How we keep your cafe's data safe.

Where your data lives

• Play Sundae's database is Supabase's managed PostgreSQL on AWS, in the us-east-2 region (Ohio, USA). All data stays in the United States.
• Data is encrypted at rest (AES-256) and in transit with TLS: browser to app, app to database, and app to Stripe, Resend and Anthropic.
• The database is backed up every day, and backups are kept for 7 days.
• The app is hosted on Vercel, with HTTPS everywhere and HTTP Strict Transport Security turned on.
• Cafe logos, website gallery photos and cleaning-task photos are served from public links so a cafe's website can show them, so nothing private belongs in an image upload.

Keeping each cafe's data separate

• Every record carries its cafe's id. On every page and every change, Play Sundae checks which cafe the signed-in person belongs to and what role they hold there.
• Row-level security is on for all 88 database tables, so a signed-in person can only reach the cafes they belong to.
• Signed-in users can't change bookings, payments, memberships, prices or waivers directly through the database API. Every change goes through Play Sundae's own server checks.
• Cafe websites read prices, photos and blog posts through read-only functions that return one cafe's published information.
• Each cafe connects its own Stripe account, so one cafe's payments, payouts and refunds never mix with another's.
• Sundae's own team (today, the founder) can open a cafe's dashboard for setup and support, and a banner shows on screen while that's happening.

Signing in

• Staff sign in with an email and password, an emailed sign-in link, or Google. Passwords are stored by Supabase Auth as salted hashes, never in plain text.
• Owners can give a team member a temporary password, which must be replaced at the next sign-in.
• Families never create a password. They sign in with an emailed link, or with the 6-digit code in the same email.
• Sign-in emails are rate limited per address and per network address, and password-reset emails to one a minute per person.

Payments and PCI

• Each cafe connects its own Stripe account (Stripe Connect, Standard). Money goes from the customer's card to Stripe to the cafe's bank.
• Card numbers never reach Play Sundae. Families pay on Stripe's hosted checkout pages, and cards at the desk go through Stripe Terminal readers. There is no screen where staff type a card number.
• Play Sundae keeps only Stripe ids, plus the card brand, last four digits and expiry date so staff can see which card is on file.
• Stripe is a PCI DSS Level 1 certified service provider. Because cards are entered only on Stripe's pages and readers, a cafe's PCI scope stays as small as Stripe allows, and the cafe completes Stripe's short yearly self-assessment in its own Stripe dashboard.
• Every payment event from Stripe is checked against Stripe's signature, and charges to a saved card carry an idempotency key so a retry can't charge twice.

What data we hold

• Parents and guardians: name, email, phone, relationship to the child, and whether they can pick up.
• Children: name, date of birth, and allergy and medical notes entered by a parent or by staff.
• Party guests: each guest child's name, date of birth and notes, and the signing parent's contact details.
• Waivers and party agreements: the exact text accepted, who accepted it, when, how, and the network address and browser used.
• Visits and purchases: bookings, check-ins, memberships, play passes, gift cards and cafe sales, with the staff member involved.
• A copy of every email sent to a customer, with its delivery status.
• Not collected: Social Security numbers, government IDs, full card numbers, signature images, biometrics, or photos attached to children's records.
• Play Sundae is used by parents, guardians and cafe staff, not by children. There are no advertising or social media pixels, and page views are counted with cookieless Vercel Analytics.

Waivers and agreements

• Waivers are versioned. Each signature records the exact version and a fingerprint of its text, so a later edit never changes what an earlier signer agreed to.
• A signature records who signed, for which child, when, how, and from which network address and browser. The parent gets a copy by email with a PDF attached.
• Check-in waits until every child has a signed waiver on the current version.

Email

• Transactional email only, sent through Resend, with the cafe's name as the sender and replies going to the cafe.
• Apart from booking confirmations, waiver copies and sign-in links, every customer email is off until the cafe turns it on.
• While a cafe moves over from another system, its messaging is paused, so no family is emailed until the cafe has checked its data.
• Every customer email is logged with its recipient, content and delivery status.

AI features

• Play Sundae uses Anthropic's API for a staff help assistant, party prep suggestions, and a reporting assistant that Sundae switches on per cafe. Each request sends only what it needs.
• The reporting assistant runs only fixed, read-only reports for the signed-in cafe and never writes its own database queries. Customer emails and phone numbers stay on the owner's screen.
• Anthropic's commercial terms say it does not train its models on API customers' data. We don't sell or share prompts with anyone.

Monitoring, building and releasing

• Errors are reported to Sentry with technical details of the request, such as the account id and network address. A sample of sessions is replayed with page text and form inputs masked.
• Code lives in a private GitHub repository, and every database change is a versioned migration file.
• Releases go out once a week, outside cafe opening hours. Urgent fixes can ship sooner.
• Secrets live only in the hosting dashboards, never in code. Scheduled jobs need a secret key, and incoming webhooks are signature-checked.

Exporting and deleting data

• Owners and admins can export reports to CSV at any time, and staff can export bookings.
• On request, and when a cafe leaves, Sundae provides a full export of the cafe's records in CSV or JSON. No proprietary formats.
• For a family's deletion request, the cafe contacts Sundae and we remove that family's personal details, keeping only the sale records the cafe needs for its taxes.
• When a cafe leaves, its data is deleted from the live database after the export is delivered, and daily backups age out within 7 days.

Audit trails

• Booking edits, voids, refunds and comps are recorded with the staff member, the time and the reason.
• Cash drawer activity, gift card activity, membership perks, pass visits and check-in overrides are recorded with the staff member and the time.

Who processes data for us

What we don't have yet

We'd rather tell you than have you find out later.