Clear records need clear privacy.

1. Who we are and when this policy applies

Food Hygiene Record Book provides the app and related services. For account administration, support, website use and the limited service-activity information described below, Food Hygiene Record Book is the data controller.

When a restaurant or other food business records information about its staff, suppliers or other people, that business decides why the information is used and will normally be the controller for that record. The service processes cloud record content only to provide the backup and team functions chosen by the app user.

Privacy questions and data-rights requests can be sent to support@foodsafetyrecords.co.uk or through the contact page.

2. Information processed

Food-business records

You decide what to enter. Records may include business names and locations, kitchen details, equipment and food temperatures, stock levels, cleaning checks, initials, signatures, notes, food waste, SFBB diary and review entries, date labels and shelf-life dates, supplier and delivery checks, timed food batches, HACCP hazards, controls, critical limits, monitoring, corrective action and review dates, staff training, fire-safety information and fire-safety inspection reports, accident-book entries, the allergens in each dish, probe-thermometer checks, maintenance and pest-control records, action lists, food sent to other sites with its temperatures, and inspection-report content.

Allergy, diet and staff-illness records

From Android version 1.3 and iPhone version 1.9.6, a business can also keep:

• an allergy and special-diet register for people it cooks for, such as children, residents, guests or staff: a name or reference, a group such as a class or room, allergies, whether a reaction can be severe and what to do in an emergency, special diets (for example vegetarian, halal, kosher, coeliac or diabetic), food-texture and drink-thickness levels, who confirmed the information and when to check it again; and
• staff-illness and return-to-work records: the staff member's name, the symptoms they reported and when they stopped, time away from work, the checks made before they returned and who made them.

These records can include health information, and a diet can indicate a religious belief. Data-protection law treats both as special-category information. They are kept in the app's private storage on the phone and are included in the business's optional cloud backup in the same way as its other records. They are not shared with a team, are never used for analytics, advertising or account reporting, and are not readable from our administration console (see section 13). The inspection report shows totals from the allergy register, not names; staff-illness records appear in it with the staff member's name and symptoms, because an inspector may ask to see them. A report or printed kitchen list is created only when someone in the business chooses to create or share it. The business decides whether to keep these records (see section 7), and can erase a person's details in the app at any time, for example when the person leaves or asks (see section 10).

Accident book and fire-safety inspections

From iPhone version 1.9.6 and Android version 1.3.2, a business can also keep:

• an accident book: when and where an accident happened; the person involved (a staff member, contractor, customer, visitor or someone else, by name or a reference); the kind of accident, how it happened, the injury and where on the body; first aid given and by whom; whether they went to hospital, whether the injury was serious and whether a staff member or contractor was off work for more than seven days; whether the accident was reported to the Health and Safety Executive under RIDDOR, with the date and reference; witnesses; what was done to stop it happening again; who recorded it; and notes; and
• fire-safety inspection reports: the date, who inspected (for example the fire and rescue service, a fire risk assessor, an insurer or the business itself), the inspector's name and organisation, the report or notice number, the result, a summary, the next inspection date, the actions agreed with their due dates and who completed them, and notes.

Accident-book entries can include health information about staff and about members of the public, which data-protection law treats as special-category information. They are handled like the staff-illness records above: kept in the app's private storage on the phone and included in the business's optional cloud backup (and, on Android, in a backup file the business chooses to save); not shared with a team; never used for analytics, advertising or account reporting; not readable from our administration console; and not included in the inspection report. The business decides whether to keep an accident book (see section 7) and can erase a person's details in the app at any time. Fire-safety inspection reports contain names but no health information; on iPhone they appear in the fire-safety section of the inspection report.

Erasing a person's details. When details are erased in the app, the entry stays in the record book marked "Details erased", with when and by whom, and the personal and health details are removed from it. The next completed cloud backup carries the erasure; while cloud backup is paused, for example after a trial ends, it reaches the cloud copy when backup resumes. Up to three older cloud copies kept as fallbacks may still hold the erased details until newer backups replace them.

Account and team information

If you use cloud features, the app processes your email address, Firebase account identifier, email-verification status and authentication tokens. Team access also uses invitation details, the selected business, member display names, email addresses, assigned roles, custom role names, join dates and shared-record activity.

When complimentary access is granted or extended, we use the recipient email address, access period, seat allowance and, where available, business name to send a service confirmation. This is an operational message about account access, not marketing.

iPhone first-time setup and service reporting

From iPhone version 1.9.4, new and previously unregistered users provide their name, business name and email address. Online account creation also requires a password, handled by Firebase Authentication. These details support account setup, management of the business trial and help with the app. Existing registered users keep their account and access.

From iPhone version 1.9.5, an app account is needed to use the app, and a new account confirms its email address within 7 days. Records already saved on the iPhone are kept. So that the 7 days are the same on every device, our service records when the period started for each account. It stores only a pseudonymous (hashed) account identifier, that start time and a short hourly request count that limits misuse.

Offline setup saves the supplied details privately on your device and resumes registration when you reconnect. Passwords are not saved for an offline retry. A restricted service report can send your supplied name and business name, setup and business identifiers, setup time, account-creation time reported by the device, iOS app version/build and last reported activity. The service uses Firebase App Check and an Apple-signed app transaction to validate the app and prevent duplicate setup identities. It does not obtain your Apple Account email or password.

Your typed offline email stays on the device until account creation. After registration, the reporting service obtains your account email and verification status from a validated Firebase token. Supplied names remain unverified even after email verification. Setup completed, registration pending verification and verified registration are separate statuses. A download or an installation that was never opened is not a completed setup.

Setup reports and linked account activity are periodically retried when the app is active and connectivity is available. Last reported activity is not live presence or proof of activity in a particular business. These reports contain no temperature readings, cleaning entries or other food-safety record contents. Setup, reinstallation and retries do not restart a trial or grant paid access.

Limited account activity

For a verified cloud account, the app may send a small service heartbeat no more than periodically. It contains the app version, build number and platform. The authenticated request also lets the service associate the heartbeat with the account email, display name if supplied, verification status, sign-in time and an opaque account identifier.

The last-active heartbeat does not receive temperatures, cleaning checks, food-waste entries, food-control or HACCP records, staff records, SFBB entries, fire-safety records, business names or PDF contents. It is used to understand whether the service is active, support users on older versions and improve reliability.

Optional app-activity email reminders

If you switch on email reminders for your verified account, we use your verified email address, supplied display name where available, your choice and its date, and the latest app activity reported to our service to send a gentle reminder after at least six days without a new activity report, during daytime UK hours. The email asks you to check whether your food-safety records need updating and links to the app. It does not state that any records are missing or include their contents. Offline use or delayed reporting may mean your activity is more recent than we can see.

Reminders are off by default. You can turn them off in the app or through the link in each email. We send at most one reminder for the same inactive period. Our authorised owner console can show whether a reminder is enabled, due, attempted or paused, and can pause sending; it cannot switch reminders on for you. We keep the preference and a limited delivery record to prevent repeat messages. The name shown in an email comes from your supplied display name and may be incomplete; we use a neutral greeting when it is unavailable.

Linked app visit history (iPhone and Android)

On iPhone and Android versions with visit reporting enabled, a visit is recorded when a person with an email-verified app account uses the app in the foreground for a selected business, while Measure app visits is on. Each visit has a unique session identifier, the selected business identifier (and, for a business kept only on the phone rather than in cloud backup, its business name), UTC start and last-observed times, an end time when known, approximate active seconds, whether the end was observed or estimated, and the app version, build and platform (iPhone or Android). The authenticated request links the visit to the person's account; the request body does not include their name or email. This is linked personal information, not anonymous analytics.

Our authorised administrators can see each signed-in person's visits by business and day, including visit count, start times and approximate active time. A return after a brief interruption may continue the same visit. If the app closes unexpectedly, the last recorded checkpoint is used as an estimated end, so duration may be incomplete. We use visit history to understand app use and improve support and reliability, not to make automated decisions about business access. It does not contain screen contents, food-safety records, typed text, taps, location or inspection PDFs. A download or unopened installation is not counted as a visit.

Visit history is stored by our protected service through Cloudflare, separately from Google Analytics for Firebase. If the phone is offline, pending visit details are kept in the app's protected storage and sent only when the same account can reconnect. Turning off Measure app visits (on iPhone in App account > Privacy, on Android in App account) stops new visit collection and last-active reporting. On iPhone it also removes unsent visit details from that phone. On Android, visit details not yet sent are never sent; they stay only in the app's private storage on that phone and are not included in device backups. Turning it off does not erase history already received by the service. You can request removal of received history through the account-deletion or data-rights options below.

In-app service announcements

The app may show an operational or product announcement to all users or to a particular verified account. To deliver the notice reliably, avoid repeatedly showing a dismissed notice and understand whether it was useful, the service stores the announcement identifier, platform, a pseudonymous recipient hash derived from the Firebase account identifier, and the dates and times when the notice was delivered, opened or dismissed.

The recipient hash is not used to recover an email address, build an advertising profile or track activity in other apps or websites. For an announcement addressed to one account, the administrator must use that account's email address to select the recipient.

iPhone message notifications

When message notifications are enabled in the app and permitted by iOS, the app registers an Apple push notification token with our service. We store the token and a token hash, its development or production environment, and registration or update times. If you are signed in with a verified email, the service also associates the device with your account identifier and verified email so that an announcement addressed to you can reach the right phone. Apple processes the token and notification content to deliver the alert.

An alert may show a short message preview on the Lock Screen, depending on your iOS notification preview settings. Tapping it opens the message in the app. You can turn message notifications off in the app or iOS Settings. When connectivity returns, the app retries the required device registration or removal. Signing out removes the account association after the updated registration reaches our service; public announcements can remain enabled. Disabling alerts while offline cannot immediately remove a token already held by the service.

Technical, website and support information

Firebase Authentication may process credentials, IP addresses and user-agent information to sign users in and prevent abuse. Firebase App Check processes device or app-attestation material and short-lived tokens to help reject unauthorised clients.

Firebase Hosting processes ordinary web-request information, including IP addresses, to deliver and protect this website. The support form prepares a message in your own email app; it does not upload the form to this website. If you send the email, we receive the information included in it.

Optional iPhone usage analytics

From version 1.9.4, Google Analytics for Firebase helps us understand which app sections people use, where recording flows are abandoned or completed, and where the app needs improvement. It measures section views, sessions, selected actions, flow completion and duration groups. The SDK also processes app/device details, a random app-instance identifier, general location derived from network information, and purchase/subscription events such as product and price. These pseudonymous identifiers are not the same as anonymous data.

We do not put your name, email, business identifiers, typed text, signatures, temperature readings, cleaning entries or other customer-record contents into our usage-analytics events. We do not set an analytics account user ID, record the screen or replay sessions. Advertising identifiers, IDFV collection and advertising personalisation are disabled in the iPhone app.

Detailed iPhone usage analytics is off by default. It starts only if you switch on App account > Privacy > Share detailed usage, and you can switch it off again for free at any time, including while signed out or offline. Previous explicit opt-outs are preserved. Turning it off stops future analytics collection and resets the local analytics data/identifier; activity while it is off is not replayed when you turn it back on. This does not delete data already received by Google. Your records, trial and business access are unaffected.

The Android app does not currently include Google usage analytics; app visit measurement is described above. If we add it, it will stay off unless you choose to switch it on, and we will update this policy before any collection starts.

We use these measurements to improve this app, not to send you marketing or make decisions about your business access. Account setup reporting is separate from this setting. Last-active reporting and linked app visit history follow the separate Measure app visits setting described above, which is on by default.

Optional website analytics

Google Analytics 4 runs only after you choose Accept analytics. If accepted, it helps us understand page visits, approximate country or region, device and browser type, referring campaigns, feature-preview use, FAQ openings, and clicks leading to an app store, support or other websites. We use this information to improve the website and understand which marketing is useful.

We do not send names, email addresses, support-form contents, account identifiers, food-safety records or app activity to website analytics. Advertising storage, advertising personalisation and Google Signals are disabled. Google Analytics may set first-party _ga cookies to distinguish visits and maintain a session. We configure them to expire no later than about 13 months from first use.

You can reject analytics without losing any website function. You can also change your choice later through Cookie settings in the website footer. Withdrawing consent removes the website's Google Analytics cookies where the browser permits this and stops the Google tag loading on later pages.

3. Where information comes from

• directly from you when you create records, an account or a support message;
• from a business owner or administrator who invites your verified email address and assigns your role;
• from authorised team members when they update a shared business; and
• from Apple, Google, Firebase and hosting infrastructure when they provide security, authentication and request information.

4. Local records and device security

Record-book data is stored in the app's private storage so saved records can be viewed offline. On iPhone, authentication credentials use the iOS Keychain with device-only accessibility, and the app covers its content in the app switcher. Android uses its own private app storage and Android security facilities; Android system backup and device-transfer backup are disabled for the app.

If cloud backup is not enabled, deleting the app, losing the device or losing access to it may permanently remove records that have not been exported. A device passcode, available biometric protection, operating-system updates and secure device handling remain the user's responsibility.

Inspection PDFs are generated on your device from the selected business and date range. Sharing opens the device's sharing controls, and you choose which app or service receives the file.

5. Optional cloud backup and team access

One verified app account is used for cloud backup and supported team features; a separate backup login is not required. Records are not uploaded to cloud backup during the free trial, and team invitations are not available during the trial. With paid or complimentary access, records are uploaded only after you choose the cloud upload option in the app; until then they stay on your device. Team availability depends on your app version. Backup uploads use separate generations so an interrupted upload does not replace the last completed backup. Temporary uploads and older inactive generations are routinely cleaned up; the active backup remains until it is replaced or deleted.

Team access starts only when an authorised person enables it for a selected business. The current business records are then uploaded to a protected team workspace. Personal backups and other businesses are not added to that workspace.

Invitations are sent to a specific verified email address and expire after seven days. Access is controlled through these roles:

• Owner: full control of records, people and business access;
• Administrator: all records and invitations for managers, staff and viewers;
• Manager: all food-safety records and business details;
• Staff: daily temperature, cleaning, waste and SFBB diary records; and
• View only: review access without editing.

Authorised members can see the shared business records their role allows. Recent shared-record activity identifies the member and whether a record was updated or removed.

6. Subscriptions and payment

Business access can be paid for through an Apple auto-renewable subscription on iPhone or a Google Play subscription on Android, or granted free of charge by us as complimentary access. On Android, Google processes the payment and we receive the subscription and purchase-status information needed to confirm and manage your business access; we never see your card details. The Apple payment details below apply to iPhone subscriptions.

When you subscribe, the app sends Apple's signed transaction to our protected service so the correct business can be unlocked. From that transaction we store the original transaction identifier, the product identifier, the current status and renewal or expiry date, the business the purchase applies to, and the owner email address associated with it. Apple also sends us server notifications about renewals, cancellations, billing retries, grace periods, refunds and expiry so that access stays accurate.

This information is processed to perform our agreement with you: to unlock and maintain the access you paid for, to keep it correct when Apple reports a change, and to prevent one business's purchase being used to unlock another. Records of a transaction are also kept where needed for tax, accounting and dispute-handling duties.

Complimentary access does not involve any payment and never becomes a charge. It is recorded as an access grant against the business, with its period, seat limit and an internal administrative note.

Apple's handling of your purchase is governed by Apple's own privacy policy. To cancel, use your Apple Account subscription settings; we cannot cancel an Apple subscription for you.

7. Why information is used and our lawful bases

Provide the service

Required account/setup details, trial administration, account sign-in, cloud backup, restoration, team access, service announcements, support and account deletion are processed to perform our agreement with you or take steps you request.

Protect and improve the service

Security checks, abuse prevention, fault diagnosis, limited setup/account-activity reporting, optional linked app visit history and app-use statistics for service improvement, and announcement delivery, opening and dismissal information are processed for our legitimate interests in operating a secure, reliable and understandable service.

Optional email reminders

With your consent, your email address, supplied display name and last reported app activity are used to provide the reminder you requested. You may withdraw that consent in the app or from any reminder email without losing app access.

Website analytics

Optional Google Analytics is processed only with your consent. You may reject or withdraw that consent at any time through Cookie settings without losing website functionality.

Meet legal duties

Information may be processed where necessary to comply with applicable law, resolve legal claims or respond to a valid authority request.

A food business using the app is responsible for identifying its own lawful basis before entering or sharing personal information about staff or other people. The allergy and special-diet register, staff-illness records and the accident book can contain special-category information. Before using them, the business should confirm that it has a lawful basis and a condition for processing that information, for example to protect the health of the people it feeds or to meet its food-hygiene, health-and-safety and employment duties, and should record only what the kitchen needs: a first name and initial, or a reference, is enough. Apart from those records, the app is not intended for medical records or other special-category information.

8. Who information is shared with

• Google Firebase and Google Analytics: authentication, App Check, Cloud Firestore backup and team data, website hosting, and optional app/website usage measurement with the separate controls described above;
• Cloudflare: protected infrastructure for account activity and linked app visit history (iPhone and Android), optional email-reminder preferences and delivery records, business access and subscription verification, team invitation and permission checks, owner reporting, in-app announcements and reliable notification queuing;
• Resend: delivery of transactional emails confirming complimentary access and extensions, optional app-activity reminder emails you choose to receive, and occasional personal account emails from us (for example a check-in, or a reminder to confirm your email address), each with a link to stop them;
• authorised business members: the selected shared business according to each person's role;
• services you choose: email, messaging, file storage or another destination selected through iPhone or Android sharing controls when you share a PDF; and
• authorities or advisers: only where disclosure is legally required or necessary to protect legal rights.

Google, Cloudflare and Resend act as service providers for the relevant cloud functions. We do not sell personal information, use it for third-party advertising or use it to track you across other companies' apps and websites.

9. International processing

Cloud providers operate internationally. Firebase Authentication is operated from the United States, while Cloud Firestore, App Check, Hosting, Cloudflare and Resend may process information in the UK, EEA, United States or other locations where those providers operate.

Where personal information is transferred outside the UK, the relevant provider terms use recognised safeguards where required, such as adequacy regulations or approved contractual clauses. More information is available in Firebase privacy and security information and Cloudflare's data processing addendum.

10. How long information is kept

• Local records: until you remove them in the app or delete the app. On Android, kitchen records are not deleted one by one: they are corrected or marked, so the record book stays complete, and a person who has left is marked as no longer with the business and left off the kitchen list. When a business no longer needs a person's allergy and diet details or a staff member's illness details, or the person asks, it can erase them in the app: the name and the health details are removed for good, and the entry is kept marked “details erased”. The next cloud backup replaces the current backup copy; an earlier backup copy that still holds them is removed on the backup clean-up schedule described in this section.
• Current cloud backup: until replaced or the backup account and cloud records are deleted.
• Older backup copies: from iPhone version 1.9.6 and Android version 1.3.1, after each completed backup the app keeps the current cloud copy and the three newest earlier copies and removes older ones; interrupted uploads are removed after 24 hours. Earlier app versions keep older copies until the app is updated.
• Team invitations: seven days, unless accepted, declined or cancelled sooner.
• Shared business records: while the workspace remains active or until an authorised member removes them. Leaving a business removes your access but does not delete the owner's business records.
• iPhone setup reports: removed after 90 days without a received setup or linked account activity report. Account deletion removes linked setup details; minimal hashed suppression identifiers remain for up to 90 days to reject stale queued reports. Trial and transaction ledgers are separate and are not reset by this removal.
• iPhone analytics: the Google Analytics property is set to retain event-level data for two months and user-level data for 14 months. The user-data retention period resets on new activity. These controls do not remove most aggregated standard reports, which may remain longer. Turning off the app setting stops new collection but does not erase server-held history. Contact us about data rights and the information needed to locate a pseudonymous record.
• Linked app visit history (iPhone and Android): kept for 90 days, then removed by scheduled cleanup. Turning off Measure app visits stops new collection and discards unsent details on that phone. Account deletion removes linked visit history from the service; you can also ask us to remove information already received.
• Email confirmation start time: removed when the account is deleted, and otherwise automatically after about 13 months.
• Daily activity markers: 90 days. The latest account activity, version and platform remain for account support until the account activity is deleted.
• Account deletion requests: while a request is pending or in progress we keep its dates, its progress, your sign-in identifier and your email address so that it can be completed or cancelled. When it completes, the sign-in identifier and email address are removed; a scrambled identifier, the dates and the number of items removed remain as a record that the request was carried out.
• Do-not-contact list: the scrambled copy of a deleted account's email address is kept so that we never email that address again by mistake.
• Product news after deletion (only if you ticked the box): your email address and business name are kept until you unsubscribe or ask us to remove them.
• Optional email reminders: your on/off preference is kept until account deletion so that an opt-out is respected. Delivery attempt records are kept for up to 90 days and removed with the account. An unsubscribe link disables the preference without deleting your app account or records.
• Access-notification delivery records: successful outbox records are removed after 30 days; undelivered records are removed after 90 days. The access grant itself remains in the access audit history.
• In-app announcements and receipts: an announcement is removed 180 days after it expires or is revoked. Its pseudonymous delivery, opening and dismissal receipts are removed with it. An announcement with no expiry remains until it is revoked and then enters the same 180-day cleanup period.
• iPhone push notifications: invalid or unregistered device tokens are removed when identified. Device registrations not refreshed for 365 days and push-delivery history older than 180 days are removed by scheduled cleanup. Account deletion removes push data associated with that account.
• Support messages: while reasonably needed to answer the request, prevent repeated problems and meet legal obligations.
• Website security logs: according to Firebase Hosting's operational retention, which Google describes as a few months for IP data.
• Optional website analytics: Google Analytics is configured to retain event-level data for two months and user-level data for 14 months. Google states that these controls do not affect most standard reporting, which uses aggregated data. First-party analytics cookies expire no later than about 13 months from first use.

After account deletion, service providers may retain limited residual copies in protected backup systems for their published deletion period. Google states that some Firebase Authentication data may take up to 180 days to be removed from live and backup systems.

11. Sign-out, removal and deletion controls

On iPhone, signing out removes saved cloud credentials and local copies of businesses you joined as a team member. On Android, signing out ends the app account session but does not delete saved local records. Neither action deletes your personal cloud backup or the business owner's shared records.

An owner or administrator can remove a member's access. A non-owner can leave a shared business. The shared records remain available to the business owner and other authorised members.

On iPhone: open App account > Manage or delete account and follow the displayed account and business checks. Older versions use the account-deletion option under Secure cloud backup. In iPhone versions up to 1.9.5, deletion starts straight away. Our service removes your cloud backup, your team memberships, invitations sent to or by you, cloud businesses you own that nobody else uses, your account activity and your linked visit history, and the app then removes your Firebase Authentication account. These versions cannot warn you that a shared business would go too, so a cloud business you own that other team members still use is not deleted automatically: we keep it for review and do not remove it without checking first. Local records on that iPhone remain until removed separately.

On Android: open Account > Delete my account and confirm with your password. If your version cannot complete the request, it tells you that nothing was deleted; use the email route below and we will delete the account for you.

In newer app versions on iPhone and Android, the app first shows the cloud businesses you own and how many team members use each one. Your deletion is then scheduled for 7 days later, so you can save a backup file to your phone or cancel the request in the app. On that date our service removes your cloud backup, your team memberships, invitations sent to or by you, every cloud business you own (including its shared records, activity and team list, so its other members lose access to those cloud records), your account activity, your linked visit history and your Firebase Authentication account.

Deleting your account never deletes a cloud business that belongs to someone else; only your membership of it is removed. It never deletes records saved on a phone. Deletion runs in the background in small batches and normally finishes within a few hours of the request or scheduled date; a very large account can take up to 48 hours.

Product news after deletion is your choice. When you delete your account you can tick Keep me updated about new features by email, which is unticked unless you choose it. If you tick it, we keep only your email address and business name, with the date of your choice, to send occasional product news; each email lets you unsubscribe, and you can ask us to remove them at any time. If you do not tick it, we keep only a one-way scrambled (hashed) copy of your email address on a do-not-contact list, so that we do not email you again by mistake; your address cannot be read back from it.

You can also request account and associated-data deletion by emailing support@foodsafetyrecords.co.uk from your account email address. We may need to verify your identity. Limited transaction, access and trial/audit records may be retained for disputes, legal obligations and enforcement of the one-time trial, as described above.

PDFs saved or shared outside the app must be deleted from the destination service or device separately.

12. Security

Security measures include HTTPS, Firebase security rules, verified-email access, role checks, Firebase App Check with Apple's App Attest or DeviceCheck on iPhone and Google Play Integrity on Android, platform-specific credential protection and restricted administrative access. Firebase states that Authentication, Cloud Firestore and App Check data is encrypted in transit and at rest.

Cloud records are protected by provider encryption and access controls, but they are not end-to-end encrypted with a recovery key held only by the user. No system can guarantee complete security.

13. What our administrators can and cannot see

We operate a private administration console so we can run the service, support customers and manage access. Access to it requires a verified administrator account and every access change it makes is recorded in an audit log with the acting administrator and the time.

Administrators can see:

• supplied setup name and business name (labelled unverified), setup/business identifiers, setup time and last received activity, plus registered account email and email-verification status;
• every sign-in account, whether or not its email address has been confirmed: the email address, display name, sign-in method (for example email and password, Apple or Google), when the account was created and last signed in, and whether it is confirmed or disabled. This is a copy of basic account details from our sign-in provider, Google Firebase Authentication, kept in our protected service for the console and removed when the account is deleted. Passwords are never copied or visible;
• whether an account has been active recently, the app version and platform, and whether optional inactivity reminder emails are enabled, due, attempted or paused;
• when linked app visit reporting is enabled and the setting is on, each verified account's visit count, start times and approximate active time for the selected business and earlier days;
• business names, the business owner's email address and how many team seats are in use;
• whether a business has active access, and whether that access is a paid subscription, a complimentary grant or protected legacy access, with its start and expiry dates; and
• in-app announcements, the target email for an individually addressed notice, and aggregate delivery, opening and dismissal counts. General-announcement receipt rows use pseudonymous hashes rather than showing an account email; and
• aggregated totals such as how many businesses are active, how many are on complimentary access and how many subscriptions renew or lapse in a period.

Administrators can grant, extend or revoke complimentary access, and can correct an owner email address on a business account. Revoking or expiring access never deletes saved records. After the trial, or when access ends, saved records are locked on iPhone and Android: they remain viewable and can be shared, but creating, editing or deleting records, cloud synchronisation and team collaboration require active paid or complimentary business access.

We use this information for our legitimate interests in operating, supporting and understanding a reliable paid service. You may object using the contact details in this policy.

14. Your data-protection rights

Depending on the circumstances and lawful basis, you may have rights to be informed, access personal information, correct it, erase it, restrict its use, object to its use and receive portable information you supplied.

Send a request to support@foodsafetyrecords.co.uk. We may need to verify your identity. There is normally no charge and we aim to respond within one month, subject to lawful extensions or exemptions.

For personal information entered by your employer or another food business, contact that business first because it normally controls those records.

15. Automated decisions and marketing

The service does not make decisions with legal or similarly significant effects using automated processing or create advertising profiles. If you switch on optional app-activity reminders, it may send a plain record-keeping reminder after a period without reported app activity; these emails contain no offers and can be turned off. It may also send necessary service emails when your free trial starts or when complimentary access is granted or extended, and display operational or product announcements inside the app or, if you allow notifications, as a phone notification. These announcements are not third-party advertising and are not used to profile users. We send product news by email only to people who choose it, for example by ticking Keep me updated about new features by email when deleting their account (see section 11); every such email has an unsubscribe link.

16. Children

The app is intended for food-business record keeping and is not directed to children. Do not create an account for a child. A school, nursery or other food business may record a child's allergies and diet in the allergy register only when it has confirmed that doing so is necessary and lawful; a first name and initial, or a reference, is enough.

17. Changes, questions and complaints

This policy may be updated when app functions, providers or legal requirements change. The latest version and update date will remain on this page.

Please contact us first if you have a concern so we can investigate. You also have the right to complain to the UK Information Commissioner's Office. Visit the ICO complaints page or call 0303 123 1113.