Agreement and business customers
These Terms & Conditions are between Crunch Hospitality Solutions Ltd, registered in England and Wales under company number 15010010, with its registered office at Flat 1, 1 Montenotte Road, London, England, N8 8RL (“Crunch”, “we”, “us”), and the business identified in the order, subscription or agreed proposal (“you”). Contact: [email protected].
They cover our hosted Crunch platform, websites, AI assistants, reporting, integrations and any onboarding, configuration, training, data work or hospitality consulting we agree to provide (“Services”). Services are intended for business use. You must have authority to bind the business and to authorise access to its systems and data. If you are using Crunch for personal, non-business purposes, contact us before ordering; these terms do not remove mandatory consumer rights.
An agreement is formed when you accept an order or online subscription that incorporates these terms and we confirm it, including by activating the requested service. A website visit alone does not create a paid subscription. Keep a copy of the version accepted. Existing contracts are not replaced merely by publication of this page. Our confidentiality undertaking below also applies to information you entrust to us for an evaluation or requested pre-contract discussion, in consideration of that disclosure and our evaluation services; no separate NDA is required.
An “Order” means the accepted checkout, order form or written proposal identifying the plan or work, price and duration. In a conflict, mandatory law and agreed international-transfer clauses take priority, followed by the data-processing schedule for personal-data matters, an expressly agreed variation in the Order, and these terms. A general Order description does not reduce our confidentiality undertaking. The Privacy Policy explains personal-data handling; it is a notice, not consent to processing or an expansion of our licence to your data. Purchase-order boilerplate does not change this agreement unless we expressly accept it.
Platform access and responsibilities
During an active subscription or trial, we grant your authorised users a non-exclusive, non-transferable right to use the subscribed features for your business. Your organisation administrator controls memberships, roles and connected services. You are responsible for authorised users’ conduct, maintaining accurate account information, securing credentials and promptly reporting suspected compromise. We remain responsible for our own security and access-control obligations.
Do not use the Services unlawfully, infringe others’ rights, introduce malicious code, bypass access controls or usage limits, access another organisation’s data, resell access without agreement, or test security without written authorisation. Reverse engineering restrictions apply only to the extent permitted by law. Do not submit unnecessary special-category data, criminal-record information, children’s data or full payment-card details. Agree any intended sensitive-data processing with us first.
You retain responsibility for lawful collection, appropriate privacy notices, permissions and instructions for data supplied by your business, including employee and customer information. Give us only access reasonably needed for the agreed work. Keep independent copies of records needed for tax, food safety and business continuity; Crunch is not your sole statutory archive.
Subscriptions, trials and usage
Your Order identifies Full Crunch or OPS, monthly or annual billing, applicable allowances, fees and any promotion. Pricing explains the current offers. The price and promotion accepted in your Order govern the initial purchased term; an expired promotion does not continue indefinitely. Prices are in GBP unless stated otherwise, with VAT or other applicable taxes added where due and disclosed before purchase. Hands-on services and expenses are separate unless expressly included.
Full Crunch offers an eligible 90-day trial without a payment card. OPS is a paid plan without that trial. Trial allowances and eligibility are disclosed at signup. If a trial expires without a payment method or paid activation, the workspace becomes read-only rather than creating a payment obligation or automatically deleting your data. If you expressly authorise a paid subscription, the disclosed payment terms apply. Read-only access may depend on security and technical availability; it is not a promise of indefinite hosting.
Monthly subscriptions renew for successive months and annual subscriptions for successive years unless cancelled before renewal. Annual plan fees are paid upfront. Included monthly usage renews on the subscription’s monthly meter cycle, including on annual plans, rather than accumulating. Full Crunch includes recurring AI output-token and invoice-capture allowances. OPS has a one-off, non-expiring AI welcome credit, rather than a recurring monthly AI allowance, and a recurring invoice-capture allowance. Credits have no cash value and are not transferable between organisations.
Additional invoice-capture pages and AI output tokens are charged at the rates disclosed in the Order, normally monthly in arrears even on annual plans. Allowances are not spending caps: additional usage is automatic and uncapped after applicable allowances or credits are exhausted. Only successful invoice extractions and completed logical AI turns are customer-metered; failed, cancelled or incomplete work is not charged as a completed turn. Your authorised users can incur usage for your organisation. Review usage regularly and contact us if you need a separately agreed spending control. We do not promise a hard cap unless expressly agreed.
You authorise our payment provider to collect agreed recurring fees and incurred usage charges using your authorised payment method. An annual prepayment does not prepay overages. We may suspend paid capabilities for overdue undisputed amounts after notice and a reasonable opportunity to resolve the issue; an immediate restriction may be necessary for fraud or security. A payment failure does not itself erase data or cancel accrued charges. Raise billing concerns promptly with [email protected]; we will investigate and correct errors. This does not shorten any legal claim period.
Cancellation, renewal changes and ending access
Cancel renewal through the available billing portal or by emailing [email protected] before the renewal date. Email cancellation is available even if the portal is unavailable. We will acknowledge and process a timely request; our processing delay will not invalidate it. Cancellation normally takes effect at the end of the paid period. Usage incurred before that date remains payable. Except for our breach, an express Order provision or a legal entitlement, prepaid fees are not refunded for unused time or unused allowances.
We will give at least 30 days’ written notice of changes to recurring fees or usage rates. Changes apply from the next renewal after that notice and do not alter prepaid plan fees for the current term. We will not increase agreed usage rates during a committed annual term without your agreement. You may cancel renewal before a change applies. Material reductions to committed paid functionality during a prepaid term require your agreement or a right to end the affected service and receive a proportionate refund of unused prepaid fees.
Either party may terminate for a material breach not remedied within 30 days of written notice, or immediately if it cannot be remedied. We may restrict only the access reasonably necessary to address illegal activity, a material security risk or serious misuse, and notify you unless legally prohibited or doing so would increase the risk. We will restore access when the reason is resolved. If we discontinue a paid service for convenience, we will give at least 30 days’ notice and refund unused prepaid fees for that service. Statutory insolvency restrictions apply to any termination rights.
Cancellation of paid access and deletion are separate. Following termination, we will provide 30 days to request return of your business data in a reasonably available, commonly used format, subject to lawful identity and authority checks. We will then delete or anonymise customer content from active systems within a further 60 days unless you request earlier deletion or agree continued read-only hosting. Isolated backup copies will be removed within 90 days of active deletion and remain protected and unavailable for ordinary use in the meantime. Legally required records are retained only for their required purpose. If restored for disaster recovery, deletion instructions must be reapplied. The data-processing schedule governs personal-data return/deletion and any earlier lawful instruction. We will not withhold your personal data to secure a disputed payment.
Hands-on services and operational decisions
Founder-led does not mean that every engagement includes unlimited founder time or guarantees a particular person. We will agree the scope, deliverables, fees, dependencies, schedule and any on-site work in writing. Changes to scope, expenses or third-party purchases require your agreement. In the absence of a separate cancellation arrangement, you may stop future consulting work by written notice and pay only for work already performed and unavoidable third-party costs you authorised; unused advance service fees will be returned.
We will perform the Services with reasonable skill and care. You will provide timely instructions, suitable access and a safe working environment for venue visits. We act as an independent service provider, not as your employee, director, purchasing agent or partner. We cannot bind your business, commit expenditure, publish changes to a POS system or contact suppliers on your behalf unless you authorise the relevant activity. We will disclose a material conflict of interest affecting an engagement and agree appropriate safeguards or decline the affected work.
Reports, shopping suggestions, forecasts, recipe costs, OCR and AI responses can contain errors, omissions, stale data and assumptions. Review source records, quantities, units, taxes, prices and proposed actions before relying on or applying them. AI outputs may not be unique. We do not guarantee sales, profit, savings, stock accuracy or a particular commercial result. You remain responsible for management decisions, stock counts, ordering and statutory records. Crunch is not a substitute for professional accounting, tax, employment or food-safety advice. Verify allergens and food-safety information independently. These responsibilities do not excuse our failure to exercise reasonable skill and care.
Confidentiality undertaking
We commit to keep your non-public business information confidential, whether or not it is personal data, marked confidential, uploaded to Crunch or covered by a separate NDA. This is an express obligation owed by Crunch to your business, not merely a privacy-policy statement.
“Confidential Business Information” includes information supplied by you or on your behalf, retrieved through an authorised integration, or learned, observed, recorded or inferred in providing or discussing Services. It covers recipes and methods, menus in development, ingredient and supplier prices, rebates and commercial terms, invoices, purchasing, stock, wastage, sales and transaction records, costs, margins, forecasts, plans, credentials, staff and customer information, venue observations, conversations and our analyses and outputs derived from them. It includes information belonging to your affiliates, suppliers or other parties that you lawfully entrust to us, and information received before a paid subscription starts.
We will use it only to evaluate, deliver, support and secure the Services you request, follow your lawful instructions, and meet legal obligations. We will not sell, license, monetise, or disclose it to another customer or use it to compete with your business, advise another business using your information, build customer comparisons or benchmarks, or train or fine-tune general-purpose or shared AI models. We will not enable model-provider training on it. Any different use requires your separate, specific written permission; accepting these terms is not that permission. We may improve software using general skills and non-content technical metrics, but that does not permit reuse of your business information, remembered confidential details or identifiable derived insights.
Access is limited to founders, staff, professional advisers and service providers who need it for the permitted purpose. Before access, we will bind them by enforceable confidentiality duties at least as protective as these terms (or equivalent professional duties), apply proportionate access controls and reasonable security measures, and remain responsible for those acting on our behalf. Founders’ outside interests do not authorise disclosure or reuse. Disclosure to an infrastructure or AI provider solely to perform your Services is subject to these restrictions and, where applicable, the data-processing schedule.
We will not use your business name or logo as an endorsement, disclose your relationship with us publicly, or publish screenshots, recipes, case studies, testimonials or identifiable performance figures without your prior written approval for the particular use. Providing a demonstration, support access or consulting engagement is not publicity permission. We will obtain your permission before making recordings of consulting sessions or venue visits.
Exceptions apply only where we can demonstrate with contemporaneous evidence that the information was lawfully public without a confidentiality breach, already lawfully known without restriction, received lawfully from another source without a duty of confidence, or developed independently without using your information. Information is not exempt simply because an individual component is public or someone remembers it. A confidential combination remains protected.
If law requires disclosure, we will, where legally permitted, notify you in advance, cooperate reasonably in seeking protection and disclose only what is legally necessary. On learning of unauthorised access, use or disclosure, we will notify you without undue delay, contain the issue, investigate, take reasonable remedial steps and cooperate with you. Personal-data incidents are also subject to the schedule below.
On request or when the permitted purpose ends, we will return or securely delete the information, subject to the return/deletion arrangements above and strictly necessary legal or isolated-backup retention. Retained copies remain subject to this undertaking. We will confirm completion on request. Confidentiality and use restrictions continue for as long as the information remains confidential; trade secrets remain protected for as long as they qualify as such. Termination, non-payment or a later policy update does not release us from them. You may seek an injunction or other available relief for actual or threatened breach. The liability provision below expressly preserves these obligations.
You will likewise protect our non-public technical and commercial information using reasonable care and use it only for the Services, with equivalent public-domain, lawful-receipt, independent-development and compulsory-disclosure exceptions. Your duty does not stop you discussing your own business data, reporting concerns to regulators or obtaining confidential professional advice.
Data, intellectual property and integrations
You and your licensors retain ownership of your business data, recipes, records and other supplied material. You grant us only the limited rights needed to process that material for the permitted purposes above, including hosting, authorised analysis and creating your outputs. We do not acquire ownership of your data or recipes. Where rights can arise in customer-specific reports or other deliverables created and paid for under an Order, we assign our rights in those deliverables to you on payment, excluding our pre-existing materials, platform, methods and general tools. We grant you a perpetual, non-exclusive licence to use any such embedded Crunch materials for your business. Third-party materials remain subject to their applicable licences. We do not warrant that AI outputs are capable of exclusive copyright protection.
Crunch retains rights in the platform, branding, underlying software and reusable tools. Feedback may inform improvements, but does not license Confidential Business Information or personal data for unrelated use.
Integrations such as Square operate only with appropriate authorisation and may import records, maintain credentials and apply changes within the permissions you enable. Your third-party contract remains with that provider, which may have its own fees, privacy practices and availability. Disconnecting an integration stops future authorised access but does not itself delete previously imported records. We remain responsible for our integration work and protection of data under our control. We may make reasonable changes for compatibility or security and will explain material effects where practicable.
Service standards and liability
We will use reasonable care to operate and secure the Services and resolve reported faults. Planned maintenance, third-party outages and events outside reasonable control can affect availability. No guaranteed uptime, response time, backup recovery time or certification is promised unless specified in an Order. We will take reasonable steps to mitigate disruption and notify you of material issues. A force-majeure event does not excuse confidentiality or data-protection obligations that remain within our control; if it prevents the affected service for over 30 days, either party may end that service and unused prepaid fees for it will be refunded.
Neither party excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, deliberate misuse or disclosure of Confidential Business Information, or any liability that cannot lawfully be limited. Nothing restricts an individual’s statutory data-protection rights or a regulator’s powers.
Subject to those exceptions, each party’s aggregate liability arising from the agreement is limited to the greater of £10,000 and the fees paid or payable for the Services in the 12 months before the event giving rise to the claim. For breach of confidentiality or data-protection obligations, a separate aggregate cap applies of the greater of £50,000 and twice those 12-month fees. Related claims are treated as one event; a loss is not recoverable twice under both caps. The higher cap applies instead of, rather than in addition to, the ordinary cap for those claims. Payment of properly due fees is not excused by these caps.
Subject to the same non-excludable exceptions, neither party is liable for indirect or consequential loss. This does not exclude reasonable direct costs of restoring data, responding to an incident or mitigating a confidentiality breach, or any other direct loss merely because it relates to data. Both parties must take reasonable steps to mitigate losses. These limitations apply in contract, tort (including negligence) and otherwise, to the extent reasonable and permitted by law; they do not prevent appropriate injunctive relief.
Changes, notices and governing law
We may update these terms for future Orders. For an existing agreement, material changes require at least 30 days’ written notice and take effect at renewal, unless you expressly agree earlier or a mandatory legal change requires it. You may cancel before renewal. We cannot retrospectively expand data-use rights or reduce protection for information already entrusted to us without your express written agreement. A Privacy Policy update alone never changes contractual confidentiality or processing instructions.
Send legal notices to [email protected] or our registered office. We will send notices to the account owner’s registered email or an agreed contract contact. An automated failure message means email notice has not been delivered. Each party should keep contact details current.
These terms and the Order are the entire agreement on their subject, without excluding liability for fraudulent misrepresentation. Neither party may assign the agreement without the other’s written consent, not unreasonably withheld, except in a business reorganisation or sale where the successor assumes the same obligations and no material reduction in your protection occurs. Severability and a failure to enforce a provision do not waive other rights. Third parties have no right to enforce the agreement under the Contracts (Rights of Third Parties) Act 1999 unless an Order expressly provides otherwise. Confidentiality, accrued payment obligations, intellectual-property rights, liability provisions and necessary processing/deletion duties survive termination.
English law governs, and the courts of England and Wales have exclusive jurisdiction, subject to mandatory legal protections. Please contact us first to try to resolve a dispute; this does not prevent urgent relief or a regulatory complaint.
Schedule: processing personal data for your business
This schedule forms part of the agreement and applies whenever Crunch processes personal data on your behalf. “Data Protection Law” means applicable UK GDPR and Data Protection Act 2018 requirements, as amended, and EU GDPR where it applies. Controller, processor, personal data, breach and processing have their meanings under that law. You are the controller, or a processor authorised by the relevant controller; Crunch is your processor or sub-processor. Where you are a processor, you warrant that these instructions and the engagement of Crunch are authorised by your controller. Each party will meet the duties applicable to its role. Crunch acts separately as controller for its own account administration and other purposes identified in the Privacy Policy.
Processing description and instructions
The subject matter is delivery of the Services in your Order. Processing lasts for the service term and the limited return, deletion and lawful-retention period. Its nature includes collection, transfer, hosting, organisation, retrieval, consultation, analysis, report generation, OCR, AI inference, authorised integration actions, support and deletion. Its purposes are to deliver, support and secure your requested Services.
Data subjects may include your owners, employees, contractors, suppliers, customers and business contacts. Data may include names, business contact details, account and role identifiers, transaction records, supplier and invoice information, staff-related records you provide, support communications, prompts, attachments, outputs and technical identifiers. The service is not designed to require special-category or criminal-offence data. Processing such data requires a separately agreed written scope and safeguards.
The agreement, your Order and authorised use/configuration provide documented instructions, including authorised international transfers subject to the safeguards below. We will process personal data only on those instructions, unless law requires otherwise, in which case we will tell you before processing unless legally prohibited. We will immediately inform you if, in our opinion, an instruction infringes Data Protection Law, and may pause that instruction while it is resolved. We will not determine unrelated purposes, sell the data, use it for advertising, train shared models or combine it with another customer’s identifiable data.
Confidentiality, security and assistance
We will ensure persons authorised to process personal data are bound by confidentiality and receive appropriate instructions. Taking account of risk, the nature of the data, available technology and implementation costs, we will maintain appropriate technical and organisational measures under Article 32. These include access restriction and tenant authorisation, protected transport, credential handling, appropriate storage protection, monitoring, incident handling and backup/recovery arrangements. We will review safeguards and not materially reduce overall protection during the term. We will make further information reasonably available for your assessment; this is not a representation of a specific security certification or blanket data-residency guarantee.
We will notify you without undue delay after becoming aware of a personal-data breach affecting your data. As information becomes available, we will describe its nature, affected data and people, likely consequences, contact point and mitigation, with updates and reasonable cooperation. We will preserve relevant evidence. We will not wait for a complete investigation before initial notice. You retain responsibility for notifying regulators and affected people unless the law requires us to notify directly.
Taking account of the nature of processing and information available, we will assist with data-subject requests, security obligations, breach response, impact assessments and regulatory consultations under Articles 32–36. We will promptly forward requests relating to your data and respond only on your instructions unless law requires otherwise. Routine compliance assistance is included; unusually extensive assistance may be charged only at a reasonable fee agreed in advance, without delaying legally required assistance or charging you to remedy our own breach.
Service providers and international transfers
You give general written authorisation for necessary sub-processors, subject to the following safeguards. Before processing your data, we will make available the current list identifying each provider’s legal entity, function, processing location and applicable transfer safeguard, and provide it on request to [email protected]. The Privacy Policy identifies the principal technology providers and purposes; it does not replace that detailed register. We will give at least 30 days’ prior written notice of an intended addition or replacement, allowing you to object on reasonable data-protection grounds before it receives your data. We will work to resolve an objection through a suitable alternative or safeguard. If unresolved, either party may end the affected service before the change, with a refund of unused prepaid fees for it.
We will impose equivalent data-protection obligations by written contract on sub-processors, verify appropriate safeguards and remain responsible to you for their performance. We will not transfer personal data outside the UK or, where relevant, the EEA without a lawful mechanism and required assessment and supplementary measures. These may include applicable adequacy regulations or decisions, or the relevant EU standard contractual clauses with the UK Addendum or the UK International Data Transfer Agreement as appropriate. The required transfer instrument will be executed before a restricted transfer; this paragraph does not purport to execute incomplete standard clauses. Contact us for the safeguards relevant to your data. Use of the service is not consent to an otherwise unlawful transfer.
Return, deletion and compliance evidence
At your choice on termination or a lawful deletion instruction, we will return personal data in a reasonably available commonly used format and delete remaining copies, or delete it, unless law requires retention. We will follow earlier instructions where applicable and otherwise the return/deletion timetable above. We will ensure sub-processors do the same, isolate any temporary backup retention, prevent further ordinary use and confirm completion on request. Data retained by law remains protected, limited to that purpose and deleted when no longer required.
We will provide information necessary to demonstrate compliance with Article 28 and allow and contribute to audits and inspections by you or an independent auditor bound by confidentiality. Reasonable notice, normal business hours and protections for other customers’ data apply, but will not obstruct a regulator, a breach investigation or legally necessary audit. We will first offer relevant documentation where it can meet the requirement. The schedule does not transfer either party’s statutory responsibilities to the other.