Privacy policy

Draft for review. Replace the text in [square brackets] and have a solicitor check this page before relying on it.

This policy explains how Kitchio (“we”, “us”) handles personal information. Kitchio is a trading name of [Kitchio Ltd, a company registered in England and Wales, company number 00000000, registered office: address]. Contact us about privacy at hello@kitchio.co.uk.

Who this policy covers

We handle personal information in two different roles:

• As a controller, for people who visit kitchio.co.uk, book a demo, fill in our onboarding form, or are our restaurant clients and their staff. We decide how this information is used.
• As a processor, for customers who order from a restaurant's website built with Kitchio. The restaurant is the controller of that information and decides how it's used; we store and process it on the restaurant's behalf and only on its instructions. If you ordered from a restaurant, contact that restaurant first about your information. Their privacy policy applies.

What we collect

• Demo requests and onboarding: your name, email, phone number, restaurant details, and any files you upload such as your logo, menu and photos.
• Restaurant clients: contact details, billing information, and notes about our work together.
• Staff logins: a session cookie that keeps you logged in to a restaurant dashboard or Kitchio Manage.
• Restaurant customers (as a processor): name, email, phone, delivery address, order details, loyalty points, reviews and order history. Card details are entered directly with Stripe and never reach Kitchio.
• Technical information: IP address and browser details, which our hosting provider logs to keep the service secure and working.

Why we use it, and our lawful basis

• To reply to demo requests and set up your restaurant: steps taken at your request before entering a contract, and contract once you're a client.
• To run, secure and improve the service: legitimate interests.
• To meet tax, accounting and legal duties: legal obligation.
• To send you occasional updates about Kitchio if you're a client or have asked about the service: legitimate interests. You can opt out at any time.

We don't sell personal information, and we don't use restaurant customers' information for our own marketing.

Who we share it with

We use trusted suppliers who process information for us under contract:

• Vercel: website hosting.
• Supabase: database and file storage.
• Stripe: card payments, processed in each restaurant's own Stripe account. Stripe handles payment information under its own privacy policy.
• postcodes.io: looks up postcodes to work out delivery distances. Only the postcode is sent.
• Google Fonts: serves the typefaces on our pages, which means your browser connects to Google.
• Formspree: delivers demo request messages to our inbox.

Some suppliers may process information outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to protect it.

How long we keep it

• Demo requests and onboarding submissions that don't become clients: up to 12 months.
• Client records and invoices: for as long as you're a client, then 6 years for tax and legal reasons.
• Restaurant customer information: as long as the restaurant is a client, then deleted or returned to the restaurant within 90 days of the contract ending, unless the law requires us to keep it.

Cookies and storage

We only use what's needed for the service to work: a login cookie for dashboards, and browser storage that remembers a customer's basket, details for faster checkout, diet and allergy filters and recent orders. We don't use advertising or tracking cookies, so there's no cookie banner.

Your rights

Under UK data protection law you can ask to see, correct or delete your information, object to or restrict how we use it, and ask for a copy to take elsewhere. Email hello@kitchio.co.uk and we'll reply within one month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Keeping it safe

Information is encrypted in transit, the database is only reachable from our servers, staff areas are password protected, and access to client data is limited to the people who need it.

Changes

We'll update this page if anything changes, and tell clients directly about significant changes.