Privacy Policy
Effective March 17, 2026 — Last updated November 2, 2026
This Privacy Policy describes how Prophitable LLC, doing business as Prophitable ("Prophitable," "we," "us," or "our"), collects, uses, shares, and protects your personal information when you use our website, web application, and related services.
Updated November 2, 2026. When you sign up, we now record how you found us (the site that sent you, the first page you saw and your answer to an optional question). See Where you came from. On October 30, 2026, this website moved off Wix and is now hosted by Vercel. Wix keeps a copy of the contacts it held before October 2026 until our Wix account closes in May 2027 (see Third Party Services). We no longer use TWIPLA, so nothing on this site records your session or fingerprints your device. The Meta Pixel no longer runs on this site either; it now runs only on our ad landing pages at try.prophitable.io. Vercel's cookieless analytics now measure this site as well as the app. The forms on this site send what you type to Brevo, and the tutorial videos load from YouTube's no-cookie player. Help articles have an optional feedback box, described under Forms on this website.
By using Prophitable, you agree to the collection and use of information as described below.
What We Collect
Information You Provide
Account information — Your name, email address, and password (or Google profile info if you sign up with Google).
Organization information — Company name, address, phone number, and logo (provided during onboarding).
Business data — Everything you enter into Prophitable: ingredients, recipes, products, orders, costs, staff, customers, suppliers, and inventory. This data is yours. We process it to provide the service, but we don't own it. See "Your Data" below.
Payment information — Collected and processed by Stripe. We never see or store your credit card number. We only receive your subscription status and billing dates.
Forms on this website — The Costing Sheet form asks for your first name and email, and whether you want tips by email. The contact form asks for your name, email, company, website, the reason you're writing and your message. Both go to Brevo, which emails you (or us) and keeps you as a contact, and our team gets a Slack alert with your name and email. We use them only to answer you and, if you asked for tips, to send them. The feedback box at the foot of a help article asks why the article did or didn't help, and for your email only if you'd like a reply. It's emailed to us through Brevo, with a Slack alert, and isn't added to our contacts.
Information Collected Automatically
Server logs — Our hosting provider (Vercel) collects standard log data: IP address, browser type, and timestamps. Retained for up to 30 days.
Session cookie — A single essential cookie from Supabase Auth keeps you logged in. Not used for tracking.
Feature flags — LaunchDarkly receives anonymous data (your plan tier, not your name or email) to manage feature availability.
Analytics (Vercel Web Analytics and Speed Insights) — On this website, on our ad landing pages and inside the application (app.prophitable.io), we use Vercel Web Analytics to count pageviews: which pages people land on, where they came from, and which features get used. On this site it also counts a few actions, like sending a form or clicking into sign-up, along with the page they happened on. Speed Insights measures how fast pages load, along with your browser and device type. Both are cookieless. Your IP address is hashed and discarded (not stored), and no personal identifiers are collected. We use this to understand what to improve, not to identify or retarget individual users.
Where you came from — When you open this website, it remembers the first page you landed on, the site that sent you (for example google.com) and any campaign tags in that link (utm_ tags). That note lives in your browser's session storage, not a cookie, and disappears when you close the tab. Click through to sign up or sign in and it goes along in the link. The app holds onto it in your browser until you finish signing up, for up to 30 days, so a verification email you open later still counts. Once your company account exists, we save it there a single time with your answer to the optional "How did you hear about us?" question, and it can't be changed after that. Our team sees it in the new-signup alert (email and Slack), and Brevo keeps it on your contact. We use it only to learn which channels bring people to Prophitable.
Tutorial videos (YouTube) — The videos on our tutorials page use YouTube's privacy-enhanced player (youtube-nocookie.com), which sets no cookies until you press play. Once you play a video, YouTube (Google) receives your IP address and viewing activity under Google's privacy policy.
Meta Pixel (ad landing pages only) — When you land on one of our ad pages at try.prophitable.io (for example, after clicking a paid ad on Facebook or Instagram), the Meta Pixel records the pageview and any subsequent free-trial signup. That's how we know which ad creative drove the visit. The pixel sets two cookies (_fbp and, if you arrived from a Meta ad, _fbc) and runs only on those landing pages. It doesn't run on this website (www.prophitable.io) or inside the application (app.prophitable.io). We don't pass your business data through the pixel, and we don't use it to retarget you with ads.
What We Don't Collect
- No advertising or tracking pixels on this website or inside the application (app.prophitable.io). The Meta Pixel disclosed above runs only on our ad landing pages at try.prophitable.io.
- No Google Analytics, session recordings or device fingerprinting. Our only analytics is the cookieless Vercel analytics described above: no IP storage, no individual user identification.
- No biometric data, government IDs, or health data
- No data from children under 13
How We Use Your Information
We use your data to:
- Run the service — store your data, calculate costs, generate reports, manage your account
- Process payments — manage subscriptions through Stripe
- Provide support — respond to your questions and requests
- Improve the product — using anonymized, aggregated data (see below)
- Measure paid-advertising effectiveness — only on our ad landing pages, through the Meta Pixel, to learn which ad creative works
We don't retarget you with ads based on what you do inside the app, sell your data to third parties, or train AI models on your business data.
Third Party Services
We share data only with service providers that help us operate Prophitable:
| Service | What They Receive | Reasoning |
|---|---|---|
| Slack | Your name, email and business name at signup, and how you found us; your name and email when you send a form on this website | Internal alert to our team when someone signs up, subscribes or sends a form |
| Wix (former) | Your name, email and business name, if you signed up or sent a form on this website before October 2026 | Our former website host and customer contact list. Those contacts moved to Brevo in October 2026, and Wix keeps a copy until our Wix account closes in May 2027 |
| Brevo | Your name, email and business name at signup, and how you found us; your portal buyers' names, emails and order details; what you send through a form on this website | Our customer contact list and the onboarding emails you get during your trial and after you subscribe (Brevo knows your plan and whether you're on a trial or paid plan); signup and payment alerts to us; portal emails to your buyers (invitations, sign-in links, order confirmations, reminders); emailing you the Costing Sheet and answering your messages |
| Meta (Facebook/Instagram) | Pageview events on our ad landing pages (try.prophitable.io), browser ID, ad-click ID if you arrived from a Meta ad | Measure which paid ad drove a visit/signup. We don't retarget users or send business data. |
| Anthropic | Receipt images and spreadsheets you upload | Turn receipts and imported spreadsheets into structured data. Anthropic doesn't train its models on your files and keeps them only for a limited period under its commercial terms. |
| Vercel | IP address, request headers (hosting); page URL, referrer, browser, device type, page-load timings, hashed-then-discarded IP (analytics) | Hosting this website, our ad landing pages and the application; cookieless pageview and page-speed analytics |
| YouTube (Google) | Your IP address and viewing activity, only once you play a tutorial video | Playing the tutorial videos on this website |
| LaunchDarkly | Plan tier (anonymous) | Feature flag management |
| Google Maps | Addresses you enter | Autocomplete and route calculation |
| Stripe | Name, email, payment details | Payment processing |
| Supabase | Account + business data | Database and authentication |
We do not sell your personal information to anyone.
Cookies
Inside the application (app.prophitable.io) we use two cookies, neither for advertising:
- Supabase auth token (essential) — Keeps you logged in
- LaunchDarkly (functional) — Stores feature flag state
That's it. No ad trackers, no analytics cookies, no third-party tracking pixels.
This website (www.prophitable.io) sets no cookies. It does keep a short note in your browser's session storage (which page you landed on and which site sent you), explained under Where you came from. On our ad landing pages (try.prophitable.io), the Meta Pixel sets two cookies for paid-ad attribution:
_fbp— identifies your browser to attribute ad-driven visits to specific Meta campaigns (90 days)_fbc— set only if you arrived from a Meta ad; records the ad click ID (90 days)
The Meta Pixel does not run on this website or inside the application. We don't use these cookies to retarget you with ads, and we don't share business data with Meta.
Vercel Web Analytics and Speed Insights are cookieless. They don't appear in the lists above because they don't set or read any cookies. They measure pageviews and page speed using a hashed-then-discarded IP and no persistent identifiers.
YouTube's privacy-enhanced player sets no cookies until you press play on a tutorial video. After that, YouTube may set its own cookies under Google's policy.
Your Data
You own your business data. Ingredients, recipes, products, orders, costs. All of it belongs to you. We have a limited license to process it while you use Prophitable, and that license ends when your account is deleted.
Aggregated data. We may use anonymized, aggregated data (data that can't be traced back to you or your business) for benchmarking and product improvement. For example, we might share that "food brands on Prophitable have an average ingredient cost ratio of X%." We will never identify your business.
Data Retention
| What Happens | How Long We Keep Your Data |
|---|---|
| Payment records | Retained by Stripe per legal requirements (up to 7 years) |
| You request deletion | Deleted within 30 days |
| You cancel | Access is paused. Data preserved for 90 days, and you can ask us for an export |
| You have an active subscription | All data retained |
To request data deletion, email percy@prophitable.io.
Security
- All data encrypted in transit (TLS) and at rest (AES-256)
- Multi-tenant isolation via row-level security. No one can access another organization's data.
- Passwords hashed with bcrypt
- Credit card data tokenized by Stripe before it reaches us (it doesn't)
No system is 100% secure, but we take reasonable measures to protect your information.
Your Privacy Rights
California Residents
Under the CCPA, you have the right to:
- Know what personal information we collect about you
- Delete your personal information
- Correct inaccurate information
- Opt out of the sale of your personal information — though we don't sell it
We will not discriminate against you for exercising these rights.
All Users
You can:
- Access your data by logging in
- Update your info in Settings
- Export your data by emailing us (self-serve export coming soon)
- Delete your account by emailing percy@prophitable.io
Where Your Data Lives
Prophitable is hosted in the United States. If you use Prophitable from outside the US, your data is transferred to and processed in the US. By using Prophitable, you consent to this transfer.
Children
Prophitable is not for anyone under 13. We don't knowingly collect information from children.
Changes to the Policy
If we make material changes, we'll update this page and notify you by email. Continued use after changes means you accept the updated policy.
Contact
Prophitable LLC
DBA Prophitable
Torrance, CA 90501
percy@prophitable.io