Privacy Policy
Effective: [EFFECTIVE DATE] · Last updated: [EFFECTIVE DATE]
1. Who we are
"Legacy", "we", "us" and "our" means [LEGAL ENTITY NAME], trading as Legacy, of [REGISTERED / POSTAL ADDRESS]. [COMPANY NUMBER, if a limited company, or delete]. ICO registration: [ICO REGISTRATION NUMBER, or delete this line if exempt].
Contact for all privacy matters: [email protected]. We have not appointed a Data Protection Officer because we are not required to; the contact above handles all data protection queries.
2. Our two roles: controller and processor
- Controller. We are the controller for data we use to run our own business: account holder details, billing, support enquiries, website visitors and business contacts.
- Processor. The kitchen records your business stores in Legacy (temperature logs, cleaning and opening/closing checks, HACCP and Safer Food Better Business style records, traceability, supplier, recipe and costing data, and staff names attached to entries) belong to your business. For that data, your business is the controller and we process it only on your documented instructions, as set out in the Data Processing terms in our Terms of Service.
If you are a member of staff at a kitchen that uses Legacy, please contact your employer first about records they hold about you; we will assist them.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, business name, site name, role, password (stored hashed by our authentication provider) | You |
| Team member data | Names, emails and roles of staff the account owner invites; who logged which entry and when | Account owner / staff |
| Kitchen records (processed on your behalf) | Temperatures, checks, batch and lot numbers, suppliers, recipes, ingredient costs, notes and photos you upload | You |
| Billing data | Plan, invoices, payment status. Card details are handled by our payment provider; we never see or store full card numbers | You / payment provider |
| Communications | Emails and support requests | You |
| Technical data | IP address, browser and device type, timestamps, security and error logs | Your device |
We do not intentionally collect special category data (such as health data). Please do not enter it in free-text fields. If a record genuinely requires it (for example, a staff illness exclusion log), your business is responsible for having a lawful basis for that.
4. Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and running your account, providing the service | Contract |
| Taking payment, invoicing, keeping accounting records | Contract; legal obligation (tax law) |
| Security, fraud prevention, backups, fixing errors | Legitimate interests (keeping the service safe and working) |
| Service emails (password resets, billing, important changes) | Contract |
| Replying to enquiries | Legitimate interests |
| Product updates and marketing emails | Consent, or for existing customers the PECR "soft opt-in"; you can unsubscribe at any time |
| Contacting businesses about Legacy (B2B) | Legitimate interests, using publicly listed business contact details; you can object at any time |
| Complying with law, defending legal claims | Legal obligation; legitimate interests |
We do not sell personal data, and we do not use it for automated decision-making that has legal or similarly significant effects on you.
5. Features coming soon
Voice logging and invoice auto-read are not yet available. Before we launch either feature, we will update this policy to explain what audio or document data is processed, by whom and for how long, and we will make it opt-in.
6. Cookies and similar technologies
This website does not use advertising or analytics cookies. We use only what is strictly necessary:
- Our hosting/security provider (Cloudflare) may set strictly necessary security cookies to protect against abuse.
- The Legacy app uses browser storage to keep you signed in. This is essential to provide the service you ask for.
- This website loads fonts from Google Fonts, which means your IP address is sent to Google to deliver the font files.
Under PECR, strictly necessary storage does not need consent. If we ever add analytics or other non-essential cookies, we will ask for your consent first with a cookie banner and update this section.
7. Who we share data with (sub-processors)
We use trusted suppliers to run Legacy. They act on our instructions under data processing terms.
| Supplier | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, content delivery, security | Global network (incl. USA) |
| Supabase, Inc. | App database, authentication and file storage | [CONFIRM REGION, e.g. EU/UK] |
| Lovable (Lovable Labs Incorporated) | App build and hosting platform | EU / USA |
| Google LLC (Google Workspace / Gmail, Google Fonts) | Email communication; website fonts | USA / global |
| Stripe Payments UK Ltd (when payments go live) | Payment processing | UK / USA |
We may also disclose data where required by law, to professional advisers, or to a buyer if our business is sold (with this policy continuing to apply). We will give account owners notice of new sub-processors by updating this list and, for significant changes, by email.
8. International transfers
Some suppliers process data outside the UK, including in the USA. Where they do, we rely on a UK adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework where the supplier is certified) or on the ICO International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. Contact us for more details.
9. How long we keep data
- Kitchen records: for as long as your account is active, or as your business configures. Food businesses often need to keep records long enough to show compliance to an inspector; your business decides this.
- After cancellation: you can export your data for 30 days. We then delete kitchen records from the live system within a further 30 days, and from backups within 90 days, unless you ask us to delete sooner.
- Billing and accounting records: 6 years after the end of the financial year, as required by UK tax law.
- Support emails: up to 2 years after the enquiry closes.
- Security logs: up to 12 months.
- Marketing contacts: until you unsubscribe or object; we keep a suppression record so we don't contact you again.
10. Security
We use encryption in transit (HTTPS/TLS), encryption at rest provided by our hosting suppliers, hashed passwords, role-based access, and database-level separation so each business can only see its own records. Access by us is limited to what is needed to support and maintain the service. No system is perfectly secure, so please use a strong, unique password and remove staff who leave.
11. Data breaches
If a personal data breach occurs, we will contain it and assess the risk. Where required we will notify the ICO within 72 hours of becoming aware, and tell affected people without undue delay where there is a high risk to them. Where we are your processor, we will notify your business without undue delay so you can meet your own obligations.
12. Your rights
Under UK GDPR you have the right to: be informed; access your data; have it corrected; have it erased; restrict its use; data portability; object (including an absolute right to object to direct marketing); and rights relating to automated decision-making. Where we rely on consent, you can withdraw it at any time.
Email [email protected]. We will respond within one month (extendable by two months for complex requests) and normally free of charge. We may need to verify your identity. Requests about kitchen records will be passed to, or handled with, the business that controls them.
13. Children
Legacy is a business service. It is not designed for or directed at children, and account holders must be 18 or over. Businesses that let staff under 18 log records are responsible for managing that use appropriately. If you think we hold data about a child unlawfully, contact us and we will delete it.
14. Complaints
Please contact us first at [email protected] and we will try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority: ico.org.uk/make-a-complaint, tel. 0303 123 1113.
15. Changes
We may update this policy. We will change the "last updated" date and, for significant changes, notify account holders by email.