Privacy policy

Tradeinit is operated by Flexibles AI Ltd, a company registered in England and Wales under company number 16387411, with its registered office at 46 Barn Hill, Wembley, London HA9 9LF, trading as Tradeinit. In these pages "we", "us" and "Tradeinit" mean Flexibles AI Ltd.

For this website and for venue accounts, we are the data controller. For a guest's order, payment or booking at a venue, the venue is the data controller and we are its data processor: we handle the data on the venue's instructions to deliver the service. Our data processing page explains that arrangement.

Questions about this policy go to privacy@tradeinit.com. We are registered with the Information Commissioner's Office (ICO).

What we collect: the items you order, the table or booking, the time, the amount, how you paid (card brand and last digits as given to us by the payment provider, never the card number), an email address if you ask for a receipt or a booking confirmation, a phone number if the venue's booking form asks for one, and your tick if you choose to receive offers from the venue.

Why: to place and pay for your order, to send the ticket to the kitchen, to send you a receipt or confirmation you asked for, to let the venue handle a refund or a query, and to keep the venue's accounting records.

Lawful basis: performance of the contract between you and the venue, and the venue's legal obligation to keep sales records. Marketing is sent only with your consent, which you can withdraw at any time using the link in the message or by telling the venue.

Card details: entered on the payment provider's own secure form, or on the venue's card machine. Tradeinit never sees or stores the full card number; from a card machine it receives the amount, the result, the card type and the last four digits.

How long: order and payment records are kept for six years because UK tax law requires venues to keep them. An email given for a receipt is kept with that order. A marketing consent is kept until withdrawn.

What we collect: your name, email address, the venue's business details, your login and the actions you take in the dashboard (menu edits, refunds, settings, stock movements, corrections to sales, closing the day), your staff name and PIN for the POS, which sites your login may open, and the device identifier of a tablet, handheld terminal or till enrolled for the POS.

Why: to run your account, to show who did what (for example who served a table or approved a refund), to send you the nightly report and service emails, and to support you.

Lawful basis: performance of our contract with the venue, and our legitimate interest in keeping the platform secure and in telling you about changes to the service you use.

How long: for the life of the account and 30 days after it ends, then deleted, except for records that must be kept for tax purposes.

Tradeinit Pocket is our Android app for handheld card terminals. It shows the same POS that a browser would, full screen, and asks the terminal's own payment app to take the card payment.

What stays on the terminal: the venue's POS address and name, the terminal's identifier, which payment app it uses, when it was installed, and the POS sign-in cookie. The app keeps no card data and no copy of the venue's records.

What the app sends and receives: it talks only to tradeinit.com, as described above for venue staff, and to the payment app on the same terminal. It passes the amount to the payment app and receives the result: approved or declined, the transaction reference, authorisation code, amounts, payment method, card scheme and the last four digits. Those go into the venue's sales record on our servers, exactly as for any card machine payment. The full card number never reaches the app or Tradeinit.

The app contains no advertising, no analytics and no third-party tracking. Its on-device log records the outcome and reference of each payment request, never card details, and goes when the app is removed.

To have a terminal's or a staff member's data deleted, the venue removes the device or the person under Team, or emails privacy@tradeinit.com.

What we collect: if you send an enquiry, the details you type in the form. We also collect anonymous page-view statistics (page, country, device type) through Vercel Analytics, which uses no cookies and does not identify you.

Why: to reply to you, and to understand which pages are useful.

Lawful basis: our legitimate interest in answering enquiries and improving the site.

How long: an enquiry is kept for 12 months unless it becomes a customer relationship.

A venue can connect its Tradeinit data to the Flexibles AI assistant to ask questions about its own trading. The assistant sees only that venue's data, answers only that venue's owner, and is used to answer the question asked, not to train models. Guests' names and contact details are not needed for these answers and are not sent.

Menu import reads photographs of a venue's paper menu with an AI model to produce the menu text. Those photographs contain no personal data.

We use a small number of suppliers to run the platform. Each one handles data only to provide its part of the service, under a written contract. The current list is on our data processing page: hosting, database, email delivery, online payment providers, the card machine provider for in-person payments, and the AI models used for the assistant and menu import.

We share a guest's order with the venue that took it, because the venue is fulfilling it. We do not sell personal data and we do not share it with advertisers.

Where a supplier processes data outside the UK, the transfer is covered by the UK International Data Transfer Agreement or the UK addendum to the EU standard contractual clauses.

Data is encrypted in transit and at rest. Access to the database is restricted to the platform itself and to named staff for support. Payments are confirmed with the provider on our servers before an order exists. Refunds need a manager PIN and are logged. Staff logins see only the screens their role needs.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it where we have no legal reason to keep it, object to processing based on legitimate interest, and withdraw a consent you have given.

Email privacy@tradeinit.com. If the data belongs to a venue's records (for example your order), we will pass your request to the venue as its processor and help it respond. We respond within one month.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

We update this policy when the service changes. The date at the top is the current version.