Bitewise Privacy Policy
DRAFT FOR SOLICITOR REVIEW. Not legal advice. Drafted from the Bitewise code, database schema and design documents. No lawyer has reviewed it. Do not publish it or rely on it until a UK solicitor has approved it and every [PLACEHOLDER] is filled.
Last updated: [DATE]
1. Who we are
Bitewise is operated by [COMPANY NAME], a company registered in England and Wales (company number [COMPANY NUMBER]), registered office [REGISTERED ADDRESS] ("Bitewise", "we", "us"). We are registered with the Information Commissioner's Office under number [ICO REGISTRATION NUMBER].
Contact for anything in this policy: [PRIVACY EMAIL].
Bitewise is a booking and pre-ordering service for restaurants. Diners reserve a table and choose their dishes in advance through the Bitewise mobile app. Restaurants run their side through the Bitewise web portal. Bitewise never takes payment from diners. Diners pay the restaurant in person.
For the personal data in your Bitewise account we are the controller. When a booking reaches a restaurant, that restaurant becomes a separate controller of the booking details it receives and must handle them under its own privacy notice.
2. What personal data we collect
If you are a diner (mobile app)
| Data | How we get it | Why |
|---|---|---|
| Name | You enter it when you create an account | To set up your account and identify you |
| Email address | You enter it when you create an account | To sign you in, confirm your email, and send booking emails |
| Password | You choose it | To sign you in. We never see it in readable form; our authentication provider stores only a hash |
| Phone number (optional) | You may add it to your profile | So the restaurant or Bitewise can reach you about a booking [VERIFY: confirm whether the app lets you add this at launch] |
| Dietary preference (optional) | You may add it to your profile | To help you choose dishes. See section 3 |
| Bookings | You make them | Restaurant, date and time, number of guests, status, booking reference, optional note to the restaurant, and the history of amendments and cancellations |
| Dish choices | You make them | Which dishes each guest pre-ordered, with the price and 5% discount worked out at the time of booking |
| Impact figure | We calculate it | The food waste your pre-orders are estimated to have avoided, worked out from each restaurant's own declared figures |
| Saved restaurants and reviews | You create them | To show your saved list and, where you leave one, a review |
| Notification preference and push token | You switch notifications on or off; your phone generates the token | To send booking reminders and updates to your device [VERIFY: the database and server side exist; the app must register the token before launch] |
| Location | Your phone, only if you allow "while using the app" | To show restaurants near you. If you decline, we use Southampton city centre instead. See section 3 |
| Technical data | Automatic | IP address and device and request details are seen by our hosting and database providers when your app connects, and appear in their security and operational logs |
If you work at a restaurant (web portal)
| Data | Why |
|---|---|
| Name, email address, password (hashed) | Your account |
| Your role at the restaurant (owner, chef, front of house) | To control what you can do in the portal |
| Actions you take (for example marking a booking completed or cancelling it) | A booking's history records who did what |
| Your name, email and role, visible to the other members of your restaurant's team on the team page | So owners can manage who has access |
| If you are invited by email: the invited email address, role and a one-way hash of the invitation token | To let you join. The token itself is not stored |
Restaurant business data
Restaurants give us their business name and address, opening and sitting times, menus and prices, photos, and their own waste figures and stock costs. This is mostly business information rather than personal data, but it can include the name of an owner or staff member. Restaurants' subscription billing is handled by Stripe (section 4).
What we do not collect
We do not collect payment card details from diners. We do not use advertising identifiers, advertising networks or analytics trackers in the mobile app or the web portal [VERIFY at launch: update this line if Sentry or PostHog is enabled]. We do not sell personal data.
3. Dietary and health information, and location
Dietary preference and notes. A dietary preference such as "vegetarian", "halal" or "coeliac", or an allergy mentioned in a booking note, can reveal information about your health or religious beliefs. This is "special category" data. We only process it because you choose to give it to us, and we ask for your explicit consent when you enter it [REQUIRES BUILD: consent wording at the point of entry]. You can remove it at any time by editing your profile or note. Bitewise does not verify allergen information and is not a substitute for telling restaurant staff about an allergy in person.
Location. The app asks permission to use your location "while using the app". Your phone gives the app your coordinates, and the app sends them to our database as part of a search so that restaurants can be sorted by distance. We do not store your coordinates in your profile or booking records. They may appear briefly in the technical logs of our providers. You can refuse permission and still use the app with Southampton city centre as the search centre, and you can withdraw permission in your phone settings at any time.
4. Who we share data with
Restaurants. When you book, the restaurant receives the booking: reference, date and time, number of guests, the dishes chosen, any note you wrote, and whether you later amend, cancel, or are marked as having attended or not turned up. The restaurant's portal shows your first name (or "Guest" if you have not given one), but not your surname, email address or phone number. The restaurant is a separate controller of what it receives.
Our service providers (processors). They process data only on our instructions to run Bitewise:
| Provider | What it does for us | Personal data it handles |
|---|---|---|
| Supabase | Database, sign-in, file storage, real-time updates and scheduled functions (region: [SUPABASE REGION]) | All account and booking data described above |
| Vercel | Hosts the restaurant web portal and these web pages | Staff account sessions, IP addresses and request logs for portal visitors |
| Resend | Sends booking emails (confirmation, amendment, cancellation, reminders) [VERIFY: live at launch] | Your name, email address and the booking details in the email |
| Expo (Expo Push service, and Apple and Google push services) | Delivers push notifications [VERIFY: live at launch] | Your push token and the notification text |
| Stripe | Takes restaurants' monthly subscription payments. Never used by diners | Restaurant owners' name, email and card details, which go straight to Stripe and not through our servers. Stripe is also an independent controller for its own fraud and regulatory purposes |
| postcodes.io | Turns a restaurant's business postcode into map coordinates | Only a restaurant's business postcode. No personal data |
| Anthropic (Claude API) | Reads a menu PDF or photo that a restaurant chooses to upload, to suggest dishes for the owner to review [VERIFY: active only while the server holds an Anthropic API key] | The content of the menu file. It is business content; restaurants should not upload files containing personal data. Nothing is saved until the owner approves it |
| Sentry or PostHog | Crash reports or usage statistics [VERIFY: delete this row unless enabled] | Technical error data / usage events |
Apple and Google, through the App Store and Google Play, are independent controllers of the data they collect when you download and use the app.
Bitewise staff. A small number of Bitewise administrators can look up a booking by its reference to give support. Each lookup and each administrative action is recorded in an audit log.
Others. We may disclose data if the law requires it, to protect people's safety, or in a sale or restructuring of the business (the buyer would be bound by this policy).
5. International transfers
Some of our providers are part of groups headquartered outside the UK, in particular in the United States. Where personal data is transferred outside the UK we rely on a UK adequacy decision, the UK-US Data Bridge where the recipient participates, or the ICO's International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, together with additional safeguards where needed [VERIFY: solicitor to confirm the mechanism for each provider]. Contact us if you would like more information about the safeguards.
6. Our lawful bases
| What we do | Lawful basis (UK GDPR Article 6 unless stated) |
|---|---|
| Create and run your account, take and manage your bookings, send booking confirmations, amendments and cancellations | Contract: we need to do this to provide the service you asked for (6(1)(b)) |
| Send reminders and cut-off alerts as push notifications | Your consent through your phone's permission prompt, which you can withdraw in your phone settings or in the app (6(1)(a)) |
| Dietary preference and health information you choose to give | Your explicit consent (Article 9(2)(a)) |
| Use your device location to sort restaurants by distance | Your consent through your phone's permission prompt (6(1)(a)) |
| Calculate and show your food waste impact | Contract (6(1)(b)) |
| Keep the service secure, prevent abuse, fix faults, keep booking history for disputes | Legitimate interests (6(1)(f)): running a safe, reliable service |
| Public reviews you choose to post | Legitimate interests (6(1)(f)) of other diners and restaurants in honest reviews |
| Restaurant staff accounts | Contract with the restaurant, and legitimate interests (6(1)(f)) |
| Restaurant billing records and tax records | Legal obligation (6(1)(c)) |
| Marketing emails | None are sent at launch. If we start, we will ask for your consent first |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
7. How long we keep data
These are the periods we apply [DECISION: confirm each one; automated deletion is REQUIRES BUILD].
| Data | Kept for |
|---|---|
| Account (name, email, phone, dietary preference, preferences) | Until you delete your account |
| Bookings, dish choices and booking history | 24 months after the booking date, then anonymised so no longer linked to you. We keep anonymised totals for impact reporting |
| Reviews | Until you delete your account, then anonymised or removed |
| Saved restaurants | Until you remove them or delete your account |
| Restaurant staff accounts | Until the restaurant removes you or you delete your account |
| Restaurant subscription and charity contribution records | 6 years, to meet tax and accounting obligations |
| Provider logs (hosting, database, sign-in) | The provider's standard period, typically days to a few months [VERIFY per provider] |
| Backups | Deleted data can remain in encrypted backups until they expire, currently up to [BACKUP RETENTION] [VERIFY against the Supabase plan] |
8. Your rights
Under UK data protection law you can ask us to: access the personal data we hold about you; correct it; erase it; restrict how we use it; give you a copy in a portable format; and object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time.
How to use them:
- Change your details: in the app, open your profile and edit your name, phone, dietary preference and notification setting.
- Cancel a booking: in the app, before the restaurant's cut-off, or contact the restaurant.
- Delete your account: in the app, under Bookings, Your account, then Download or delete my data; restaurant staff can do the same under Account in the portal; or follow the steps on our public page /delete-account, which also says how to ask by email at [SUPPORT EMAIL]. Your sign-in, profile, reviews, saved restaurants and notes are deleted and your upcoming bookings are cancelled. Past bookings are kept on the restaurant's records without your name, so the restaurant's own figures stay correct. We keep a note that an account was deleted (a one-way code that cannot identify you, and the date) to show we honoured the request. If you are the only owner of a restaurant on Bitewise you must first make someone else an owner, or ask us to close the restaurant.
- Get a copy of your data: in the app (Download my data) or in the portal (Account, Download my data), as a file you can keep or give to another service, or email [PRIVACY EMAIL]. The copy covers your profile, bookings with what you ordered and the history of changes, reviews, saved restaurants and restaurant team memberships. It leaves out the codes used to send notifications to your phone.
- Anything else: email [PRIVACY EMAIL]. We will reply within one month. We may need to confirm who you are first. There is no charge unless a request is clearly unfounded or excessive.
Restaurants hold their own copy of booking details. To exercise rights over that copy, contact the restaurant.
9. Cookies and similar technologies
Web portal and these web pages. We use only strictly necessary cookies: the sign-in session cookies set by our authentication provider (their names begin "sb-") so that staff stay logged in [VERIFY: check names in the browser developer tools before launch]. They are removed when you sign out or they expire. We do not use advertising, analytics or tracking cookies, so we do not show a cookie banner. If that changes we will ask for your consent first.
Mobile app. The app does not use cookies. It stores your sign-in session on your device so you stay signed in, and removes it when you sign out.
10. Security
Data is sent over encrypted connections. Access to data is controlled by database rules so that a diner can only read their own bookings and a restaurant only its own bookings, enforced in the database itself and not just in the app. Staff roles limit what restaurant users can do. No system is perfectly secure; if a breach is likely to put you at risk we will tell you and the ICO as the law requires.
11. Children
Bitewise is for people aged 18 or over [DECISION]. We do not knowingly collect data from children. If you believe a child has created an account, contact [PRIVACY EMAIL] and we will delete it.
12. Changes to this policy
We will post any changes here and, for significant changes, tell app users in the app or by email.
13. Complaints
Please contact us first at [PRIVACY EMAIL] so we can try to put things right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113.