Privacy Policy

# Privacy Policy **Effective Date:** April 13, 2026 **Last Updated:** April 13, 2026 This Privacy Policy describes how Incline Labs, LLC ("Incline," "we," "us," or "our") collects, uses, shares, and protects information when you use our web application, mobile applications for iOS and Android, in-store shift console, websites, APIs, and related services (collectively, the "Service"). This Privacy Policy applies to (a) operators (the gas station and convenience store businesses and their owners or authorized administrators who subscribe to the Service), (b) employees of operators whose information operators upload to the Service, (c) shoppers whose loyalty or transaction data operators upload to the Service, and (d) visitors to our websites. **Important note for employees and shoppers.** When operators upload your personal information to the Service, Incline acts as a service provider or processor on behalf of the operator. The operator (your employer or the store you shop at) is the party that controls how your personal information is collected and used. To exercise your privacy rights, please contact the operator directly. Incline will assist operators in responding to your requests. ## 1. Information We Collect **Information operators provide directly.** - Account information: name, email address, business name, business address, phone number, and password - Billing information: payment card details (collected and processed by Stripe, Inc.; we do not store full card numbers), billing address, tax ID - Profile information: store locations, business type, number of employees, and other information you choose to provide - Communications: messages you send to us, support requests, and survey responses **Information operators upload about their employees.** - Names and contact information - Job titles, roles, and pay rates - Schedules, hours worked, and time-off requests - Performance and disciplinary records (if uploaded) **Information operators upload about their shoppers.** - Loyalty program membership information (name, email, phone, loyalty ID) - Transaction history and purchase patterns - Loyalty points and rewards information **Information we collect automatically.** - Device information: device type, operating system, browser type, IP address, device identifiers - Usage information: pages visited, features used, actions taken, time spent, referring URLs - Log data: timestamps, error reports, performance data - Cookies and similar technologies (see Section 8) **Information from third parties.** - Authentication providers, if you sign in using a third-party account - Payment processors (limited transaction data from Stripe) - Service providers helping us operate the Service **We do not collect** shopper payment card data, government benefit (EBT/SNAP) account numbers, biometric data, or precise geolocation data of shoppers. ## 2. How We Use Information We use the information we collect to: - Provide, operate, and maintain the Service - Process payments and manage subscriptions - Authenticate users and prevent fraud or unauthorized access - Communicate with you about the Service, including support, updates, and announcements - Respond to inquiries and provide customer support - Improve, personalize, and develop the Service, including developing new features - Generate aggregated and de-identified analytics and benchmarks - Comply with legal obligations and enforce our Terms - Protect the security and integrity of the Service We do **not** sell personal information for monetary consideration. We do **not** use personal information for cross-context behavioral advertising or third-party targeted advertising. We do **not** use Customer Data to train artificial intelligence or machine learning models for any purpose other than improving the Service for you. ## 3. How We Share Information We share information only as described below. **Service providers (subprocessors).** We share information with third-party service providers who help us operate the Service, such as cloud hosting providers, payment processors, analytics providers, customer support tools, and email service providers. These providers are contractually bound to use information only as necessary to provide their services to us. A current list of subprocessors is available in our Data Processing Addendum at useincline.com/legal/dpa. **With operators.** When an employee or shopper interacts with the Service, we share that information with the operator on whose behalf we are processing it. **Legal compliance and protection.** We may disclose information when required by law, subpoena, court order, or other legal process, or when we believe in good faith that disclosure is necessary to (a) comply with legal obligations, (b) protect our rights, property, or safety or those of others, (c) detect, prevent, or address fraud or security issues, or (d) enforce our Terms. **Business transfers.** If Incline is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your information. **With your consent.** We may share information for any other purpose with your explicit consent. **Aggregated and de-identified information.** We may share aggregated or de-identified information that cannot reasonably be used to identify you for any lawful purpose. ## 4. Data Retention We retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically: - Account information: for the duration of your subscription plus 90 days after termination - Customer Data: for the duration of your subscription, with a 30-day export window after termination - Billing records: 7 years to comply with tax and accounting laws - Log data and security records: typically 12 months - Backups: up to 90 days after deletion from the active Service After these periods, we will delete or de-identify the information unless legally required to retain it longer. ## 5. Data Security We implement reasonable administrative, technical, and physical safeguards to protect information from unauthorized access, disclosure, alteration, or destruction. These safeguards include: - Encryption of data in transit (TLS 1.2 or higher) - Encryption of data at rest (AES-256) - Access controls and authentication requirements - Regular security assessments and monitoring - Employee training on data protection - Incident response procedures No system is completely secure. We cannot guarantee absolute security, and you transmit information at your own risk. If we become aware of a security incident affecting your personal information, we will notify you as required by applicable law. ## 6. Your Privacy Rights Depending on where you live, you may have the following rights regarding your personal information: - **Right to know / access.** Request confirmation of whether we process your personal information and access to that information. - **Right to correction.** Request that we correct inaccurate personal information. - **Right to deletion.** Request that we delete personal information we have collected about you. - **Right to portability.** Request a copy of your personal information in a portable format. - **Right to opt out of sale or sharing.** Direct us not to sell or share your personal information. As stated above, we do not sell personal information. - **Right to opt out of targeted advertising.** Direct us not to use your personal information for targeted advertising. We do not use personal information for targeted advertising. - **Right to limit use of sensitive personal information.** Direct us to limit the use of certain sensitive categories of information. - **Right to appeal.** If we deny your request, you may appeal our decision by replying to our denial email. - **Right against discrimination.** We will not discriminate against you for exercising your privacy rights. **How to exercise your rights.** To exercise any of these rights, please email us at privacy@useincline.com. We will respond within 45 days, with a possible 45-day extension if reasonably necessary. We may need to verify your identity before fulfilling your request. **Authorized agents.** You may use an authorized agent to submit a request on your behalf. We will require proof of the agent's authorization and may verify your identity directly. **Employees and shoppers.** If you are an employee or shopper of one of our operator-customers, please direct your privacy requests to that operator. As a service provider, we will assist the operator in responding to your request. ## 7. Global Privacy Control and Universal Opt-Out Signals We honor opt-out preference signals, including the Global Privacy Control (GPC), as required by applicable state laws. When you visit our website with GPC enabled, we will treat the signal as a request to opt out of any sale or sharing of personal information for that browser and device. ## 8. Cookies and Tracking Technologies We and our service providers use cookies and similar technologies to operate, secure, and analyze the Service. The categories we use are: - **Strictly necessary cookies.** Required for the Service to function (authentication, session management, security). These cannot be disabled. - **Functional cookies.** Remember your preferences and settings. - **Analytics cookies.** Help us understand how the Service is used so we can improve it. You can control cookies through your browser settings. Disabling certain cookies may affect Service functionality. We do not use cookies for cross-site tracking or targeted advertising. ## 9. Children's Privacy The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us at privacy@useincline.com so we can delete it. ## 10. International Users The Service is operated from the United States and is intended for users in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. ## 11. State-Specific Disclosures **California (CCPA / CPRA).** California residents have the rights described in Section 6, plus the right to know the specific categories of personal information collected, sources, business purposes, and categories of third parties with whom information is shared. In the past 12 months, we have collected the following categories of personal information: identifiers, commercial information, internet/network activity, and professional/employment information. We do not sell or share personal information as those terms are defined under CCPA. We do not knowingly collect or sell the personal information of minors under 16. To exercise your rights, contact us at privacy@useincline.com. **Other states with comprehensive privacy laws.** Residents of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have rights under their respective state privacy laws. The rights described in Section 6 apply to you, and you may exercise them by contacting us at privacy@useincline.com. **Notice of financial incentives.** We do not offer financial incentives in exchange for personal information. ## 12. Changes to This Privacy Policy We may update this Privacy Policy from time to time. Material changes will be communicated by email or through the Service at least 30 days before they take effect. For non-material changes, we will update the "Last Updated" date. Your continued use of the Service after the effective date of any update constitutes acceptance of the updated Privacy Policy. ## 13. Contact Us To exercise your privacy rights or ask questions about this Privacy Policy, contact us at: Incline Labs, LLC Attn: Privacy Officer Email: privacy@useincline.com General inquiries: contact@useincline.com Support: support@useincline.com