Privacy notice

1. Who we are and how to contact us

SpyDine is a UK sole-trader business providing confidential restaurant guest-experience audits, reporting, action plans, training and the related online platform. For the personal information covered by this notice, SpyDine is the data controller unless we tell you otherwise.

For privacy questions or to exercise a data-protection right, email hello@spydine.com.

2. Information we use

• Enquiry and booking information: your name, work email, phone number, business and restaurant details, address, local area, preferred audit window and the improvement goals you provide.
• Account and platform information: sign-in details, role, organisation and location membership, account activity, training progress and notifications.
• Audit and service information: audit answers, notes, images or other evidence, reports, action plans, assignments and service history.
• Billing information: billing contact details, invoice and payment status, and Stripe customer, payment, subscription or invoice identifiers. SpyDine does not store full payment-card details.
• Technical and security information: device, browser, network, session and security-log information needed to protect the service and investigate misuse.

3. Why we use information

Provide and administer the service

We use information to respond to enquiries, create and manage bookings, run audits, deliver reports, provide portal access and support customers. Our usual legal basis is performance of a contract or taking steps requested before a contract.

Take and manage payment

We use billing information to process Checkout payments, subscriptions and 14-day invoices. This is necessary for our contract with you and, where relevant, to meet accounting and tax obligations.

Keep the platform secure

We use technical and security information to prevent fraud, control access, maintain records and improve reliability. This is in our legitimate interests and those of our customers in operating a secure service.

Communicate about your service

We send service messages such as invitations, booking confirmations, audit updates, report availability, invoice notices and security alerts. We do not use service emails for unrelated marketing without a suitable lawful basis.

Meet legal obligations and resolve issues

We may keep or disclose information where required by law, to establish or defend legal claims, or to investigate suspected misuse of the service.

4. Where information comes from

Most information comes directly from you or people authorised by your organisation. We may also receive information from auditors completing an assignment, other authorised platform users, and payment-status information from Stripe. We do not receive full card details from Stripe.

5. Who we share information with

We use carefully selected providers to operate the service, including Vercel for application hosting and delivery, Supabase for database, authentication and private storage, Stripe for payment processing, and Postmark for transactional email when email delivery is enabled. They may process personal information only to provide their services to us and under appropriate contractual safeguards.

We may also share information with your organisation's authorised users, auditors assigned to the relevant work, professional advisers, insurers, regulators, law-enforcement bodies or others where the law requires or permits it. We do not sell personal information or make audit reports public.

Some providers may process information outside the UK. Where that happens, we will use the transfer safeguards required by applicable data-protection law.

6. How long we keep information

We keep information only for as long as it is reasonably needed for the purposes above. Account, booking, audit and platform records are normally retained while the relevant customer relationship or operational history is active. Billing and transaction records may be retained for longer where accounting, tax, legal or dispute-resolution requirements apply. We then delete, anonymise or securely archive information when it is no longer needed.

7. Security and confidential reports

SpyDine uses access controls, encrypted connections, tenant isolation, role-based permissions and security logging to help protect personal information and confidential audit material. Access to a report or audit record is limited to the relevant authorised organisation users, assigned auditors and SpyDine personnel who need it to operate or support the service.

8. Your rights

Depending on the circumstances, you can ask us for access to your information, correction of inaccurate information, deletion, restriction, a portable copy, or to object to processing based on legitimate interests. You can also object to direct marketing at any time. Email hello@spydine.com; we may need to verify your identity before responding.

You can complain to the UK Information Commissioner's Office (ICO) if you are unhappy with how we use your information. Details are available at ico.org.uk/make-a-complaint.

9. Cookies and automated decisions

SpyDine uses cookies and similar storage necessary for sign-in, session security and core platform functionality. We do not currently use advertising cookies. Stripe Checkout and other providers may use their own technology under their own privacy notices when you use their services.

We may use automation to support operational tasks such as matching an audit area or checking availability. SpyDine does not make solely automated decisions that produce legal or similarly significant effects on individuals.

10. Changes to this notice

We may update this notice when the service or legal requirements change. The current version will always be published on this page. If we make a material change that affects active platform users, we will take appropriate steps to notify them.

Read our Terms of Service.