sign-in identity; we do not request payments access.
- The access and refresh tokens are encrypted at rest with a key that never leaves the server, and are used only to make the calls described in section 3.
- We read your data to show it to you and to check it; we write only what a person in your company approved, and every write is recorded with who approved it.
- You can disconnect at any time from the application's Integrations settings, which deletes the stored tokens. You can also revoke CompanyCodex from inside the connected service (for QuickBooks, from your Intuit account's connected apps).
- We never sell, rent or share data from a connected service with anyone, and we never use it for anything but your company's own books and operations.
7. Who we share data with
We do not sell personal information and we do not share it for advertising. The service runs on a small number of providers who process data on our behalf, under contracts that restrict them to that:
- Render — hosting and the database, in the United States (Oregon).
- Anthropic — the AI models, as described in section 5.
- Resend — transactional email (invitations, password resets, the daily digest) and the inbound address for vendor documents.
- Stripe — subscription billing, once a company is charged for the service. Stripe holds your card; we hold only Stripe's reference to the subscription.
- Intuit, Toast, Google and any other service you connect — only the calls you authorised, as above.
Beyond that, we share data only when the law requires it, or when you tell us to (for example, exporting your dataset to your accountant).
8. Public pages
Some things are meant to be seen without a login: a guest menu, an allergen guide, a staff brief, a catering inquiry form. Each lives behind a long unguessable link that your company creates and can turn off. Those pages carry guest-safe facts only — never recipes, costs, private documents or anything about your employees.
9. Keeping it safe
- Every connection is over HTTPS.
- Passwords are hashed; third-party credentials and tokens are encrypted at rest.
- Each company's data is isolated from every other company's at the database layer, and the isolation is tested as part of every release.
- Access inside your company is by role, and the server enforces it, not the screen.
No system is perfect. If we learn of a breach affecting your data, we will tell the account owner promptly and say what we know.
10. How long we keep it
For as long as your company has an account. Your data is yours: an owner can export the company's whole dataset at any time from the application, and can ask us to delete the account. Deletion removes the company's data from the live service within 30 days and from backups as they rotate out. Audit records and AI request logs are deleted with the rest. Where the law requires us to keep a record (billing, for example), we keep only that.
11. Your choices and rights
- Owners and managers can see, correct and delete the company's data inside the application.
- Any account holder can change their name, email and password from their own settings.
- Employees who want to know what their employer holds about them should ask their employer; we will help the employer answer.
- Depending on where you live, you may have rights to access, correct, delete or port your personal information, and to object to some uses. Email us and we will honour them.
12. Children
CompanyCodex is a tool for businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under 16 except as an employee record entered by their employer under applicable labour law.
13. Changes
If this policy changes in a way that matters, we will email account owners before it takes effect and update the date at the top. The current version always lives at this address.
14. Contact
andrew@waverlystone.com. We read it.