1. Who We Are

SmartlyServe Ltd ("SmartlyServe", "we", "us", "our") operates the SmartlyServe bakery management SaaS platform at smartlyserve.com. We are the data controller for personal data collected through our platform.

Contact: privacy@smartlyserve.com

2. Information We Collect

2.1 Account Information

• Name, email address, phone number
• Bakery name, address, country
• Billing name and address (payment processed by Stripe / PayPal — we do not store card numbers)
• Username and hashed password

2.2 Business Data You Enter

• Customers, products, recipes, orders, invoices, suppliers
• Employee records you create within the platform
• Financial data (costs, prices, revenue figures)

2.3 Usage Data

• Log data: IP address, browser type, pages visited, timestamps
• Device information (OS, screen resolution)
• Feature usage patterns (aggregated and anonymised for analytics)

2.4 Communications

• Emails and messages you send us via contact forms or support tickets
• Demo request details

3. How We Use Your Information

Purpose	Legal Basis (GDPR)
Providing and operating the SmartlyServe platform	Contract performance
Processing payments and managing subscriptions	Contract performance
Customer support and responding to enquiries	Legitimate interests / Contract
Sending transactional emails (invoices, password resets)	Contract performance
Sending product updates and newsletters (with consent)	Consent
Fraud prevention and security	Legitimate interests
Improving our platform (anonymised analytics)	Legitimate interests
Complying with legal obligations	Legal obligation

4. Data Sharing

We do not sell your personal data. We share data only with:

• Hosting providers (Hostinger) — for server infrastructure, within the EU/UK
• Payment processors (Stripe, PayPal, Razorpay) — for billing only
• Email service providers — for transactional emails only
• Analytics providers — anonymised, aggregated usage data only
• Law enforcement / regulators — if required by applicable law

All third-party providers are bound by data processing agreements that comply with GDPR and equivalent regulations.

5. Data Retention

• Active accounts: data retained for the duration of your subscription
• After cancellation: 90 days data retention period, then deletion
• Financial records: retained for 7 years for legal/tax compliance
• Log data: retained for 90 days, then automatically purged
• Marketing consent records: retained until you withdraw consent

6. Your Rights

Depending on your location, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — delete your account and data
• Portability — export your data in CSV/JSON format at any time via Settings → Export
• Restriction — limit how we process your data in certain circumstances
• Object — object to processing based on legitimate interests
• Withdraw consent — for marketing emails at any time via unsubscribe link

To exercise any right, email privacy@smartlyserve.com. We respond within 30 days.

7. Security

• All data in transit encrypted with TLS 1.2+
• Passwords hashed using bcrypt
• JWT tokens with expiry for authentication
• Multi-tenant architecture — each bakery's data is fully isolated
• Regular security reviews and dependency updates
• Hostinger infrastructure with DDoS protection

8. Cookies

We use essential cookies for authentication and session management. See our Cookie Policy for full details.

9. International Transfers

SmartlyServe is hosted in the EU. If you access from outside the EU (UK, US, Australia, New Zealand, Canada), your data may be transferred internationally. We ensure appropriate safeguards including Standard Contractual Clauses where required.

10. Children's Privacy

SmartlyServe is a business platform not directed at individuals under 18. We do not knowingly collect data from minors. Contact us immediately if you believe a minor has provided us data.

11. Changes to This Policy

We'll notify you of material changes by email and by displaying a notice in the app at least 30 days before changes take effect. Continued use after changes constitutes acceptance.

12. Contact & Complaints

Email: privacy@smartlyserve.com
UK users: you have the right to complain to the ICO.
EU users: contact your local Data Protection Authority.