Privacy Notice

Last updated: 15 October 2026

This Privacy Notice explains how Toque Manager processes personal data when you use our website, application and services.

It explains the processing for which Toque Manager acts as a data controller. Where your business uses Toque Manager to store or process personal data on its behalf, your business will normally be the controller and Toque Manager will act as its processor. That processing is governed by our Data Processing Agreement.

1. Who controls your data

Toque Manager Ltd, a company registered in England and Wales, company number 17509641 ("Toque Manager", "we", "us"), is responsible for the personal data described in this Privacy Notice.

Registered address: 104 Josling House, London SE7 7GP

ICO registration number: ZC280104

When we are the controller

We act as the data controller for personal data we process for our own business purposes, including:

creating and administering user accounts;
managing our relationship with customers and users;
processing subscriptions and payments;
providing customer support;
maintaining the security, availability and integrity of the service;
preventing fraud, misuse and unauthorised access;
complying with legal and regulatory obligations; and
maintaining appropriate business and technical records.

When we are the processor

Where your business uses Toque Manager to store or process personal data about its employees, customers, suppliers or other individuals, your business will normally be the data controller and Toque Manager will act as its data processor.

This may include personal data contained in:

HACCP records;
staff records;
supplier records;
invoices;
uploaded documents;
recipes;
sales records; and
other information entered into the service.

Your business is responsible for determining the purposes and lawful basis for that processing and for providing any privacy information required by law.

Our processing of this data is governed by our Data Processing Agreement.

2. What we collect

Depending on how you use Toque Manager, we may process the following categories of information:

Category	Examples
Account information	Name, email address, role, login and account details
Business information	Business name, country, currency, VAT information and configuration settings
Kitchen records	Recipes, ingredients, costing information, plating photographs and notes
Supplier information	Supplier names and contact details, prices and related records
Invoice information	Invoice images, supplier details, line items, totals and other information contained in uploaded invoices
Food safety records	HACCP checks, temperature records, probe records, training and delivery records, complaints, pest records and supporting documents
Sales information	Sales figures and information imported from supported files or integrations
Billing information	Subscription status and information required to administer billing
Technical information	IP address, browser/device information, authentication records, security logs and information about use of the service
Support information	Information you provide when contacting customer support

We may receive personal data:

directly from you;
from your employer or business;
from other authorised users of your Kitchen;
from documents uploaded to the service;
from integrations or imported files; or
automatically through your use of the service.

We do not normally require you to provide special category data. If your business chooses to enter special category data into the service, your business remains responsible for ensuring that the processing is lawful and that an appropriate Article 9 condition applies.

3. Why we process personal data

We process personal data for the following purposes:

Purpose	Lawful basis
Create and administer your account	Necessary for performance of our contract
Provide and operate Toque Manager	Necessary for performance of our contract
Process subscriptions and payments	Necessary for performance of our contract and, where applicable, compliance with legal obligations
Provide customer support	Necessary for performance of our contract and, where appropriate, our legitimate interests in providing effective support
Maintain service security and prevent misuse	Our legitimate interests in protecting the service, our customers and users
Maintain backups and recover the service	Our legitimate interests in operating a reliable and resilient service
Prevent fraud and abuse	Our legitimate interests in protecting our business, customers and users
Comply with legal obligations	Necessary for compliance with a legal obligation
Establish, exercise or defend legal claims	Our legitimate interests and, where applicable, compliance with legal obligations

Where we rely on legitimate interests, those interests include operating, securing and protecting our business and services, preventing misuse, maintaining service reliability and protecting our customers and users.

We consider the impact of this processing on individuals and apply appropriate safeguards.

We do not sell personal data.

We do not use Customer Data to train general-purpose AI models.

4. AI-assisted processing

Some Toque Manager features use Anthropic's commercial API services to extract, structure or suggest information from information you choose to submit.

Examples include:

extracting supplier and line-item information from an invoice photograph;
extracting recipe information from an uploaded image; and
suggesting allergen information based on ingredient or stock information.

Only the information necessary to perform the relevant AI-assisted feature is sent to the AI provider.

AI-generated or AI-suggested information is not treated as verified fact by Toque Manager. Users must review and verify AI-generated information before relying on it, particularly information concerning allergens, food safety or other matters that could affect customers or legal compliance.

For commercial API services, Anthropic states that customer inputs and outputs are not used to train its models by default, subject to its applicable commercial terms and exceptions.

Where Anthropic processes personal data on our behalf, we treat it as a sub-processor and require appropriate contractual and data protection safeguards.

5. Who we share personal data with

We use service providers to operate Toque Manager. Depending on the service and the relevant processing activity, these providers may process personal data on our behalf as processors or sub-processors.

Our principal providers include:

Provider	Purpose
Supabase	Database, authentication and file storage
Vercel	Application hosting
Stripe	Subscription billing and payment processing
Anthropic	AI-assisted processing
Resend	Account, invitation and password-reset emails; account-deletion confirmation and inactivity-warning emails

We may appoint or replace service providers where necessary to operate the service.

Where a provider acts as our processor or sub-processor, we require appropriate contractual data protection obligations.

Some providers, including payment providers, may also process certain personal data as independent controllers for their own legal, regulatory, security, fraud-prevention or other legitimate purposes. Their own privacy information will apply to those activities.

We may also disclose personal data:

where required by law;
in response to a valid legal process or regulatory requirement;
where necessary to protect our rights or property;
where necessary to protect users, customers or the security of the service; or
as part of a corporate transaction such as a merger, acquisition or sale of assets, subject to appropriate safeguards.

6. Where it's stored and international transfers

Personal data may be stored or processed by us and our service providers in the UK, the European Economic Area or other countries where our providers operate.

Supabase project region: London, United Kingdom (eu-west-2). Your Kitchen's data is stored and processed in the UK.
Vercel processing/storage arrangements: Vercel Inc. (United States) hosts the application and runs it on its global edge/serverless network. Vercel processes data under its Data Processing Addendum, which incorporates the UK Addendum to the EU Standard Contractual Clauses for transfers outside the UK.
Anthropic processing location/transfer mechanism: Anthropic, PBC (United States) processes the information sent to it for AI-assisted features under its Data Processing Addendum, which incorporates the UK Addendum to the EU Standard Contractual Clauses for transfers outside the UK.
Stripe processing location/transfer mechanism: Subscription billing and payments are processed by Stripe. For UK customers this is contracted through Stripe Payments UK, Limited and Stripe Payments Europe, Limited (Ireland), with underlying infrastructure operated globally by Stripe, Inc. (United States). Stripe's Data Processing Agreement incorporates the UK Addendum to the EU Standard Contractual Clauses for transfers outside the UK.
Resend processing location/transfer mechanism: Plus Five Five, Inc. (trading as Resend), San Francisco, United States — primary processing takes place in the United States. Transfers are made under Resend's Data Processing Agreement, incorporating the UK Addendum to the EU Standard Contractual Clauses; Resend also participates in the EU-U.S. Data Privacy Framework and its UK extension.

Where personal data is transferred outside the United Kingdom, we will use an appropriate legal safeguard where required by applicable data protection law.

Depending on the destination and circumstances, this may include:

an applicable UK adequacy regulation;
the UK International Data Transfer Agreement;
the UK Addendum to the EU Standard Contractual Clauses; or
another lawful transfer mechanism recognised under UK data protection law.

Further information about international transfers and the safeguards used for particular providers is available by contacting us at customerservice@toquemanager.com.

7. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Privacy Notice, unless a longer period is required or permitted by law.

Our retention periods are:

Account and customer relationship data: for the duration of the customer relationship. When you delete your Kitchen, this data is removed immediately together with your Customer Data — we do not separately retain it afterwards, except where a service provider (for example, our payment processor) independently retains records of its own under its own legal obligations. If a Kitchen's subscription lapses and is never resumed or deleted, we email the Owner a 15-day notice after 6 months of continued inactivity and automatically delete the Kitchen and all its data if nothing has changed by the end of that notice period.
Customer Data processed on behalf of a customer: in accordance with the customer's instructions and our Data Processing Agreement.
Backups: retained for 30 days on a rolling basis, after which they are automatically overwritten or deleted.
Billing and financial records: retained for the period required by applicable accounting, tax and legal obligations (currently six years under UK accounting and tax requirements).
Support records: where you contact us by email, we aim to keep that correspondence for around 2 years after the matter is closed in case of follow-up, unless a longer period is needed to resolve a dispute or comply with law. We do not currently operate a separate in-app support-ticket system — support is handled by email.
Security logs: Toque Manager does not currently maintain a separate application-level security log. Authentication and infrastructure-level logs are retained by our hosting and database providers according to their own standard settings.

When a customer account is closed, Customer Data will be deleted or returned in accordance with the customer's instructions, the Data Processing Agreement and applicable legal requirements.

Where applicable, some information may be retained after account closure where necessary to comply with legal obligations or establish, exercise or defend legal claims.

8. Your rights

Depending on the circumstances and applicable law, you have rights including:

the right to access your personal data;
the right to correct inaccurate or incomplete personal data;
the right to request deletion of your personal data;
the right to request restriction of processing;
the right to object to processing based on legitimate interests;
the right to data portability where the legal requirements for portability are met; and
where we rely on consent, the right to withdraw that consent at any time.

These rights are subject to certain legal exceptions and limitations.

To exercise a right, contact us at customerservice@toquemanager.com.

We may need to verify your identity before responding to a request.

Where Toque Manager is acting as a processor for your business, requests relating to Customer Data should normally be directed to the relevant customer/controller. We will assist the controller as required by our Data Processing Agreement and applicable law.

We aim to respond to valid data protection requests within the time period required by applicable law.

9. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure.

These measures include, where appropriate:

encryption in transit;
access controls and role-based permissions, configurable per feature area down to view-only versus edit access;
database-level controls designed to isolate customer data between Kitchens;
restricted use of privileged server-side credentials;
authentication and access-management controls;
backups and recovery procedures; and
monitoring and controls designed to identify and prevent unauthorised access or misuse.

No internet-based service can be guaranteed to be completely secure.

We regularly review our security measures and update them as the service develops.

10. Children

Toque Manager is a business-to-business service and is not directed at children.

We do not knowingly provide user accounts to children.

If a customer enters personal data relating to a child into the service, the customer remains responsible for ensuring that the processing is lawful and appropriate.

11. Automated decision-making

We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals.

Our AI-assisted features are used to extract, structure or suggest information. They do not independently make legal or similarly significant decisions about individuals.

12. Changes to this Privacy Notice

We may update this Privacy Notice when our services, processing activities or legal obligations change.

We will publish the updated version on this page and, where appropriate, notify customers or users of material changes before they take effect.

13. Contact and complaints

If you have a question about this Privacy Notice or how we process personal data, contact us at:

Toque Manager Ltd
104 Josling House, London SE7 7GP
Email: customerservice@toquemanager.com

If you are unhappy with how we have handled your personal data, please contact us first so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner's Office (ICO).

ICO website: ico.org.uk
ICO complaints: ico.org.uk/make-a-complaint