Cratebook Privacy Policy

Cratebook is a mobile app published by Salix Limited (NZBN 9429053674067), referred to here as “Salix”, “we” and “us”, under the app identifier nz.salix.cratebook. This policy explains what information the app handles, how it is used, and the rights you have under the New Zealand Privacy Act 2020.

Cratebook is a private staff app for wholesalers that run their ordering website on the Cratebook platform. It signs in to the wholesaler's own system and lets its staff take and manage customer orders, look up customers, work sales leads and answer enquiries from a phone. The wholesaler is the operator of, and responsible for, the records shown in the app. This policy covers the app; it is separate from the privacy policy for our website.

Accounts are created for named staff by the wholesaler. You cannot register yourself, and the app shows nothing until a staff account signs in.

To sign you in and keep you signed in, Cratebook processes:

• Your email address and password: entered at sign-in and sent to your wholesaler's system to authenticate you. Your password is not stored on the device.
• Session tokens: a refresh token held in the device's secure keystore so you stay signed in, replaced each time it is used.

To deliver alerts, and only if you allow notifications:

• A push token: issued by Expo's push service and sent to your wholesaler's system so it can alert you when a new order or enquiry arrives.

While you use the app, it displays your wholesaler's own records, drawn live from its system:

• orders and their lines, customer accounts and their contact details, sales leads with call and visit notes, and enquiries sent through the wholesaler's website.

The app keeps a copy of these on the device for up to a day, so lists stay readable without signal. Signing out deletes that copy.

Orders you bring in from a message. If you paste a customer's message into a new order, share a message or picture to Cratebook from another app such as WhatsApp, or take or choose photos of an order list, the app sends that text or those images to your wholesaler's system, which reads the products and quantities into a draft order. The app reads your clipboard only when you tap Paste, receives only what you choose to share, and sends nothing from your photos that you did not choose.

What the app does not do: it does not request your location or contacts; it uses the camera only when you choose to photograph an order; it uses no advertising identifiers; it contains no third-party advertising or analytics SDKs; and it does not track you across other apps or websites. Tapping a phone number, WhatsApp or map button hands over to that app on your phone.

The information above is used only to run the app for you: to sign you in, to connect to your wholesaler's system and show its records, to read orders you bring in, and to alert you when something new arrives. We do not use it for advertising, and we do not sell or rent it to anyone.

• Your wholesaler's system, which holds its records, receives your sign-in, your push token and any messages or photos you bring in. To read an order from a message or photo it uses Anthropic's Claude, which processes the content for the wholesaler and does not use it to train its models.
• Expo (650 Industries, Inc.), which issues the push token and relays alerts, where notifications are enabled.
• Apple or Google, whose notification services deliver alerts to your device.

Some of these providers may store or process data outside New Zealand; where they do, we take reasonable steps to ensure it is protected to a standard comparable to the Privacy Act 2020.

• Notifications: to alert you to new orders and enquiries. You can decline; the rest of the app still works.
• Camera: only when you tap to photograph an order list.
• Photos: only to let you choose pictures of an order list.
• Network access: to reach your wholesaler's system.

• Data on your device: sign out to clear your session and the cached records, or uninstall the app to remove everything Cratebook has stored.
• Your staff account and push token: contact your wholesaler, or email info@salixtech.co.nz with the subject “Cratebook deletion request”. We will action the request, or pass it to the wholesaler that operates the system, and respond within 20 working days.

Requests about a record held by a wholesaler, such as an order or a customer account, should go to that wholesaler, which is responsible for it.

Sign-in tokens are held in the device's secure keystore, and the app talks to your wholesaler's system and to Expo over encrypted connections. Refresh tokens are replaced on every use, and a wholesaler can end a lost device's access. No online service can promise perfect security, but we treat what the app handles with care.

We may update this policy as the app or our practices change. The “last updated” date at the top always reflects the current version.

Salix Limited (NZBN 9429053674067): info@salixtech.co.nz. For privacy matters, address your message to the Privacy Officer. If you are not satisfied with how we have handled your information, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).