Last updated 6 August 2026
Bluegrass Cookies operates a financial and operations platform used by Crumbl Cookies franchise owners to run their businesses. This policy explains what the platform collects, why, and what we do and do not do with it. It covers both our own use of the platform and its use by customers who license it.
Our customers are business owners. The data the platform handles is business data — sales, labor, inventory, vendor invoices, and business bank activity — belonging to the franchise that supplied it. We are not a consumer product and do not market to or sign up individual consumers.
Bank connections are made through Plaid Inc. When a customer connects an account, they authenticate directly with their bank through Plaid's interface. We never receive, see, or store banking usernames or passwords. Plaid's handling of that information is governed by the Plaid End User Privacy Policy.
Our access is read-only. The platform can read transactions and balances. It cannot initiate a payment, transfer, or any other movement of funds.
We use bank data for one purpose: reconciling what actually cleared against what the customer's books expect — vendor drafts, card-processor deposits, delivery-marketplace payouts, rent, payroll, and sales tax — and projecting cash position forward. We do not use it for advertising, credit decisioning, scoring, or any purpose unrelated to servicing the account that was connected.
A customer can disconnect a bank account at any time from the Connections page in the platform. Disconnecting revokes our access with Plaid and deletes our copy of the access credential. Transactions already imported into the customer's accounting records are retained, because they form part of that business's books.
Only the service providers required to operate the platform, and only to the extent needed to do so: Google Cloud Platform (hosting, database, and secret storage), Plaid (bank connectivity), Intuit QuickBooks Online (the customer's own accounting system), and the customer's own point-of-sale, scheduling, and payroll providers. We also disclose data where legally required.
Data is stored in Google Cloud in the United States, encrypted in transit and at rest. Access credentials — including Plaid access tokens — are held in Google Secret Manager under per-customer access controls, never in application databases or source code. Access to production systems is limited to personnel who need it. Each customer's data is stored in a separate database.
Business and accounting records are retained for as long as the customer's account is active, and afterward as needed to meet tax and accounting recordkeeping obligations. Bank access credentials are deleted as soon as a connection is removed. A customer may request deletion of their data by contacting us; we will honor the request except where a record must be retained by law.
Customers may request access to, correction of, or deletion of their data, and may withdraw a bank connection at any time. Email michael@bluegrasscookies.com and we will respond within 30 days.
If this policy changes materially we will update the date above and notify active customers by email.
Bluegrass Cookies
michael@bluegrasscookies.com