Start free trialBook a 15-min demo ↗

Last updated 22 October 2026

Privacy Policy.

We collect what we need to run your venue, store it in the EU, and let you take it back any time. This page explains the specifics in plain English.

1. Who we are

PsycheMeta Ltd ("we", "us") is the data controller for personal data processed via Hospitality App — the app at my.hospitalityapp.co.uk and the iOS and Android apps. Hospitality App is a product of PsycheMeta Ltd, registered in England & Wales, company no. 16586115. Registered office: F23, 18 Foregate Street, Worcester WR1 1DN. For privacy matters: privacy@hospitalityapp.co.uk.

2. What we collect

Account data

  • Name, email, password (hashed; we never see the plaintext)
  • The business(es) you own or work at
  • Your role within each business (owner, manager, staff)

Demo bookings

If you book a 15-minute demo on hospitalityapp.co.uk/demo/, we receive the business name, address and phone, and the owner’s name, email and phone, by email. The time you pick is booked on Calendly, which receives the name, email and any details we pass through so the invite is filled in for you.

Set-up calls from the app

When you sign up in the app, we offer an optional 15-minute set-up call. The link opens our Calendly page without passing your name or email; Calendly only receives what you type into it yourself.

Email preferences

Whether you've opted out of set-up tips and product news, how you told us, and a record of the emails we've sent you (see section 3a).

Operational data

  • Rota: shifts assigned, hours worked, role
  • Compliance: check definitions, log entries, photo evidence, readings
  • Takings: gross daily / weekly takings figures
  • Payroll: hourly rate, contract type, payslip-relevant calculations
  • Communications: announcements posted, swap requests, read-receipts

Device + diagnostic data

  • Device push token (when you opt in to push notifications)
  • Approximate location at clock-in (only if your business enables it)
  • Crash reports + anonymised performance metrics

App usage

Which sections of the app you open (for example Rota or Stock), recorded at most once per section per day, with your account, venue and whether it was the web or phone app. We use it to improve the product and support venues. We don't record what you view or type.

3. Why we collect it (legal bases)

  • Contract — to provide the service you signed up for
  • Legitimate interest — to keep the service secure, prevent fraud, run anonymised analytics, and to see which parts of the app venues use so we can improve it and support them (app usage)
  • Legal obligation — when required by HMRC, food-safety or licensing inspectors
  • Contract and legitimate interest — for account emails (sign-up, password reset, trial and billing notices) and set-up emails that help you get your venue running
  • Legitimate interest (soft opt-in) — for occasional product news about Hospitality App and similar Hospitality App products, sent to people who signed up and didn't opt out (see section 3a)
  • Consent — for push notifications, optional location capture, and product news if you asked us to turn it back on

3a. Emails we send you

  • Account emails — about your account, trial and billing. These go whatever your preferences.
  • Set-up tips and product news — when you sign up there's a box: "We'll send set-up tips and occasional product news — tick to opt out". Leave it unticked and we may send them; tick it and we won't. Product news is only about Hospitality App and similar Hospitality App products.
  • Opting out later — every optional email has an unsubscribe link and a link to your email preferences. Turning product news off is one click. To turn it back on, just reply or email us and we'll do it for you.
  • Who gets them — venue owners and account-holders. Staff invited by a business don't get set-up tips or product news.
  • Bounces and complaints — if an address bounces or marks our email as spam, we stop emailing it and keep a note of that so we don't start again.

4. Where it's stored

All operational data is stored on Supabase (Postgres) in the EU (Frankfurt) region with row-level security per business. Static assets are served from Vercel's global edge. Email is sent via Resend. Push notifications go through APNs (iOS) and FCM (Android). All transit is HTTPS / TLS.

5. Sub-processors

  • Supabase Inc — database, authentication, storage
  • Resend — email delivery: transactional email (invites, digests, payroll exports) and account, set-up and product-news emails
  • Apple Push Notification service (APNs) — iOS push delivery
  • Firebase Cloud Messaging (FCM) — Android push delivery
  • Vercel — hosting
  • Calendly — 15-minute demo bookings from hospitalityapp.co.uk/demo/ (name, email and the answers you choose to send), and set-up call bookings from the app (only what you type into Calendly)

6. How long we keep it

  • Account + operational data — as long as your account is active, plus 30 days after cancellation
  • Compliance logs — kept for 6 years to support HACCP, licensing and tax-record retention requirements
  • Diagnostic data — 90 days
  • App usage — 13 months
  • Emails we've sent you — the email's content is deleted after 30 days; its subject and your address stay with your account. When you delete your account, these records lose the subject, content and address
  • Unsubscribes, bounces and complaints — kept after you delete your account, so we can keep honouring your objection
  • Backups — encrypted, rotated weekly, retained 30 days

7. Your rights

Under UK GDPR you can:

  • Ask for a copy of everything we hold about you (data subject access request)
  • Have it corrected if inaccurate
  • Have it deleted (subject to the retention rules above for compliance records)
  • Object to processing for marketing or analytics — including opting out of set-up tips and product news at sign-up, from any email, or by emailing us
  • Withdraw consent for push / location at any time
  • Lodge a complaint with the ICO at ico.org.uk

Email privacy@hospitalityapp.co.uk and we'll respond within 30 days.

8. Cookies

The marketing site (hospitalityapp.co.uk) sets no cookies of its own and runs no analytics or tracking. Three things on it come from other companies:

  • Fonts load from Google Fonts. Your browser asks Google for the font file, so Google sees your IP address. Google Fonts sets no cookies.
  • The demo booking calendar on hospitalityapp.co.uk/demo/ is Calendly's, and it may set Calendly's own cookies when that page loads. If you'd rather not, use the plain link on that page or email us to book.
  • The product video loads from YouTube only when you press play, using YouTube's privacy-enhanced mode. YouTube may then set its own cookies.

The app at my.hospitalityapp.co.uk uses a session cookie strictly necessary for sign-in.

9. Children

The service is not intended for under-16s. If your business invites a young worker (16-18), it's the business's responsibility to confirm they meet UK working-time and right-to-work rules.

10. Changes

If we materially change this policy we'll email account-holders. The "last updated" date at the top of the page always reflects the current version.