Privacy Policy

Who we are and our roles

Crunch Hospitality Solutions Ltd (“Crunch”, “we”, “us”) provides software and hands-on services for hospitality businesses. We are registered in England and Wales under company number 15010010, with our registered office at Flat 1, 1 Montenotte Road, London, England, N8 8RL. For privacy questions, requests or complaints, email [email protected] or write to our registered office.

This notice covers our website, enquiries, accounts, billing, support, integrations, AI and consulting. It explains personal-data handling under applicable law, including the UK GDPR and Data Protection Act 2018 as amended, and EU GDPR where applicable. Visiting the site or reading this notice does not give consent to all processing.

We act as controller for our business contacts, enquiries, account and billing administration, security and business management. Your organisation normally acts as controller of staff, supplier and customer personal data it provides for processing through Crunch or consulting; we act as its processor, following its instructions. If your organisation acts for another controller, we may be a sub-processor. The data-processing schedule applies to that work. Roles depend on the activity, not simply a contractual label.

Non-personal business information, such as recipes and margins, is also protected by our contractual confidentiality undertaking. This notice does not reduce that protection.

Information we handle and its sources

• Enquiries and contacts: name, business email, phone, role, company and venue details, postcode, POS provider, requirements, messages, meeting notes and correspondence. You provide these through forms, public Alex, email, calls or meetings; colleagues may introduce you or invite you to a workspace. An enquiry may include landing-page, campaign and referrer information, IP address and browser details.
• Accounts: identifiers, email, profile, authentication and verification records, roles, organisation memberships, invitations, settings and sessions. These come from you, your administrator and, if selected, an identity provider such as Google. We do not receive your Google password.
• Billing: billing contact/address, subscription, invoices, payment status and references, limited payment-method information, and usage/credit records. Stripe collects and processes card details on its payment surfaces; Crunch does not require full card numbers in the platform. Do not send them in chat or support messages.
• Business records: catalogues, recipes, stock, invoices, suppliers, purchases, POS/sales records, locations, reports and files, supplied by you or your users, connected systems such as Square, or authorised consulting access. These may contain names, contact details, employee/customer references, invoice addresses and transaction identifiers as well as non-personal business data.
• AI and extraction: prompts, conversation history, relevant business context, attachments, OCR results, tool requests/results, answers, reports, feedback and usage. Public Alex receives the venue details and messages you enter.
• Technical and support records: IP address, browser/device information, timestamps, requests, authentication activity, audit/error records and feature interactions generated when you use the Services. Help feedback includes article, rating, optional comment and a session identifier. Optional analytics are described below.

Please minimise personal data in uploads and free text. We do not need unnecessary health, biometric, political or religious information, criminal records, children’s details or full card data. Agree any intended sensitive-data processing with us first. The Services are intended for business users, not children; contact us if a child’s data has been supplied inappropriately.

Purposes and legal bases

For our controller activities, the following bases apply. The contract basis applies only where the contract is with you personally, for example as a sole trader. For a company’s representatives we generally rely on the stated legitimate interests instead.

We balance legitimate interests against your rights and limit processing to what is needed. You may object as explained below. Where we are a processor, your organisation determines the lawful basis; we follow its instructions and do not use its content for our own marketing.

Required account, contact and billing information is needed to provide the requested service or comply with law. Without it we may be unable to open an account, respond or provide paid Services. Optional fields and optional analytics are not required to browse or buy. We do not sell personal data or use customer business content for advertising.

AI assistants, reports and invoice capture

Crunch uses OpenAI-powered features, including Alex, Crunchy, document extraction and AI-supported analysis. Requested or configured workflows may send relevant prompts, conversation context, business records, attachments and tool results to OpenAI for inference, extraction or the requested work. Scheduled reports and configured workflows can also use AI without a new message being typed at that moment. The data sent can therefore extend beyond the words in a prompt.

Crunch may store conversations, files and outputs for service history and authorised workflows. Provider processing and retention depend on the service and contractual settings. We do not promise zero provider retention, single-country processing or absence of all authorised human review for service operations, safety or legal requirements.

We will not use your confidential business information to train or fine-tune shared or general-purpose models, or opt it into model-provider training. This restriction permits inference for your requested Services. We restrict access to relevant people and providers and apply proportionate data-minimisation and credential-handling safeguards. Avoid passwords or unnecessary personal data in prompts. Public Alex is an enquiry channel; use a secured workspace or agreed transfer for confidential operational datasets.

AI can make mistakes. Our ordinary Services support human operational decisions; we do not use them to make solely automated decisions about people producing legal or similarly significant effects. Your organisation controls its own use of outputs. Discuss any proposed use involving employment or other significant individual decisions with us before enabling it so the legal basis and safeguards can be assessed.

Founder-led services and confidentiality

Founders and authorised team members may see information needed for onboarding, configuration, support, analysis or agreed venue work. This includes information shared in meetings, email and documents or observed on site. Access must be limited to the agreed purpose and people who need it, under confidentiality duties. We will obtain permission before recording sessions or visits.

The confidentiality undertaking prohibits unauthorised disclosure, competitive exploitation, cross-customer reuse and publicity. A subscription or consulting engagement does not authorise case studies, screenshots, recipes, use of your name or disclosure of financial performance. Those uses require separate written approval. Advisers receive only information needed for their professional role and subject to appropriate confidentiality.

Service providers and disclosures

We use providers for the relevant purpose under appropriate protections. Principal technologies identified in the platform include:

This describes principal technologies, not a certified inventory of every production supplier or region. For processing on your organisation’s behalf we will make the current sub-processor register available before processing and on request to [email protected], identifying legal entities, functions, locations and transfer safeguards. Our contractual schedule governs advance notice and objections to changes. Providers’ separate controller activities, such as legally required payment fraud checks, are subject to their own applicable notices.

Square and other integrations exchange records within your authorised permissions. They are independently selected services and may be controllers for their own purposes. Disconnecting stops future authorised access but does not itself erase imported records; request deletion separately. Your administrator controls workspace membership. We may disclose relevant information to authorities where legally required, professional advisers under confidentiality, or a potential business successor subject to confidentiality and continued protection. A business sale does not authorise unrelated data use.

International processing and security

Hosting, AI, payment, support and monitoring can involve processing outside the UK or EEA, including the United States. We do not promise UK-only or EU-only residency. Before a restricted transfer we will ensure a lawful mechanism: for example applicable adequacy regulations/decisions or appropriate contractual safeguards, including the UK International Data Transfer Agreement or relevant EU standard contractual clauses with the UK Addendum as applicable. Required transfer assessments and supplementary measures must also be in place. You may request details and copies of relevant safeguards, subject to necessary redactions protecting others’ confidential information.

We use safeguards proportionate to risk, including account/organisation access controls, protected communications, credential handling and monitoring. No system is risk-free. We do not claim a certification or guaranteed recovery time unless expressly agreed and evidenced. Our contracts provide for incident handling, processor breach notification without undue delay and cooperation with the relevant controller. Report suspected privacy incidents to [email protected].

Retention and deletion

We retain information only as needed for its purpose, applicable instructions and legal duties. Cancelling payment and requesting deletion are separate actions.

• Workspace records, conversations and files: retained for an active service or agreed read-only hosting, subject to earlier lawful deletion instructions. The standard termination arrangement gives 30 days to request return, followed by deletion or anonymisation from active systems within a further 60 days unless continued hosting is agreed. Isolated backups are removed within 90 days of active deletion, remain protected and are unavailable for ordinary use. Earlier lawful instructions and required legal retention take priority. We coordinate deletion with relevant providers and explain necessary exceptions.
• Account, contract, billing and tax records: retained for the relationship and applicable accounting/tax duties or legal claims. UK company accounting records normally require six years from the end of the relevant financial year. A live dispute or legal hold may require longer retention. This does not justify keeping all customer operational content.
• Enquiries and support/consulting correspondence: retained to handle the request or engagement, relevant follow-up, necessary service history or legal claims. Retention is reviewed against the last meaningful contact, sensitivity and any objection or erasure request. Confidential customer material remains subject to contractual return/deletion duties.
• Security and diagnostic records: retained as needed for fault diagnosis, risk management and investigations, considering sensitivity and investigation status. Periods vary by system; request the period applicable to a particular record. Security retention does not permit unrelated use of customer content.
• Public campaign events: the first-party store has a 180-day expiry policy, subject to background database deletion timing. Attribution submitted with an enquiry follows enquiry-record retention.
• Preferences: this browser’s analytics choice expires after six months. We may keep a minimal marketing suppression record to honour an opt-out. Session storage normally lasts for the tab session; login storage follows authentication validity and sign-out controls.

If law or legal claims require retention we will explain the reason, restrict use and protect the retained record. Backup deletion is not immediate; deletion instructions must be reapplied if data is restored. For organisation-controlled data, we verify its instruction and assist it in responding to your rights request.

Cookies, browser storage and optional analytics

The website and platform use cookies and similar storage for login, session continuity, security and requested functions. Examples include cross-domain authentication state, tokens and the help-feedback session identifier created when you submit feedback. Blocking essential storage may prevent those functions. Ordinary server connection/security records are still needed to deliver pages or submit an enquiry when you reject optional analytics.

Optional public-site analytics/experience tools, where configured, remain disabled until you select Allow optional analytics. That choice also controls first-party campaign-interaction events. Essential only keeps those optional tools off. The choice is stored on this browser for six months under crunch_cookie_choice_v1; if storage is unavailable, optional analytics remain off. Open Cookie preferences in the footer to change your choice. Withdrawing permission reloads the page to stop already loaded measurement scripts. Previously set third-party cookies may need removal through your browser’s site-data controls; requested essential functions remain available.

Google measurement may use identifiers such as _ga and Hotjar _hj identifiers when configured. Their precise storage and duration depend on the enabled configuration and provider. Permission does not authorise sending private workspace content to these tools. External linked services have their own notices. Removing browser data can sign you out or reset preferences.

Marketing, your rights and complaints

Account, security, support and billing messages are separate from optional marketing. We obtain consent where required by electronic-marketing law, and otherwise contact business recipients only where permitted with an opt-out. Unsubscribe through the message or contact [email protected]. Essential service messages may continue. Use Cookie preferences to change analytics permission.

Subject to applicable conditions and exceptions, you may request access, correction, erasure, restriction, portability or object to legitimate-interest processing. You have an unconditional right to object to direct marketing. You can withdraw consent without affecting earlier lawful processing. Applicable safeguards also cover solely automated decisions with legal or similarly significant effects. We will explain any lawful restriction on a request.

Contact [email protected] with enough detail to identify your request. We use proportionate identity/authority checks and respond without undue delay, normally within one month. Any lawful extension or need for clarification will be explained under applicable law. Requests are normally free; any lawful refusal or fee for a manifestly unfounded or excessive request will be explained. For data controlled by your employer or another Crunch customer, contact that organisation first; we will forward requests and assist it under our agreement.

You may complain directly to the UK Information Commissioner’s Office or your applicable supervisory authority. You do not have to contact us first. We also welcome the opportunity to resolve concerns through our privacy contact.

Updates

We will publish the updated date and version here and draw material changes to your attention where appropriate. A policy update does not itself change the lawful basis, obtain consent, amend an existing Order or weaken our confidentiality undertaking. Any new use needing consent or contractual agreement requires that separate step.