This policy explains what Nine to Never LLC collects when you use DisplayFleet (the "Service"), why we collect it, who processes it on our behalf, and what you can ask us to do with it. It covers the people who hold accounts with us, the display devices they pair, and the content they upload. It is part of our Terms of Service.
1. What we collect
Account and organization details
- Your name, email address, and a hashed form of your password. Email addresses are stored lowercased so that a case variant cannot create a second identity.
- Your organization's name, its web address slug, the timezone you choose (menu schedules run in it), and the display preferences you set.
- Which organizations you belong to and your role in each, plus whether and when you verified your email address and when you accepted these terms.
- The email addresses you invite to your organization, so the invitation can be sent and redeemed by the person you addressed it to.
Content you upload
- Menus, menu items, categories, descriptions, prices and price overrides, layouts, and the names you give locations, screens, dayparts, and devices.
- Images, video, and font files you upload, along with the resized and transcoded versions the players need. Anything you choose to include in that media is collected with it, so please do not upload personal information you do not need on a menu board.
Device telemetry
Paired display devices report on themselves so that you can tell whether a screen is working:
- a device identifier, the name and serial label you give it, its platform, application version, operating system version, and browser user agent string;
- heartbeats, which record when the device last checked in, and the IP address it last checked in from;
- self-reported screen state: which menu and daypart the player believes it is showing, a digest of the payload it is running, how many elements it drew against how many it expected, which images failed to load, its viewport size, and when it rendered;
- the time a screen's player last fetched its menu, so that a screen that has stopped asking for one is visible to you.
The IP address and the user agent string in that list are the display device's, not yours. What we hold about the browser you sign in with is described under "Your sign-in sessions" below. This telemetry is operational data about equipment, not about the people in front of it: the Service does not collect audience measurement of any kind, so no cameras, no counting, and no proximity or device sensing in the venue.
Billing
Payments are processed by Stripe. You enter card details directly with Stripe through its hosted checkout and billing portal, so your full card number never reaches our systems. We store the Stripe customer and subscription identifiers, your plan and billing status, and the card brand and last four digits that Stripe reports back, so we can show you what is on file.
Records of activity
- An action log of changes made in your organization, which records the acting user's identifier, name, and email address alongside what was changed. It is visible to your own organization, which is what makes it useful to you.
- Server logs generated while handling requests, which carry a request identifier and, where known, the acting user, organization, and device, so that a fault can be traced.
- Records of transactional email we send you, kept by our mail provider.
Point of sale connections
If you connect a point of sale system, we store the access credentials that connection issues us and the mapping between your point of sale catalog and your menus, along with a log of each sync. We request only the access the integration needs to read your catalog. You can disconnect at any time, which stops the exchange going forward.
Cookies
The admin application uses a session cookie to keep you signed in and a cross-site request forgery token cookie to protect form submissions. Both are strictly necessary for the Service to work. We do not use advertising cookies, and the Service contains no third party analytics, advertising, or tracking scripts.
Your sign-in sessions
Your session lives on our server as well as in that cookie. The stored record holds the IP address your browser connected from, the browser user agent string it sent, which account it belongs to, and the time of your most recent request. We hold those two because a session is a credential: recording where and with what one is being used is how a genuine sign-in can be told apart from a cookie copied and replayed from somewhere else, and it is what we would look at if you told us somebody else was in your account.
These records are short lived, and we do not build a sign-in history out of them. Signing out deletes the record for that session. A session left idle for longer than the sign-in timeout, currently 120 minutes, is deleted by a sweep the application runs against its session store as requests come in. Your IP address is also visible to us while a request is being handled, which is how repeated sign-in attempts from one address are rate limited.
2. Why we use it
- To provide the Service: to render your menus, serve them to your screens, and keep your account working.
- To authenticate you and to protect accounts, including rate limiting sign-in and password reset attempts.
- To bill you and to handle failed payments and trial expiry.
- To send transactional email: address verification, password resets, team invitations, device offline alerts, trial reminders, and payment problems. We do not send marketing email from the Service.
- To operate and debug the platform, including diagnosing why a specific screen is not showing what it should.
- To comply with law and to enforce our Terms.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
3. Who processes it for us
We use the following subprocessors. Each handles data only as needed to provide its part of the Service.
| Subprocessor | What it does |
|---|---|
| Stripe | Subscription billing and payment processing. Card details are entered on Stripe and never reach this service. |
| Mailgun | Delivery of transactional email such as address verification, password resets, team invitations, and account alerts. |
| Cloudflare | Storage and delivery of uploaded menu media (R2 object storage), plus DNS and network protection for the service domains. |
| ReliableSite | Hosting of the servers that run the service and its databases. |
Anything you connect yourself, such as a point of sale system, is a separate service under its own privacy terms, and connecting it is your instruction to us to exchange data with it.
When you set a new password, we check it against the Have I Been Pwned service to reject passwords known to have appeared in a public breach. Only the first five characters of an irreversible hash of the password are sent, which is not enough to identify the password or you.
We may also disclose information if we are legally required to, or to protect the rights, safety, and property of our customers or ourselves. If our business is transferred, this information may transfer with it, subject to this policy.
4. Where it is processed
The Service is operated from the United States, and the subprocessors above may process data in the United States and in other countries where they run infrastructure. If you use the Service from outside the United States, you understand that information is processed there.
5. How long we keep it
- Account, organization, and content data is kept while your account is open, and until you ask us to delete it.
- Sign-in session records, and the IP address and user agent they carry, go when you sign out, and a session left idle longer than the sign-in timeout is swept from the store.
- Self-reported screen state: only the five most recent reports per device are kept. Older ones are deleted as new reports arrive, because they are diagnostics, not history.
- Images and video you uploaded for a slide or for a menu design are deleted by a daily sweep, together with their generated versions, once nothing in your account references them any longer and they have been unused for at least a day.
- Backgrounds and uploaded fonts are not part of that sweep. They stay in your media library so that you can use them again on another menu, including one you have replaced, and they are removed when you delete them there, which removes their generated versions with them.
- Action logs and server logs are kept for as long as they are useful for support, security, and debugging, and are then discarded.
- Billing records are kept as long as tax and accounting rules require, and Stripe keeps its own records under its own policy.
- Deleted content goes from the live Service immediately. Copies may persist in backup snapshots or stored object versions until those age out.
6. How we protect it
- Traffic to the Service is served over HTTPS.
- Passwords are stored as one-way hashes, never in a readable form, and a new password is required to be at least ten characters with mixed case and a number, and is rejected if it appears in a known breach corpus.
- API tokens and per-device credentials are stored as digests, so a copy of our database does not yield a usable credential. A device's credential is its own, distinct from any user's, and can be revoked for one device without touching the rest.
- Every tenant-owned record carries its organization, and queries are scoped to the organization in context. That scoping fails closed: a query that has no organization in context returns nothing rather than everything.
- Sign-in, password reset, registration, and device pairing are rate limited, and role checks gate who in your organization can change what.
- Uploaded media is stored with our storage provider and served to your players from a content delivery address. Treat those addresses as public: anyone who has the address of a media file can load it, so do not put anything confidential in menu media. A board itself is not public. It is served only to a display device you have paired, which authenticates with its own credential, and to members of your organization who are signed in.
No service can promise perfect security, and we do not. If we learn of a breach affecting your information, we will notify you as the law requires.
7. Your choices and rights
- See and correct. Your name, email address, and password are editable in your account, and your organization's details in its settings.
- Delete. You can delete your own content in the application. To have your account, your organization, and its content deleted, write to support@displayfleet.com. We will verify the request comes from an owner before acting on it. Deletion is not reversible.
- Get a copy. Write to us and we will provide a copy of the personal information we hold about you.
- Email. The mail we send is transactional and part of the Service, so it cannot be unsubscribed from while an account is open. Alerts such as device offline notices follow the settings in your account.
- Regional rights. Depending on where you live, you may have additional rights over your personal information, including access, correction, deletion, portability, and the right not to be discriminated against for exercising them. Ask us at the address below and we will honor what applies to you.
8. Data you hold about other people
If you invite colleagues, connect a point of sale system, or upload content containing someone's personal information, you are responsible for having a basis to give it to us, and we process it on your instructions to provide the Service to you.
9. Children
The Service is a business tool, not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, write to us and we will delete it.
10. Changes to this policy
We may update this policy. The effective date at the top of this page changes when we do, and we will notify account holders by email before a material change takes effect.
11. Governing law
This policy is governed by the laws of the State of Texas, United States, in line with the governing law and venue provisions of our Terms of Service.
12. Contact
Privacy questions and requests go to Nine to Never LLC:
- Email: support@displayfleet.com
- Post: 5900 Balcones Dr, suite 100, Austin, Texas 78731