Privacy Policy

1. Who We Are

CartaGrid Limited ("CartaGrid", "we", "us", "our") is a company registered in England and Wales. Our registered office is at 14 Clifton Moor Business Village, James Nicholson Link, York YO30 4XG. We operate the CartaGrid allergen compliance platform, accessible at cartagrid.com.

For any privacy-related queries, contact us at operations@cartagrid.com.

2. What Data We Collect

We collect and process the following categories of personal data:

• Account data: Name, email address, job role, venue name
• Operational data: Menu items, ingredients, allergen declarations, HACCP records
• Usage data: Login timestamps, actions performed within the platform, audit trail entries
• Payment data: Billing details processed securely via Stripe (we do not store card data)
• Communications: Support messages and correspondence

3. How We Use Your Data

We use your personal data to:

• Provide and maintain the CartaGrid platform
• Ensure allergen compliance and audit trail integrity under Owen's Law and UK FSA requirements
• Process payments and manage subscriptions
• Send service notifications, compliance alerts, and support communications
• Improve platform performance and reliability
• Meet our legal and regulatory obligations

4. Legal Basis for Processing

We process your data on the following legal bases under UK GDPR:

• Contract performance: To deliver the CartaGrid service you have subscribed to
• Legal obligation: To maintain allergen records as required by UK food safety law
• Legitimate interests: Platform security, fraud prevention, and service improvement
• Consent: Where you have provided explicit consent for specific communications

5. Data Sharing

We do not sell your personal data. We share data only with trusted third-party processors necessary to deliver our service, including:

• Airtable — database infrastructure (US, under Standard Contractual Clauses)
• Glide — frontend application platform (US, under Standard Contractual Clauses)
• Stripe — payment processing (EU/US, PCI DSS compliant)
• Anthropic — AI processing for menu ingestion (US, under Standard Contractual Clauses)
• Make.com — automation platform (EU, Czech Republic)
• Retell AI — voice agent and customer service platform (US, under Standard Contractual Clauses)

All processors are bound by data processing agreements and are obligated to protect your data.

6. Data Retention

We retain your data for as long as your account is active and for a period of 7 years thereafter, in line with UK food safety audit requirements. Payment records are retained for 7 years in accordance with HMRC requirements. You may request deletion of non-compliance data at any time.

7. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of your data (where legally permissible)
• Object to or restrict processing
• Data portability — receive your data in a machine-readable format
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, contact us at operations@cartagrid.com.

8. Security

We implement appropriate technical and organisational measures to protect your data, including role-based access controls, immutable audit logging, encrypted data transmission, and regular security reviews. Our platform status and uptime are monitored continuously at status.cartagrid.com.

9. Cookies

CartaGrid uses only essential cookies required for platform functionality and session management. We do not use advertising or tracking cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify subscribers of material changes by email. The current version is always available at cartagrid.com/privacy.

11. Contact

CartaGrid Limited
14 Clifton Moor Business Village, James Nicholson Link, York YO30 4XG
operations@cartagrid.com
cartagrid.com