Privacy Policy
Effective date: November 6, 2026
Who we are. Elis Group LLC, doing business as Bowl, [postal address], Miami, Florida ("Bowl", "we"). Bowl is a tool for restaurants: you scan supplier invoices and bills, and Bowl calculates your food cost, labor cost and related numbers. This policy covers the Bowl app and website. Our customers are businesses; the personal information we hold is mostly about the people who run them and use the app.
What we collect.
| Category | Examples | How we get it |
|---|---|---|
| Account information | Name, email address, restaurant name, password (stored only as a cryptographic hash by our authentication provider) | You give it to us when you create an account or we invite you |
| Customer Data | Photos and PDFs of supplier invoices and utility bills, the amounts and dates extracted from them, recipes, fixed costs, a monthly labor-cost total, and sales figures if you connect a sales source | You upload or enter it; Bowl extracts and calculates from it |
| Device and usage data | Device model, operating system version, app version, language, IP address, time of requests | Collected automatically when you use the app |
| Camera and photo library | Access only while you scan or choose a document | Only when you tap scan or upload; you can revoke access in iOS Settings |
| Support communications | Emails and messages you send us | You send them |
Employee data (labor features). If a restaurant uses Bowl's labor features, Bowl also stores, for that restaurant's employees: first and last name, job title, pay rate or salary and pay frequency (entered by the restaurant or imported from its Toast account); time clock data from Toast (clock-in and clock-out times, hours, overtime and break minutes); and the restaurant's work schedule. Bowl does not store employees' Social Security numbers, addresses, phone numbers, email addresses or tips, even when Toast provides them. This data is used only to calculate labor cost and build schedules for that restaurant, is not used for any other purpose or shared, and is included in the data export and deleted with the account. The restaurant, as the employer, is responsible for informing its employees that it uses Bowl for these purposes.
We do not collect precise location, contacts, health data, or advertising identifiers, and we do not track you across other companies' apps or websites.
How we use it. To provide the Service (read your documents, calculate your numbers, show them to you); to review invoices and extracted values for accuracy, including handwritten changes on invoices; to secure the Service and prevent abuse; to support you; to send service messages such as security notices and changes to our terms; to send product news, which you can opt out of at any time; to improve the Service using data aggregated across customers and de-identified; to run the optional Bowl Buying Program, which uses aggregated purchase volumes to negotiate with suppliers (your restaurant's name and prices are shared with a supplier only if you opt in to a specific offer); and to comply with the law.
How documents are read — AI processing. When you scan or upload an invoice or bill, Bowl sends the image or PDF to Anthropic's Claude API, a third-party artificial-intelligence service, to extract the text, amounts and dates. Under Anthropic's commercial terms, Anthropic does not train its models on this content, treats it as our confidential information, and deletes inputs and outputs from its systems within 30 days unless the law requires otherwise or content is flagged for abuse. Bowl shows you every extracted value so you can review and correct it before it is saved. By using the scan feature you consent to this processing.
Who we share it with. We do not sell personal information or Customer Data, and we do not share it with advertisers or with other restaurants. We share data only with the service providers below (our "sub-processors"), each bound by contract to protect it and use it only to provide its service to us; with suppliers, but only aggregated de-identified volumes, or your restaurant's details if you opt in to a specific Bowl Buying Program offer; with professional advisers under confidentiality; when required by law, subpoena or court order, in which case we will tell you unless we are legally prohibited; and with a successor if Bowl is acquired or merges, in which case this policy continues to apply and we will notify you.
| Sub-processor | What it does for Bowl | Where | Security claims |
|---|---|---|---|
| Supabase | Database, authentication and file storage | United States | SOC 2 Type 2, ISO 27001; AES-256 encryption at rest, TLS in transit |
| Anthropic | Reads invoices and bills (AI extraction) | United States | No training on customer content; confidential; inputs and outputs deleted within 30 days |
| Expo (EAS) | Builds and delivers app updates | United States | Bowl uses no Expo analytics or crash reporting; Expo receives only what is needed to deliver updates (app version, device platform). Expo's own privacy policy applies |
| Expo push notifications | Delivers Bowl's notifications to your phone through Apple's push service | United States | Receives your device's push token and the notification text (which can include amounts and employee names); only for the notifications you turn on |
| Toast | Source of your sales, item sales and time clock data, if you connect your Toast account | United States | Read-only access; Bowl does not store employees' contact details or tips from Toast. Toast's own privacy policy applies |
| Resend | Sends the Bowl team an email when an account deletion is requested | United States | Receives the restaurant name, the account email and the request dates; Resend's own privacy policy applies |
| Apple | App distribution, TestFlight | United States | Apple's own privacy policy applies |
We will update this list and notify you before adding a sub-processor that handles Customer Data.
How your data is kept separate and secure. Every restaurant's data is tagged with its own identifier and protected by database-level access rules (row-level security), so an account can only read its own restaurant's records. Data is encrypted in transit (TLS) and at rest (AES-256) by our hosting provider. Access by Bowl personnel is limited to what is needed to operate, support and secure the Service, and is governed by confidentiality obligations. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but if a breach affects your personal information we will notify you as required by law, including the Florida Information Protection Act.
How long we keep it. Account information and Customer Data: for as long as your account is active. After you close your account you can export your data for 30 days; we then delete it within 30 days and purge it from backups within 90 days, unless the law requires us to keep specific records (for example, billing records). Device and usage logs: up to 12 months. Support emails: up to 24 months.
Your choices and rights. You can view and correct your account information in the app. You can export your Customer Data (Settings → Export my data) and delete your account and all its data from inside the app (Settings → Account → Request account deletion) or by emailing support@get-bowl.com; deletion requests are completed within 30 days. You can unsubscribe from product emails with the link in each email; we will still send essential service notices. You can withdraw camera or photo access at any time in iOS Settings. Residents of California and other states with privacy laws may have rights to access, correct, delete and port their personal information and to opt out of its sale or sharing; we honor these requests for everyone, regardless of where you live, and we do not sell or share personal information for advertising. We will not discriminate against you for exercising a privacy right.
Deleting your account.
You can request deletion of your account at any time in the Bowl app: Settings → Account → Request account deletion. Only the restaurant's owner can make this request.
When you request deletion:
- Your account becomes read-only immediately. You can still view your data, but nothing can be added or changed.
- We notify the Bowl team, and we'll reach out within 2 business days.
- 30 days after your request, your account is deleted automatically, without any further action from you or from us. This removes your restaurant and all of its data — invoices and their images, ingredients, prices, recipes, costs, sales, labor and team data, settings and notifications — and your sign-in account.
- You can cancel the request at any time during those 30 days in the same place in the app. Cancelling restores normal use, with nothing lost.
After deletion we keep only a minimal record that a deletion happened (account identifiers and timestamps, no restaurant content), to show that we honored the request. Copies in our backups are overwritten in the normal course of backup rotation.
Children. The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children under 13; if you believe we have, contact us and we will delete it.
Where data is processed. Bowl is operated from Florida and our sub-processors store data in the United States. If you use Bowl from outside the United States, your information will be transferred to and processed in the United States.
Changes. We will post changes here and update the effective date. For material changes we will notify you in the app or by email before they take effect.
Contact. support@get-bowl.com · Elis Group LLC (doing business as Bowl), [postal address].