This policy explains what personal data Cep collects, why, and how it's handled, in line with UK GDPR and the Data Protection Act 2018. The data controller is [Business/Trading Name — e.g. "Cep", a sole trader business operated by [Your Name], registered address [Address], United Kingdom]. Contact for privacy questions or to exercise your rights: [support@yourdomain].
| Data | Why |
|---|---|
| Email address, password (stored as a salted hash, never in plain text) | Account creation and login |
| Business/menu data you enter: ingredients, recipes, dish prices, costings, supplier prices, staff rota entries, holiday requests, temperature check logs, allergen records, certifications | Providing the core Service to you and your organisation |
| Photos you upload: dish photos, price list photos, food safety certificates | Populating dish specs, and — for price lists and recipes — extracting structured data via AI |
| Team member emails and roles, if you invite colleagues | Managing access within your organisation |
| Details of your staff that you choose to enter: name, role, hourly pay rate, date of birth, apprentice and pension status. Pay and date of birth are visible to directors only. | Working out what each person really costs the business (employer's National Insurance, pension and holiday pay) on the director pages |
| Clock-in records: the time, and how far from the restaurant the phone was. The phone's location is read once, at the moment of clocking in, to check the distance. The coordinates themselves are not stored. | Showing who is on site, and checking clock-ins are made at the restaurant |
| Daily takings and till reports you enter or upload: sales totals and the items sold | Sales reports, gross profit and forecasts |
| Payment details | Billing — handled entirely by Stripe; we never receive or store your full card number |
| Basic technical data: IP address, request logs | Security, rate-limiting, and abuse prevention |
When you upload a supplier price list, recipe document, dish photo or end-of-day till report for automatic reading, the image or document content is sent to Anthropic (the maker of the Claude AI models) for processing, so it can be read and converted into structured ingredient/recipe data. Anthropic acts as a data processor for this purpose under its own API terms and does not use data submitted through business API access to train its models. We only send what's needed to perform the extraction you asked for.
Anthropic's API infrastructure may process data outside the UK/EEA (including in the United States). Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses, as required under UK GDPR.
We use one strictly necessary cookie (fc_session) to keep you signed in. It's not used for tracking, advertising, or analytics, and isn't shared with third parties. We don't currently use marketing or analytics cookies.
We retain your account and business data for as long as your account is active. If you'd like your account and data deleted, contact us at [support@yourdomain] and we'll delete it, typically within 30 days, except where we're required to keep certain records for legal or accounting purposes (e.g. billing history).
Under UK GDPR, you have the right to:
To exercise any of these, contact [support@yourdomain].
We share data only with the processors needed to run the Service: Anthropic (AI extraction), Stripe (payments), Railway (hosting/database), and Cloudflare (photo storage). We don't sell your data or share it with advertisers.
We may update this policy as the Service changes. We'll update the date at the top of this page when we do; material changes will be flagged in the app.
[support@yourdomain]