Privacy Policy

TipGuard is operated by Draft Labs. Contact: privacy@draftlabs.org.

TipGuard is an early-stage product under active evaluation. It is not a law firm and nothing it produces is legal advice.

When you create an account we store your email address and, if you use Google sign-in, the name and email Google returns. Passwords are handled by our authentication provider and are never stored in a form we can read.

We also store what you enter in the product: your restaurant name, home state, audit-readiness questionnaire answers and the resulting score and gap list.

This is the part that matters most, so it is stated in full. When you import a roster we store, for each employee: name, email address, job role, hire date, hourly rate, home state, and whether they participate in a tip pool.

When an employee signs a notice we additionally record the name they typed, the timestamp, a frozen copy of the exact notice text they agreed to, and — because a signature record is worthless as evidence without them — the IP address and browser user-agent of the device used to sign.

You are the controller of that employee data; we process it on your instructions. Telling your staff that this record exists is your responsibility, and in most cases it is also a legal one.

The signature vault is append-only by design, enforced at the database level. A compliance record that could be quietly altered after the fact would be useless to you in an audit, so we made it impossible — for you and for us. Signature rows are removed only when the account that owns them is deleted, and then all of them go together.

We use PostHog to understand how the product is used — which pages are viewed, which actions are taken, and where people abandon a flow. This is how an early-stage product learns whether it is worth continuing.

Analytics events carry a random identifier, not your name. URLs that contain a signing token are stripped before any event leaves the browser, so a link that would let someone sign on an employee’s behalf never reaches our analytics.

We use a small number of sub-processors, each for one job: Supabase (database and authentication), Vercel (hosting), Resend (sending notice and account email), PostHog (product analytics), and Anthropic (generating plain-English explanations of compliance findings).

Compliance scoring, violation detection and the audit file are deterministic — they are computed in our own code and are never sent to a model.

We do not sell personal data, and we do not share it for advertising.

Data is stored in the United States. We keep it for as long as your account exists. Delete your account and the associated records — employees, notices, signatures, findings — are deleted with it.

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it, by emailing privacy@draftlabs.org. Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA; we will honour those requests regardless of where you are.

If you are an employee of a TipGuard customer and want your record amended or removed, contact your employer first — it is their record. If that fails, write to us and we will help.

If we change how data is handled, we will update this page and its date. Material changes will be notified to account holders by email.