Privacy Policy

This policy explains how ProCafe handles personal information. Its UK sections describe UK GDPR and the Data Protection Act 2018. The Australia and New Zealand information below explains how to contact us and which local privacy rules may apply to you.

ProCafe is referred to in this policy as “ProCafe”, “we” and “us”.

Who is responsible for your data

When you use ProCafe to run your cafe, you (the cafe) decide how to use your staff and operational records — staff names, shifts, time-off requests, food-safety readings, handover notes and similar. In UK GDPR terms, you are the controller of those records and ProCafe is your processor: we process that data on your instructions, as set out in our Data Processing Agreement.

ProCafe is the controller of its own data: your account details, billing, support correspondence, any marketing you opt in to, and our security and audit logs. This policy covers that role too.

What we collect and why

• Account identity — name and email of the owner/manager, and a one-way hash of your password (we never store the password itself). Basis: performance of our contract with you.
• Staff & operational data you enter — held on your behalf as your processor. We do not decide why it is collected; you do.
• Billing — payments are handled by Stripe, our payment processor. Card details are entered directly with Stripe; ProCafe never receives or stores full card numbers. Basis: contract and our legal obligations.
• Support & security logs — to run, secure and support the service. Signed-in mobile apps report their installed version, build number, iOS/Android platform and a randomly generated installation identifier, associated with the user and cafe, together with the time of the report. This helps our support team diagnose version differences. It does not include advertising or hardware identifiers, food-safety records or screen-by-screen activity, and does not depend on notification permission. Basis: our legitimate interests in operating a safe service.

Attendance, private employee records and team messages

For your business, we store attendance times, actual breaks, corrections and approval history. Owner-managed pay information includes hourly and overtime rates, captured rate snapshots, reviewed payable minutes and payroll-preparation totals. These tools do not pay wages or determine employment entitlements.

Venue-location checks and clock-in photos are off by default. In Pro and Operations, an owner can enable them for a location. When you choose to clock in under that policy, a supported app or browser asks for the relevant device permission and submits the location coordinates and accuracy, or the photo, with your staff, location and attendance references. These are stored attendance evidence, not temporary permission checks. There is no background location tracking, facial recognition or automated identity matching. Native location checks require a compatible app version; ordinary clock-in remains available when these requirements are off. Device permission does not establish the employer's lawful basis for using this information.

Private employee records can include contact and emergency-contact details, manually reviewed right-to-work documents and review outcomes, payslips, contract versions, typed signatures and authentication or signing receipts supplied by the employer or employee. Owners manage private personnel records and pay rates; linked employees can access their own permitted payslips and contracts. Clock-in photo review is restricted to owners. Uploaded documents and images can contain information or metadata supplied with the file. The business must choose necessary records, explain its purposes to staff and other people whose details it supplies, and set an appropriate lawful basis and retention instructions.

Team messaging stores message text, sender and conversation membership, timestamps and read state. Site-channel access follows current site permissions; private direct messages are available to their participants, not automatically to every owner. Pending mobile sends are encrypted on the device, but delivered messages are stored by the service and are not end-to-end encrypted. Staff and operational content is not sent to advertising measurement.

Special-category data

A sickness absence classification can reveal health information. Private employee files supplied by the business or employee may also contain health or other sensitive personal information. We process these records on the business's documented instructions. The business must decide what is necessary, meet the applicable requirements for processing sensitive information, inform the people concerned and set appropriate retention instructions. We do not require diagnoses or detailed medical histories to record a sickness absence. Do not include unnecessary medical or other sensitive details in notes, messages or uploaded files.

Cookies & analytics

In the signed-in app we use strictly-necessary cookies only: a session cookie to keep you signed in and, if you choose “remember this device”, a token cookie so that browser can skip the two-factor step. These are not used for tracking.

On our public pages (marketing, help, legal, security and contact) we use Google Analytics to understand visits and traffic at a high level. It sets analytics cookies and shares usage data with Google as a sub-processor. Analytics is not loaded in the signed-in app or the internal admin area, so your operational and account pages are not tracked.

Analytics runs only with your consent: we ask on your first visit and load nothing analytics-related until you accept. You can change your choice at any time via the “Cookie settings” link in the footer of any public page. See our Cookie Policy for the full list of cookies.

If you separately consent to Marketing, we use Meta Pixel and consent-bound Meta Conversions API events to measure Meta advertising. A verified trial or paid subscription event can include Meta browser/click identifiers, hashed account identifiers, IP address, browser user-agent, time and source page. We do not send operational records or passwords. Basis: your consent, which you can withdraw independently of Analytics at any time. See the Cookie Policy for the precise boundary and retention.

Where your data lives

The service and its database are hosted in the EU, with encrypted backups held with a separate EU-region provider. Some sub-processors (for example email delivery or payments) may process limited personal data in other countries. The providers and locations are listed in the Sub-processor List. Where UK transfer law applies, we use an applicable UK adequacy decision or transfer agreement/addendum. Australian and New Zealand businesses should also review their own cross-border handling obligations for staff data entered into ProCafe.

How long we keep it

Retention is set out in the Retention Schedule. In short: your data lives for the life of your account; backups age out on a rolling window; logs are kept only as long as needed.

Who we share it with

Within your business, records are shown to the users permitted by the relevant role, site, document or conversation controls described above. We also use the sub-processors that help us run the service — see the Sub-processor List. We do not sell personal data. We do not share advertising data with Meta unless the visitor has granted the separate Marketing choice.

Your rights

Under UK law, you can ask to access, correct, delete, restrict, object to or port your data. Because much of the data in ProCafe belongs to a cafe (the controller), a staff member’s request usually goes to their employer; ProCafe helps as processor. Contact support@procafe.app. You can also complain to the Information Commissioner’s Office (ICO) about UK matters. We respond to UK GDPR requests within one month where that law requires it.

Australia and New Zealand

Australian and New Zealand customers use the same EU-hosted service described above. If you are in Australia, you can ask us to access or correct the personal information ProCafe holds about you for its own account, billing or support purposes. You can raise an Australian privacy concern with us and, where the Australian Privacy Act applies, with the Office of the Australian Information Commissioner. The Australian Privacy Principles include rules about notice, access, correction and overseas disclosure. They do not impose the UK GDPR's one-month response or ICO reporting rule on Australian requests.

If you are in New Zealand, you can likewise ask us about account, billing or support information we hold about you and raise a concern with the Office of the Privacy Commissioner. Where the New Zealand Privacy Act applies, a decision on an access or correction request is generally due within 20 working days, subject to permitted extensions. Since 1 May 2026, Information Privacy Principle 3A may require a business that collects someone's information from another source to make that person aware of the collection. A cafe entering staff details should review its own notice duties. New Zealand's Principle 12 also governs relevant overseas disclosures; whether using a service provider is a disclosure depends on how the provider uses the information.

For staff and operational records entered by a cafe, contact that cafe first for access or correction. We assist the cafe with requests involving information it controls. For information we handle for our own purposes, contact support@procafe.app directly.

Security & breaches

Our security measures and how to report a problem are on the Security page. If a personal-data breach is likely to put people at risk, we notify affected customers without undue delay. We assess any reporting to the ICO, the Australian regulator or the New Zealand Privacy Commissioner under the applicable local law; the UK 72-hour rule is not a universal deadline for every market.

Contact

Questions about this policy or your data: contact ProCafe.