What you get
Your own Hub at your own web address, built from your store's roster, stations and numbers. Every tool listed on the setup page, set up for your store rather than handed over as a template.
What it costs
A one-time install fee and a monthly upkeep fee, both quoted for your store before any work starts. Neither changes without you agreeing to it in writing first. Hosting is included in the monthly. Separately, your web address costs about $12 a year, paid by you, because you own it.
Who owns the accounts
We build and maintain your team's records in a database that belongs to your store and holds no other store, and we use reasonable care to keep it that way. You can ask for a full export in a readable format at any time, without a reason and without our permission, and we get it to you as quickly as we reasonably can. If we stop working together it goes with you.
Who owns the data
Your team's records are yours. If you stop working with us we export your records to you in a readable format and use reasonable care to delete the copies we hold. Backups and system logs are deleted as they age out on their normal cycle rather than the same day. We do not sell your store's data or train anything on it. We share it only with the service providers that run the Hub for you, such as our hosting and the AI provider described below, and only so they can do that.
AI features
The Hub uses AI in two ways. Some features are built into the Hub and send information to an outside AI provider. Hub Copilot is different: it connects a Claude account that a person at your store already has to your Hub. This part says what each one sees, what it can and cannot do, and how to turn it off.
AI built into the Hub
These features send information to an outside AI provider, currently Anthropic, to write or read text: the morning summary and focus card, Ask the Hub, the board fill and the setup card, reading invoice photos and the CFA reports or screenshots you give it, the Leadership 101 tutor and the Spanish translation of training material, the night check of the day's records, and learning from the board changes your leaders make by hand. Each feature sends only what that job needs: your store's numbers and schedule, and for some features team members' first names. We take reasonable care not to send anyone's pay rate, home address, ID number or HR file. If you give it a photo, a screenshot or a report, the AI reads what is on it. To choose the right size of AI model for a job, the Hub sends Jev, a service run by TypeSafe, a one-line description of the job, and we take reasonable care that your records do not go with it.
Hub Copilot
Copilot runs in a Claude account that belongs to the person using it, under that person's own agreement with Anthropic and their own account settings, which decide how Anthropic keeps their chats and whether it may use them to improve its models. It sees only what that person's role can already see in the Hub, which can include names, schedules, the board and store totals such as the month's wages. It plans a change, shows it, and waits. The Hub is built so that a change is saved only after a person your store lists says yes, and a change it makes can be undone. Copilot is set up not to ask for, type or keep anyone's CFA sign-in.
What AI does not do
AI can be wrong, so a person checks what it writes before it counts. AI does not publish a schedule or make a decision about anyone's job, and it does not message your team on its own. Copilot can send a message only when a person tells it who it is for and what it says, and says yes. What it writes is a suggestion, not HR, legal, payroll or tax advice.
Your data and the AI provider
Under its business terms with us, the AI provider does not train its models on what the Hub's built-in features send. It keeps what it receives only as long as its business terms with us allow, for running the service and checking it for misuse. What a person sends through Copilot is covered by their own account instead, as above.
Choosing no AI
Your Operator or Executive Director can set AI to None at all in Store Settings, or ask us to. That one switch turns off every AI feature for your store, and Hub Copilot can no longer read or change anything in your Hub. Every input and screen still works by hand: you type the numbers and drop in the files yourself. Features that only exist because of AI, such as the night check and learning from hand edits, stop while AI is off. While AI is set to None at all, the Hub does not send store data to an AI provider. You can change your mind either way at any time.
When this part changes
If we change what this part says, the new words apply to your store only after your Operator or Executive Director reads them and ticks the box to acknowledge them. Each time, you pick AI on or None at all as part of accepting. Before the Hub's built-in features start using a different AI provider, we will tell your Operator in advance, so you can set AI to None at all before the change applies to your store.
Who runs the Hub for you
These outside companies run parts of the Hub for your store. Each one gets only what its job needs, and only so it can do that job.
Cloudflare
Runs the Hub's website and server.
Supabase
Holds your store's database and files.
Resend
Sends the Hub's emails.
Anthropic
The AI provider described in AI features.
TypeSafe
Runs Jev, which picks the size of AI model for a job, as AI features says.
Slack
Carries Hub alerts, only for a store that turns Slack on.
Google Sheets
Reads a schedule sheet, only for a store that links one.
Phone alert services
A phone alert travels through the alert service of the phone's maker, such as Apple or Google, with its words locked so that service cannot read them.
Who owns the software
The Hub's software is ours. We license it to your store to run your store for as long as we work together, and the license ends when we stop. You may not copy it, sell it, give it to another store or business, or reverse engineer it (take it apart to work out how it is built), and you may not let anyone else do those things. None of this touches your team's records, which stay yours as 'Who owns the data' says.
What we do each month
We do the work in this agreement with reasonable care, and with the skill generally accepted as the standard in our industry. That is the promise everything else in this agreement is measured against. Working to it, we keep the Hub running, fix what breaks as quickly as we reasonably can, and make the changes your store asks for within what upkeep covers. Anything larger is quoted separately before it is started.
Stopping
Either side can stop with 30 days' notice. The install fee is not refundable once the build has started. We get you a full export before the last day, and if something outside our control delays it we tell you and get it to you as quickly as we reasonably can. Your web address stays yours, and your database is either handed to an account you name or deleted, your choice. The software stops.
If something goes wrong
Most of this agreement is about what we will do. This part is about what happens if we get it wrong: what we will put right, and what we can and cannot be made to pay.
The most we can owe you
If you have a claim against us under this agreement, for any reason, the most we can be made to pay you in total is the greater of two amounts: the fees you paid us in the 12 months before the event that gave rise to the claim, or $10,000. Fees you paid to set up the Hub count towards that. This is an aggregate limit: a total across every claim added together, not one limit for each claim. The same limit applies to what you can be made to pay us, except for the fees you owe us under this agreement and except for your promise that you have the right to give us the records you give us.
Claims about your team's records are limited higher
If your claim is because we broke the security and confidentiality promises in this agreement — who may see your records, what we will not do with them, and what happens to them when we stop — the most we can be made to pay you in total is $50,000.
What we cannot be made to pay for
We are not responsible for indirect, incidental, special, consequential or punitive damages. That includes lost profits, lost sales, lost savings, lost or damaged data, and the cost of putting another system in place. This holds even if we knew those losses were possible.
What these limits do not cover
None of the limits above, including the list of things we cannot be made to pay for, apply to our own gross negligence or to anything we do deliberately and wrongly. They also do not reduce what you owe us in fees.
If your team's records are exposed
If we find out that records we hold for you have been seen by anyone who should not have seen them, we will tell you. We will tell you what we know, what we are doing about it, and what we do not yet know. Deciding whether to tell the people affected is yours, because they are your team and the records are yours, and we will give you the information we hold that you reasonably need to do it. We will pay our own costs of finding the cause and fixing it. Those are our costs, not a payment to you, and they do not use up the $50,000 limit; that limit is for money we pay to you or pay on your behalf.
What this is not
This is a working agreement in plain words, not a document drafted by a lawyer. Read it properly before you sign it, and have anyone you want look at it first. Tell us what needs changing.
No warranty
The Hub is provided as is and as available. We do not promise it will be free of errors, or that it will run without interruption, or that it will fit any particular purpose you have in mind. The one promise we do make about how we work is the reasonable care promise in 'What we do each month', and that promise stands. We disclaim all implied warranties, including the implied warranties of merchantability, fitness for a particular purpose, and non-infringement. You are responsible for checking any number the Hub produces before you rely on it, in particular anything to do with pay, food safety, or anything you report to Chick-fil-A.
Which law applies
This agreement is under the law of North Carolina. If we ever end up in court over it, that happens in the state or federal courts in Guilford County, North Carolina, and we both agree to that.