Data processing and GDPR

For guest orders, payments and bookings taken at your venue, you are the controller and Tradeinit is the processor. We process that data only to provide the service and on your documented instructions, which are the settings you choose in the dashboard and these terms.

For your own account (your login, staff PINs, the actions you take), Tradeinit is the controller, as described in the privacy policy.

Guest data: order lines, table or booking, time, amount, payment method and the provider's reference, an email or phone number where the guest gave one, marketing consent where given.

Staff data: names, PINs, the device enrolled, and the actions each staff member took.

Business data: menu, prices, allergens, hours, logo, address, VAT number, printers and settings.

Vercel Inc.: hosting of the application and this website, and cookieless analytics.

Supabase Inc.: the database and authentication service.

Resend Inc.: delivery of receipts, confirmations, reports and service emails.

The payment provider connected to your venue (for example Revolut Ltd, or the authorised payment institution behind Tradeinit's own payment service): taking payments and refunds. Card data goes to them directly.

The card machine provider connected to your venue: taking in-person payments and refunds on the machine. The card is read by the machine; Tradeinit receives the amount, the result, the card type and the last four digits.

Seiko Epson Corporation: your receipt printers collect their print jobs from our servers using Epson Server Direct Print; the job contains the ticket text only.

Anthropic PBC and OpenAI: reading photographs of paper menus for menu import, and answering an owner's questions through the Flexibles AI assistant. No guest contact details are sent.

We tell venues by email at least 14 days before adding a sub-processor that will handle guest data. A venue that objects on reasonable data protection grounds may end the service without penalty.

The platform runs on Vercel and Supabase infrastructure. Where a sub-processor stores or accesses data outside the UK, the transfer is covered by the UK International Data Transfer Agreement or the UK addendum to the EU standard contractual clauses, and by the supplier's own certifications.

Encryption in transit (TLS) and at rest.

Row-level access control in the database, so a venue's data is only ever read in the context of that venue.

Separate roles for owners and station logins; the kitchen never sees takings.

Payments confirmed with the provider on the server before an order exists; refunds behind a manager PIN and logged with a reason.

Secrets held in the hosting provider's encrypted configuration, never in code.

Continuous monitoring of printers and payment reconciliation, so a failure is noticed and recorded.

We process guest data only to provide the service to you, never for our own marketing.

We help you respond to a data subject's request within the statutory time, and we pass on any request we receive directly.

We tell you without undue delay, and in any case within 72 hours of becoming aware, if there is a personal data breach affecting your data, with what we know and what we are doing.

We delete or return your data within 30 days of the end of the service, except what the law requires us to keep.

We make available the information needed to show compliance, and allow a reasonable audit on notice, no more than once a year unless a regulator requires it.

Our staff who can access data are bound by confidentiality.

Order and payment records: six years, to meet UK tax record-keeping rules. Bookings: two years after the booking date. Marketing consents: until withdrawn. Account and staff data: 30 days after the account ends. Enquiries from the website: 12 months.

Data protection questions, requests and notices: privacy@tradeinit.com. We respond within five working days to a venue's request and within one month to a data subject's request.