Privacy Policy

1.About this policy and who it covers

StationPro Inc. ("StationPro," "we," "us," or "our") provides back-office software for independent gas stations and convenience stores. This Privacy Policy explains what personal information we handle, why, who we share it with, how long we keep it, and the rights you have.

This policy covers:

• Visitors to stationpro.ai and anyone who contacts us, requests a demo, or subscribes to our updates.
• Prospective customers and the individuals who evaluate, buy, and administer StationPro on behalf of a business.
• Users of the StationPro application, including owners, managers, clerks, bookkeepers, and accountants.
• Job applicants and, where required by California law, our own personnel.

It does not cover the practices of third parties, including your point-of-sale vendor, your bank, your accounting platform, or any site we link to. Those are governed by their own policies.

StationPro is a business-to-business product. We do not offer it to consumers for personal, family, or household purposes, and we do not direct it to children.

2.Our two roles: when we decide, and when you do

This is the most important section for understanding the rest of the policy, because StationPro wears two different hats and different rules apply to each.

2.1 Where we are the controller

We act as the controller, called a "business" under California law, for information we collect for our own purposes. That includes website visitor and analytics data, cookies, demo and contact form submissions, prospect and lead records, account administration and billing records, support conversations, product telemetry we use to run and improve the Service, and applicant and personnel data. Sections 3 through 10 describe this processing, and you can exercise the rights in Section 12 with us directly.

2.2 Where we are the processor

We act as the processor, called a "service provider" under California law, for the operational data our customers put into the Service or connect to it: shift and sales records, register and cash counts, fuel and lottery data, invoices, bank transaction records, and the employee identifiers used to attribute activity to a shift or a person.

• The customer is the controller. They decide what data enters the Service and why.
• We process that data only on the customer’s documented instructions, under our Data Processing Addendum.
• We do not sell it, we do not share it for advertising, and we do not use it for our own purposes beyond providing and securing the Service.
• We do not combine it with data from other sources except as our contract permits.

3.Personal information we collect

The table below lists the categories of personal information we have collected in the last twelve months as a controller, using the category names California law uses, along with why we collect each and how long we keep it.

Retention periods are targets, not guarantees to the day. Where a period conflicts with a legal hold, a live dispute, or a statutory obligation, the longer period applies. Section 11 explains our retention approach in full.

3.1 Where the information comes from

• Directly from you, when you fill in a form, create an account, email us, or talk to our team.
• Automatically, from your device and browser as you use the site and the product, through cookies and similar technologies.
• From the business that holds your StationPro account, when it creates a User for you.
• From systems a customer connects, such as a point-of-sale system, accounting platform, payroll provider, banking aggregator, or camera system.
• From our service providers, such as our payment processor, analytics provider, and email delivery provider.
• From publicly available business sources and lead providers, for prospect research and business verification.

3.2 What we do not collect

We limit collection to what is reasonably necessary and proportionate for the purpose we describe, and we hold sensitive information to a stricter standard of strict necessity. We do not want and ask you not to submit: Social Security numbers except where a tax feature specifically requires one, government ID images, health information, biometric identifiers such as fingerprint, faceprint, or voiceprint templates, full payment card numbers, or information about anyone under 16.

4.How we use personal information

We use personal information for these purposes and no others:

• Provide, operate, maintain, and secure the Service and our website.
• Create and administer accounts, authenticate Users, and apply role-based permissions.
• Process subscriptions, take payment, invoice, and collect amounts due.
• Provide support, respond to your questions, and communicate about the Service, including security and availability notices.
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms.
• Diagnose faults, monitor performance, and improve and develop features.
• Send marketing about our products where you have asked for it or where permitted, always with a way to opt out.
• Produce aggregated, de-identified statistics and benchmarks that do not identify you or any individual.
• Comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

We will not use personal information for a materially different purpose without telling you first and, where the law requires it, obtaining your consent.

4.1 AI features

Some features use large language models to summarize records, surface anomalies, and answer questions about a customer's data. Data is sent to our AI provider only to produce a result for the person who asked, under zero-retention terms. We do not use customer data to train general-purpose or foundation models, and we do not use it to train models that serve other customers. AI output can be wrong and should be verified before anyone relies on it.

4.2 Automated decision-making

We do not use automated processing to make decisions that produce legal or similarly significant effects about you, such as decisions about credit, employment, housing, insurance, education, or healthcare. The Service produces observations for a person to evaluate. It does not decide, and it does not make or recommend employment decisions. If that ever changes, we will update this policy and provide the notice and opt-out rights the law requires before the change takes effect.

5.Legal bases (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases. We identify the basis per purpose rather than listing them generally.

Where we rely on legitimate interests, we have carried out a balancing assessment and you can ask us for a summary of it. Withdrawing consent does not affect processing carried out before you withdrew it.

6.Cookies, analytics, and your choices

We use cookies and similar technologies on stationpro.ai. Cookies are small files stored on your device that let a site remember things about your visit.

You can control cookies in these ways:

• Send a Global Privacy Control signal from your browser or an extension. We treat it as a valid opt-out of sale, sharing, and targeted advertising. See Section 8.
• Use your browser settings to block or delete cookies. Blocking strictly necessary cookies will break parts of the site.
• Install the Google Analytics opt-out browser add-on, which stops Google Analytics on every site you visit.
• Email us and ask us to stop analytics processing associated with your visits.

We do not currently respond to browser Do Not Track signals, because there is no agreed standard for how a site should honor them. We do honor Global Privacy Control, which is a recognized standard.

7.Who we disclose information to

We do not disclose personal information except as described here. We do not disclose customer operational data to anyone other than the customer and the service providers needed to run the Service.

7.1 Service providers and sub-processors

We use vendors to run the Service. They may process personal information only on our instructions, for the purpose we specify, under written contracts that restrict their use of it. Our current categories are:

A current sub-processor list naming each vendor and its role is maintained and available on request, and is summarized on our security page. Customers can ask to be notified of changes to it.

7.2 Legal and safety disclosures

We may disclose information where we believe in good faith it is necessary to comply with a law, regulation, subpoena, court order, or lawful request from a public authority; to enforce our Terms; to detect or prevent fraud or a security incident; or to protect the rights, property, or safety of StationPro, our customers, or the public. Where we are legally permitted to do so, we will notify the affected customer before disclosing their data and will push back on requests that appear overbroad or improper.

7.3 Corporate transactions

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be disclosed to the counterparty and its advisers under confidentiality obligations, and may transfer as part of the transaction. We will notify affected customers before their data becomes subject to a materially different privacy policy, and the successor will remain bound by this policy until it does.

7.4 Affiliates and advisers

We may share information with our affiliates and with our professional advisers such as lawyers, accountants, auditors, and insurers, where they need it and are bound by confidentiality duties.

7.5 With your direction

We share information where you ask us to, including when you enable an integration that sends your data to a system you have chosen. Once data reaches that system, it is governed by that provider's policies.

8.Sale, sharing, targeted advertising, and Global Privacy Control

US state privacy laws define "sale" broadly. In many states it covers any disclosure of personal information to a third party for monetary or other valuable consideration, not just disclosures for cash. California separately regulates "sharing," which means making personal information available for cross-context behavioral advertising even if no money changes hands.

8.1 How to opt out

• Send a Global Privacy Control signal. We treat a GPC signal as a valid opt-out request for the browser that sends it, for sale, sharing, and targeted advertising, and we honor it without asking you to verify your identity.
• Email us with the subject "Do Not Sell or Share" and we will apply the opt-out to your account and contact records.
• Use your browser controls or the Google Analytics opt-out add-on described in Section 6.

We act on opt-out requests within 15 days, and within 15 business days for California. We will not treat you differently for exercising an opt-out, and we do not offer financial incentives in exchange for personal information.

8.2 Sensitive information

We do not seek sensitive personal information, and we do not use or disclose it for purposes beyond what is needed to provide the Service and meet our legal obligations. We do not sell sensitive personal information under any circumstances, and we do not ask for consent to do so. Where a state requires opt-in consent before processing sensitive data, we obtain it before processing.

8.3 Minors

We do not knowingly collect personal information from anyone under 16, we do not sell or share the personal information of anyone under 16, and we do not direct targeted advertising at anyone under 18. If you believe a minor has given us information, email us and we will delete it.

8.4 Profiling

We do not profile individuals in furtherance of decisions that produce legal or similarly significant effects. Where a state gives you the right to opt out of profiling, or to question the result of profiling and learn the reason for it, you may exercise that right using Section 12 and we will respond even though we do not believe our processing triggers it.

9.Employee-attributable data

StationPro organizes records that can be attributed to a named person: which clerk was on shift, which drawer came up short, which void sequence sits outside the normal pattern. That is the product. It is also the area where expectations and obligations need to be clearest.

9.1 Whose data this is

For this data we are the processor and the employing business is the controller. The employer decides what to record, who can see it, and what to do about it. We hold it on their behalf under contract.

9.2 What the employer must do

Our customers are responsible for giving their own workers any notice, and obtaining any consent, that the law requires. Several states require employers to give written notice before monitoring electronic activity, and California requires a notice at collection to employees and applicants describing categories, purposes, retention, and rights. Requirements vary by state and change. Our Terms of Service require customers to do this before putting employee-attributable data into the Service. StationPro has no relationship with our customers' employees and cannot give notice on their behalf.

9.3 What we do not do

9.4 If you are a worker at a StationPro customer

Direct access, correction, and deletion requests to your employer, who controls the data. If you write to us, we will point you to them and support them in responding. We cannot delete or change an employer's records on our own initiative. If you believe a record about you is being used unlawfully, you can also contact your state Attorney General, and Section 12.4 explains how.

10.How we protect information

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction, appropriate to the nature of the data and the risk. These include encryption in transit and at rest, role-based access control with per-store data isolation, an audit log, backups with tested restores, and vendor review. Our current practices are described in detail on our security page, which we keep more current than this document.

No system is perfectly secure, and we cannot guarantee absolute security. We review and update our controls over time. If we become aware of a security incident affecting personal information, we will notify affected customers and, where required, individuals and regulators, without undue delay and in the timeframes the law requires.

You can help: use a strong unique password, enable any additional authentication we offer, give each person their own login, and remove Users promptly when they leave.

11.How long we keep information

We keep personal information only as long as needed for the purpose we collected it for, then delete or de-identify it. The retention column in Section 3 gives our standard periods. Where no fixed period applies, we decide based on:

• How long we need it to provide the Service and support the account.
• Whether a law requires us to keep it, such as tax and accounting rules.
• Whether it is needed to establish, exercise, or defend a legal claim, or is subject to a legal hold.
• The sensitivity of the information and the risk of keeping it.

For customer operational data, retention is set by the customer under their agreement with us. On termination, we keep data available in a read-only state for 30 days so the customer can export it, then delete or de-identify it from active systems in the ordinary course, and from backups on our normal backup expiry cycle. Backup copies persist for a limited period after deletion from active systems and remain protected while they do.

12.Your privacy rights and how to use them

Twenty US states now have comprehensive privacy laws in force, and more take effect over the next few years. Rather than making you work out which one applies to you, we extend the following rights to everyone we deal with as a controller, wherever you live.

12.1 How to make a request

Email stationproai@gmail.com with the subject "Privacy request," or use our contact form. Tell us which right you want to use and enough detail to find your records. If you are an authorized agent acting for someone else, send written proof of your authority and we will verify it with the individual where the law allows.

We verify requests before acting on them, usually by confirming control of the email address on the account and, for higher-risk requests such as deletion, by asking for additional matching detail. We ask only for what we need to verify, and we do not use verification information for anything else. We do not require an account to make a request.

12.2 How long we take

We confirm receipt within 10 days and respond substantively within 45 days. If the request is complex or we have several from you, we may extend once by a further 45 days and will tell you why within the first 45. Opt-out requests are actioned within 15 days, and within 15 business days for California. There is no charge unless a request is manifestly unfounded or excessive, in which case we will explain before doing anything.

12.3 When we may decline

We may decline all or part of a request where the law permits, for example where we cannot verify your identity, where a legal obligation requires us to keep the information, where it is needed for security or fraud prevention, where it would reveal another person's information or a trade secret, or where you are asking about data we hold as a processor for one of our customers. If we decline, we will tell you why.

12.4 Appeals and regulators

You can complain to your state Attorney General at any time, whether or not you appeal to us first. If you are in the EEA, the UK, or Switzerland, you can complain to your local supervisory authority, and you have the additional rights described in Section 13.

13.State-specific disclosures

13.1 California

California residents have the rights in Section 12 under the California Consumer Privacy Act as amended. Section 3 serves as our notice at collection and sets out the categories collected, the purposes, and our retention periods. In the last twelve months we collected the categories listed in Section 3, from the sources in Section 3.1, for the purposes in Section 4, and disclosed them for business purposes to the categories of recipients in Section 7. Our position on sale and sharing is in Section 8.

California law does not exempt employee, applicant, or business-contact data. If you are one of our own personnel or applicants, or a business contact, you have the same rights, and we provide our personnel with a separate notice at collection covering employment-context processing.

Under California's "Shine the Light" law you may request information about disclosures to third parties for their own direct marketing. We do not make such disclosures. To exercise any California right, email stationproai@gmail.com or use our contact form. Because we operate exclusively online and deal with you directly, we provide an email address and a web form rather than a toll-free number.

13.2 Other states

Residents of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have rights under their own state laws. We extend the full set in Section 12 to everyone, so you do not need to identify which law applies.

• Appeals: every one of these states except Utah gives you a right to appeal a declined request. We offer it to everyone. See Section 12.4.
• Maryland: we apply Maryland’s stricter standard everywhere, collecting only what is reasonably necessary and proportionate, holding sensitive data to strict necessity, and never selling sensitive data.
• Minnesota: you may question the result of profiling and ask what data informed it. See Section 8.4.
• Texas and Nebraska: we confirm here that we do not sell sensitive or biometric personal information.
• Oklahoma: a comprehensive law takes effect January 1, 2027, and we will meet it when it does.

13.3 Nevada

Nevada residents may direct us not to sell covered information. We do not sell it, but you can still register a direction by emailing us.

14.International transfers and EEA, UK, and Swiss rights

14.1 Where data is stored

StationPro operates in the United States and customer data is stored in the United States. If you access the Service from outside the US, your information is transferred to and processed in the US, which may have data protection rules different from your own.

14.2 Transfer safeguards

For transfers of personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses, together with the UK Addendum or the International Data Transfer Agreement for UK transfers, supported by a transfer impact assessment. Where an adequacy decision or certification framework applies to a particular transfer, we may rely on that as well, but we maintain Standard Contractual Clauses as our primary safeguard so that a change in the status of any framework does not interrupt protection. You can request a copy of the safeguards we use by emailing us.

14.3 Additional rights

If you are in the EEA, the UK, or Switzerland you also have the right to object to processing based on legitimate interests, the right to restrict processing, the right to withdraw consent, and the right to lodge a complaint with your supervisory authority. In the UK that is the Information Commissioner's Office. In the EEA it is the authority in your country of residence or workplace. We would ask you to raise it with us first so we can try to put it right.

14.4 Representative and privacy contact

Our privacy contact is reachable at stationproai@gmail.com. We have not appointed a Data Protection Officer because our processing does not meet the thresholds that require one under Article 37. If and where we are required to appoint a representative under Article 27 of the GDPR or the UK GDPR, their details will be published here.

15.Changes to this policy

We may update this policy as our practices, our product, or the law changes. When we do, we will change the "Last updated" date at the top and bottom of this page and post the new version here.

For changes that materially affect how we handle personal information, we will give notice before the change takes effect, by email to account contacts or through a prominent notice in the Service and on this page. Where the law requires your consent for a change, we will ask for it rather than assuming it. We keep prior versions and will provide one on request.

16.How to reach us

For any question about this policy, to exercise a right, or to raise a concern, contact us. We aim to answer every privacy enquiry within 10 business days.