Privacy notice

Effective September 13, 2026 · Version 2026-09-13.1

Server is operated by Jeb Farneth in New York, United States ("Server," "we," or "us"). This notice covers getserver.app, app.getserver.app and the hosted Server service. It explains our current practices, including information venues provide about their staff and operations.

1. Information we receive

• Account and agreement records: your verified email address, sign-in identifiers, venue memberships, agreement version, typed signatory name and acceptance time. Our sign-in provider handles your password; it is not supplied to the Server application.
• Venue records: venue names and locations; menu items and recipes; sales, taxes, tips, discounts and refunds; supplier details, invoices, expenses, orders and stock counts.
• Staffing records: names or employee identifiers, roles, hourly pay rates, availability, worked time, breaks and scheduled shifts, when uploaded or included in a connection you authorize.
• Files and decisions: records and readable text extracted from uploads, source filenames, review notes, saved recommendations, edits and approvals. Do not upload government identification numbers, bank credentials, full payment-card details, health information or other information the workflow does not need.
• Support and optional AI chat: messages you send us or enter in Ask Server, and the replies.
• Service and payment metadata: session identifiers, request and security information, technical errors, connection permissions, encrypted provider credentials, and payment or subscription identifiers if a paid service is enabled. Payment-card entry is handled by Stripe, not Server.

2. Why we use it

We use information to authenticate accounts, separate venue workspaces, import and reconcile records, prepare operating recommendations, carry out the specific actions you approve, answer support requests, maintain billing records where applicable, prevent abuse and investigate problems. We may use service metrics to improve reliability without selling venue records or exposing one venue's data to another. We do not use uploaded venue records to train our own general-purpose AI model.

3. Venue instructions and staff information

The venue decides which business records to provide, who may access its workspace and how to use its operating recommendations. The venue must have authority to provide those records and give any notices or obtain any permissions required for employee or other personal information. We process venue records to provide the service and follow documented, lawful instructions. Staff with a request about an employer's records should contact the venue; they may also contact us so we can help direct the request. An account holder's acceptance is not consent on behalf of every employee for unrelated uses.

4. Service providers and disclosures

We use Amazon Web Services for hosting, the database, backups, sign-in and infrastructure. Square provides connected venue records when authorized. Stripe handles subscription payments. If Ask Server is enabled, OpenAI receives the question, recent chat in that user's venue, a workspace summary and relevant records retrieved to answer the question. Retrieval is limited to that user's permitted venue domains and bounded record results. Depending on those permissions and the question, results can include stock, recipes, suppliers, invoices, payments, sales, employee names, schedules and labor costs. Information typed into chat is also sent; do not include information the question does not need. Read-only retrieval does not authorize a refund, supplier email or schedule publication.

Server requests that model responses not be stored as response objects. This is not a promise of zero provider retention: provider security logs and other processing follow the provider's applicable terms and API data controls. OpenAI states that API data is not used to train its models unless the customer opts in. Server has not represented that it has approved zero-data-retention controls. Venue chat retention settings govern Server's saved chat text, not copies processed by another provider.

We may disclose information to service providers performing these functions, to people the venue authorizes, as required by law, to protect lawful rights and security, or as part of a business transfer subject to appropriate confidentiality and notice. We do not describe a planned integration as an active recipient of your data.

5. Cookies and browser storage

We use session and security cookies for sign-in and request protection, and browser storage to remember setup progress. The current public site does not include advertising trackers or third-party analytics scripts. Blocking essential cookies may prevent sign-in.

6. Retention and deletion

Business, financial, staffing, supplier, stock, agreement and approval records remain retained; no automatic erasure schedule for those records is enabled. In Account settings, a venue owner may review and approve removal of completed or failed chat text after 30, 90 or 365 days, or keep a hold on removal. The default is to retain chat. These instructions also apply to existing eligible messages. Removal is processed in bounded batches; request identifiers and approval evidence remain to prevent duplicate requests. Expired sessions, authorization flows and unapproved import previews are cleaned up automatically. Removing text cannot restore it.

Disconnecting Square stops access; it does not erase previously imported records. A deletion request stops new venue activity but does not itself confirm physical erasure, subscription cancellation or external-provider revocation. Protected records needed to reconcile an already authorized action or verify revocation can remain retained while those checks are unresolved. You can export available venue records, request deletion in Account settings, or contact us for access, correction or deletion assistance. We verify the requester and venue authority. Some records may need to be retained for legal, security or transaction purposes; this notice does not assert a universal legal retention period.

Removed data can remain in restricted backups until their retention period ends; active automated database backups currently use a seven-day window, and separately retained recovery snapshots may remain longer. Provider accounts and original provider records have separate retention controls. We will explain relevant limitations when handling a request.

7. Security and location

The hosted service uses encrypted connections, an encrypted private database, protected provider credentials and account/venue access controls. Hosting is currently in AWS's US East (Northern Virginia) region. Service providers may process information in other locations under their applicable terms. No service can promise perfect security. Please report suspected unauthorized access promptly; we will investigate and provide notifications when required by applicable law.

8. Your choices

You may stop uploading records, disable an optional feature, disconnect Square in Server, or revoke permissions with the provider. You can request help with records and account closure. Rights vary by jurisdiction; we will handle applicable requests as required by law and will not retaliate for exercising them. Server is intended for authorized adult business users, not a service directed to children.

9. Changes and contact

We will publish material changes with a new version and effective date and provide notice or obtain a fresh acknowledgement when appropriate. We will not treat an updated notice as retroactive permission for an unrelated use of previously collected information.

Contact Jeb Farneth, operating Server: Server support. Please start with your account email and venue name, not passwords, payment-card details or unnecessary employee records. Support messages are received through AWS email services and forwarded to the operator’s Microsoft Outlook business-support inbox. Cloud intake copies normally expire after seven days; forwarded correspondence is retained as reasonably needed to resolve requests and meet legal or security obligations.