Privacy Notice

Who is responsible

Cafe Bullis operates this service for participating organisations. Cafe Bullis and your sponsoring organisation may each be responsible for different uses of your information under their agreement. Contact us at cafebullis@outlook.com, or contact your organisation for questions about its employee-benefit programme.

Information we process

• Name, email address, authentication identifier, account status, roles, and assigned canteens. We do not receive your plain-text password.
• Optional profile picture and its private storage reference.
• Point grants, expiry, adjustments, balances, orders, menu items, payment records, and audit history.
• Support messages and limited request, device, browser, IP, error, and security information.

Why we use it

We use this information to verify and approve accounts, operate the wallet and employee allowance, process canteen orders and payments, prevent duplicate or fraudulent activity, maintain audit records, provide support, secure the service, and meet legal obligations. Product analytics is used only if you choose “Allow analytics.”

Providers and processing locations

We use Supabase for authentication, database, and private avatar storage; Vercel for the web application and delivery; Railway for the API; Resend for transactional email; Sentry for necessary error and security monitoring; and PostHog for optional, consent-based product analytics. These providers may process information in other regions under their contracts, security measures, and applicable law.

Analytics and necessary technology

Authentication storage and necessary error/security monitoring keep the service working and secure. PostHog remains off until you allow analytics. When enabled, Cafe Bullis disables autocapture, automatic pageviews, session recording, persistent identifiers, and person profiles, and sends only named feature-use events without email, payment amounts, payment IDs, or QR tokens. You can change this choice at any time through “Privacy choices” in the site footer.

Retention

• Account and profile data is kept while the account is active and as needed after closure to administer linked records.
• Profile pictures are kept until replaced or the account is closed, subject to provider backup cycles.
• Point, order, payment, adjustment, and audit history is not routinely deleted because it is needed for reconciliation, fraud prevention, and legal or sponsor records; it is reviewed after seven years.
• Operational security logs are targeted for a rolling 180-day period where applicable, subject to provider settings and legal holds.
• Support correspondence may be retained for up to two years after resolution.

Your choices and rights

Subject to applicable law, you may request access, correction, updating, or erasure of eligible information, withdraw optional analytics consent, and raise a grievance. Financial and audit records may need to be retained even after an account closes. Send requests from your registered email and never include a password, OTP, or QR token.

Security, children, and changes

We use role-based server authorisation, encrypted network transport, private avatar storage, and audit trails. No system is risk-free. The service is intended for an organisation’s authorised workforce and is not directed to children under 18. We will update this page when material practices change and revise the effective date.