Privacy Policy

This policy explains how ProCafe handles personal data. It is written for UK data protection law (UK GDPR and the Data Protection Act 2018).

ProCafe is referred to in this policy as “ProCafe”, “we” and “us”.

Who is responsible for your data

When you use ProCafe to run your cafe, you (the cafe) are the controller of your staff and operational records — staff names, shifts, time-off requests, food-safety readings, handover notes and similar. ProCafe is your processor: we process that data on your instructions, as set out in our Data Processing Agreement.

ProCafe is the controller of its own data: your account details, billing, support correspondence, any marketing you opt in to, and our security and audit logs. This policy covers that controller role.

What we collect and why

• Account identity — name and email of the owner/manager, and a one-way hash of your password (we never store the password itself). Basis: performance of our contract with you.
• Staff & operational data you enter — held on your behalf as your processor. We do not decide why it is collected; you do.
• Billing — payments are handled by Stripe, our payment processor. Card details are entered directly with Stripe; ProCafe never receives or stores full card numbers. Basis: contract and our legal obligations.
• Support & security logs — to run, secure and support the service. Basis: our legitimate interests in operating a safe service.

Special-category data

We do not ask for health or other special-category data, and we ask you not to put it in free-text fields. For example, the time-off note field warns: “Do not include medical or sensitive personal details.” If sensitive data reaches something we control, we redact or delete it where we can.

Cookies & analytics

In the signed-in app we use strictly-necessary cookies only: a session cookie to keep you signed in and, if you choose “remember this device”, a token cookie so that browser can skip the two-factor step. These are not used for tracking.

On our public pages (marketing, help, legal, security and contact) we use Google Analytics to understand visits and traffic at a high level. It sets analytics cookies and shares usage data with Google as a sub-processor. Analytics is not loaded in the signed-in app or the internal admin area, so your operational and account pages are not tracked.

Analytics runs only with your consent: we ask on your first visit and load nothing analytics-related until you accept. You can change your choice at any time via the “Cookie settings” link in the footer of any public page. See our Cookie Policy for the full list of cookies.

Where your data lives

The service and its database are hosted in the EU, with encrypted backups held with a separate EU-region provider. Some sub-processors (for example email delivery or payments) may process limited personal data outside the UK; where they do, transfers are protected by UK adequacy regulations or the UK International Data Transfer Agreement/Addendum, as listed against each provider in the Sub-processor List.

How long we keep it

Retention is set out in the Retention Schedule. In short: your data lives for the life of your account; backups age out on a rolling window; logs are kept only as long as needed.

Who we share it with

Only the sub-processors that help us run the service — see the Sub-processor List. We do not sell personal data.

Your rights

You can ask to access, correct, delete, restrict, object to or port your data. Because much of the data in ProCafe belongs to a cafe (the controller), a staff member’s request usually goes to their employer; ProCafe helps as processor. Contact support@procafe.app. You can also complain to the Information Commissioner’s Office (ICO). We respond to requests within one month, as UK GDPR requires.

Security & breaches

Our security measures and how to report a problem are on the Security page. If a personal-data breach is likely to put people at risk, we notify the affected customers without undue delay and the ICO within 72 hours where required.

Contact

Questions about this policy or your data: contact ProCafe.