Privacy Policy

1. What this system is

This is the internal operations system of MOCHA Midwest Inc. Our own staff use it to take wholesale orders from business customers, pick those orders in our warehouse, plan delivery routes, and keep our invoicing straight.

It is not a consumer product and it is not open to the public. There is no public sign-up. The only people who can sign in are employees whose accounts we create ourselves.

2. Who we are

MOCHA Midwest Inc.
432 Diens Dr, Wheeling, IL 60090, United States
(872) 328-2628 · midwest@mochaboba.com

3. What information the system holds

• Business customer records — business name, contact name, phone, email, billing and shipping addresses, delivery instructions and receiving hours.
• Order and invoice records — products, quantities, prices, freight charges, delivery status, and whether payment has been received.
• Product records — names, pack sizes, weights, dimensions, prices and stock counts.
• Employee accounts — name, role, sign-in credentials, and a log of actions taken in the system.
• Delivery vehicle location — recorded only while a driver is signed in and on an active delivery route, and only for the purpose of dispatch and proof of delivery. It is not used to track staff outside working hours, and it stops when the route is closed.

We do not collect information from members of the public. This system carries no advertising, no analytics trackers, and no third-party marketing tags.

4. QuickBooks Online

An administrator of our own QuickBooks Online company can connect this system to that company. When connected, the system reads:

• the product and service list, including sales prices and quantities on hand;
• customers;
• invoices.

Connecting and disconnecting

The connection is made through Intuit's standard OAuth flow. We store the resulting access and refresh tokens encrypted, and nothing else about your Intuit account.

You can disconnect at any time, either from within QuickBooks Online under Apps → My Apps, or at ops.mochamidwest.com/api/qbo/disconnect. On disconnection we stop all access immediately and delete the stored tokens.

5. Service providers

We use a small number of providers to run the system. Each receives only what it needs to do its job:

• Vercel — hosts the application.
• Supabase — hosts the database and handles employee sign-in. Data is stored in the United States.
• Anthropic — when an order arrives as a written message, the text of that message is sent to Anthropic's API so the system can work out which products and quantities were ordered. The message may contain the customer's business name and what they asked for.
• UPS and LTL freight carriers — receive the shipping address and package details for shipments we actually book with them.
• Google — provides mapping and routing for delivery planning.

We do not sell data to anyone, and we have no arrangement with anyone to receive data for their own purposes.

6. Security

• All traffic is encrypted in transit (HTTPS). Data is encrypted at rest.
• Access is limited to employee accounts we create, and each account can only reach what its role needs. This is enforced in the database itself, not only in the interface.
• API credentials are held as server-side environment variables and are never exposed to the browser.
• Changes to orders, prices and invoices are written to an audit log recording who made them and when.

7. How long we keep things

• Order and invoice records — kept for as long as our accounting and tax obligations require, and no longer than needed after that.
• Employee accounts — deactivated when someone leaves. Their audit log entries remain, because a record of who did what has to stay intact.
• Delivery route and vehicle location records — kept as part of the delivery record for that order, so that a delivery dispute can be answered.
• QuickBooks access tokens — deleted as soon as the connection is disconnected.

8. Our customers

Our customers are businesses, and the information we hold about them is business contact and trading information. If you are one of our customers and want to know what we hold about your business, want it corrected, or want it removed where we are not required to keep it, write to midwest@mochaboba.com and we will answer.

9. Children

This system is a workplace tool and is not directed at anyone under 18.

10. Changes to this policy

If we change how the system handles data, we will update this page and change the date at the top.

11. Contact

Questions about this policy, or about anything on this page: midwest@mochaboba.com · (872) 328-2628 · MOCHA Midwest Inc., 432 Diens Dr, Wheeling, IL 60090.