Privacy policy

Last updated 10 November 2026.

[Business name] (ABN [ABN]) runs forelo. This explains what we collect, why, and who helps us run it. We handle personal information in line with the Australian Privacy Principles.

What we collect

• About you: your name, email address and, if you set one, your password (stored only as a secure hash), the venues you belong to and your role, and when you sign in. If you sign in with Google, Google tells us your name, email address and a link to your profile picture; we never see your Google password. To stop people guessing passwords or sending floods of emails, we count sign-in attempts for a day by a one-way code made from the email and IP address, never the email or address itself.
• About your venue: what you enter or connect: suppliers and their contact details, products and prices, ingredients, recipes, menu, stock counts, waste, orders, deliveries and invoices.
• Sales: what was sold, when and for how much, from your point of sale or the files you upload. We don’t collect your customers’ names or contact details: if a file you upload includes them, those columns never leave your device.
• Feedback: what you send us from Send feedback, with the screen you sent it from, so we can answer it.
• Demo and quote requests: what you send us from Book a demo or Get a quote on our website: your name, email, phone if you give one, your venue’s name, suburb, kind and point of sale, and your note, so we can answer it.
• Billing: handled by Stripe. We never see or store card numbers.

Why

To run the service for your venue: forecasts, suggested orders, sending orders to your suppliers, reminders and reports; to keep it secure and fix problems; and to improve it. When you correct a suggestion we keep the correction to make later suggestions better. We don’t sell your information or use it for advertising.

AI features

Some features (reading invoices, drafting recipes, matching products, explaining an order, answering questions you type) send the details that task needs to Anthropic’s Claude, such as product, ingredient and dish names, quantities and the invoice itself. Anthropic doesn’t use it to train its models. It deletes what it receives within 30 days, or keeps it for up to 2 years if its safety systems flag it as breaking its usage policy. We never send your customers’ details.

The browser extension

The forelo extension for Chrome fills a supplier’s website cart from an order you approved. It works only on forelo’s own pages and on the supplier websites it supports (Coles and Woolworths today). When you click Fill cart, the order page hands it that one order: its number, the supplier’s name and website, each product’s code, name and number of packs, and the delivery day and time you chose, if any. It opens the supplier’s website in your own browser, where you’re signed in, adds those products, and reads only what it needs there: whether you’re signed in, the product’s name, and whether it was added or is out of stock. On Coles it then books the delivery time you chose in Coles’ delivery time picker, reading only the delivery dates, times and fees Coles shows there, never your address. It tells the order page what it added and whether it booked the time, and keeps a note of the last order it filled in your browser until you close it.

It never sees or stores your supplier passwords, never checks out or pays, and never sends anything to our servers or anyone else. It has no analytics or tracking.

Who helps us run it

• Supabase (database and sign-in) and Amazon Web Services (forecasts, backups and email), in Sydney.
• Vercel (hosting the app), a United States company. The app runs on its servers in Sydney, and requests reach them through Vercel’s network around the world.
• Anthropic (AI features), which stores data in the United States and may process requests in the United States, Europe, Asia or Australia.
• Resend (email), which keeps its records of the emails it sends in the United States.
• Sentry (error reports, without your name, email or IP address), if turned on, in the United States or the European Union.
• Cloudflare (checking that a person, not a program, is signing up or asking for a password reset or a sign-in link), if turned on: it sees your IP address and details of your browser, and may process them outside Australia, including in the United States.
• Google, only if you choose to sign in with Google: it confirms it’s you and tells us the details above. Google may process information outside Australia, including in the United States.
• Square, when you connect your point of sale, and Stripe, when you pay for a plan. Both may store or process information outside Australia, including in the United States; Stripe also names India.

Some of these are overseas. We choose providers that protect information to a standard similar to the Australian Privacy Principles.

How long we keep it

While your account or venue is active. When you ask us to delete it, we delete it within 30 days; copies in our encrypted backups are gone within 12 months.

Your choices

You can see and correct most of your information in the app. To get a copy, have it deleted, or make a complaint, email hello@forelo.app. We’ll answer within 30 days. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).