Privacy Policy

1. Who We Are

This policy explains how Forbzy Apps Ltd, trading as Forbzy ("we", "us"), handles personal data. We are a company registered in England and Wales (company number 17428802, registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ). Contact us at info@forbzy.com.

We are the data controller for the details described in section 2: your sign-up details, the client record we keep about you, the login details we hold for you and your team, and basic website data. We are not the controller of your venue data. That belongs to you (see section 3). Where you invite us into your own Supabase account, we act only as your data processor.

2. What Data We Collect and Hold

• Sign-up details — name, venue name, email address, phone number, which apps interest you, whether you want the database apps, and the email you will use for your own storage account (never a password for it). These arrive in our email inbox through our sign-up form.
• Your client record — we keep a record about each client in our own protected database: business name, a short code for your Hub, your logo, a contact name, email and phone, your plan and whether you have paid the setup fee, a few notes, and which apps are switched on for you.
• Hub login details — the email address for each login we create for you and your team (we choose the first password), a securely scrambled (hashed) version of that password, and basic sign-in records such as the time of sign-in.
• Payment information — handled by Stripe. We can see your name, email, what you paid and when. We never see or store your card number.
• Messages — anything you email to us.
• Website data — when you visit forbzy.com, your device's IP address and browser details are processed by our hosting provider and by Google Fonts (see section 6).

3. Your Venue Data: What We Do Not Hold

The information you put into the apps is your venue data (for example allergen records, compliance records, staff records and business figures). It belongs to you, and you are the data controller of it.

• Apps that work on your device keep your data in your own browser, on your own device. We do not receive it.
• The three database apps (SafePlate, The Business Page and The HR Manager) keep your data in your own Supabase account. We can see it only if you invite us into that account. If you do, we use that access to set up, maintain, fix and support your apps, and for no other purpose. You can remove us at any time. We will also remove ourselves when your subscription ends, unless you ask us to stay. While we have access, we act only as your data processor and follow your instructions.
• The HR Manager can hold sensitive information about your staff, for example home addresses, National Insurance numbers, bank details and your managers' private notes. Within the app, these can be seen only by the manager who entered them and the owner, unless a manager chooses to share a note with the other managers. If you have invited us into your Supabase account, that data is technically visible to us. We do not open staff records or private notes unless that is needed to fix a problem you have reported to us.
• SafePlate can hold an incident log (for example a customer's name, what happened, and any allergic reaction or injury) and employee records with documents such as certificates, which can include health information. Within the app, only the owner and managers can see the incident log and employee records; staff cannot. If you have invited us into your Supabase account, that data is technically visible to us. We do not open incident records or employee records unless that is needed to fix a problem you have reported to us.
• SafePlate's AI allergen assistant is optional. If it is switched on for you, the recipe and ingredient text you ask it to check or translate is sent to Google's Gemini service, using your own Google account and key, to produce suggestions. Google's own terms and privacy policy apply to that account. We set it up so that no names, staff details or incident details are sent. See section 5.
• If you are an employee or team member of a venue that uses Forbzy, your venue is usually the controller of your data in its apps. Please contact them first.

4. How We Use Your Data and Why

We use your data to:

• Set up and run your Hub and your logins
• Take payments and manage your subscription
• Contact you about your account and service updates
• Respond to enquiries and support requests
• Keep our service secure and improve it
• Keep the records we are legally required to keep

Our lawful bases under UK GDPR are: carrying out our contract with you (providing the Service you signed up for); our legitimate interests (running and securing a small business, and keeping client records); and legal obligation (such as accounting and tax records). We will never sell your data or use it for advertising.

5. Who We Share Data With (Sub-processors)

We use these companies to run the service:

• Supabase (supabase.com) — hosts our client records and Hub logins, in our own project in London. In your own account, it also hosts the database apps
• Netlify (netlify.com) — hosts our website, your Hub, and the copies of the database apps we host for you
• Stripe (stripe.com) — payment processing
• Web3Forms (web3forms.com) — delivers our sign-up and contact forms to our email
• Our email provider — receives and stores the emails we send and receive
• Google Fonts (Google) — supplies the fonts our pages use
• Google Gemini (Google) — only if you switch on SafePlate's AI allergen assistant, under your own Google account and key, which you pay Google for directly: receives recipe and ingredient text to suggest allergens, dietary labels or a translation. It is not sent names, staff details or incident details

Some of these companies are based outside the UK, or may process data outside the UK. Each publishes its own data protection terms.

Other companies' apps. Some tiles in your Hub open apps or courses run by other companies (for example, The Bar School runs on Mindsmith, and My Cocktail Book is an Apple App Store app). We do not control what those services do with your data. Their own privacy policies apply.

6. Website, Fonts and Cookies

forbzy.com has no analytics and does not use advertising or tracking cookies. Our pages load fonts from Google Fonts, which means your device contacts Google when you visit, and Google can see your IP address. Your Hub keeps you signed in using your browser's own storage. This is strictly necessary for signing in and is not used for tracking. No cookie consent banner is required as we only use what is strictly necessary.

7. Data Storage & Security

Our client records and Hub logins sit in our own Supabase database, which only we can read. Supabase holds SOC 2 Type 2 certification, and data is encrypted in transit (TLS) and at rest. Your venue data is kept as described in section 3.

Sign-up and contact forms are delivered through Web3Forms to our email. Please keep your Hub login private. If you think someone else has it, ask us to reset it.

8. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — request your data in a portable format
• Restriction — request we limit how we process your data
• Object — object to processing based on legitimate interests

To exercise any of these rights, email info@forbzy.com. We will respond within one month.

9. Data Retention

When your subscription ends, we switch off your Hub logins. We keep your client record and sign-up details for up to 12 months after that, then delete them. We keep accounting and payment records for as long as UK law requires (normally six years). Stripe keeps its own records under its own policy.

Your venue data, on your device or in your own Supabase account, is under your control. You can delete it at any time. We can delete data in your Supabase account only if you have invited us in and ask us to.

10. Our Approach to Data Protection

Forbzy Apps Ltd is committed to handling personal data responsibly and in accordance with UK GDPR. We keep what we hold to the minimum needed: your contact details, client record, login details and payment details. Your venue data stays under your direct ownership and control at all times.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email. The date at the top of this page indicates when it was last updated.

12. Contact & Complaints

For any privacy-related questions, contact us at info@forbzy.com.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the ICO at ico.org.uk.