Platform Privacy Policy

This policy explains how BakeCheck handles personal data in connection with the member platform — the admin dashboard used by bakeries and their staff. It covers both the account data we control and the Shopper data we process on your behalf.

This is the privacy policy for Members (bakery businesses using the platform). Members of the public ordering from a bakery's storefront should read that shop's own consumer privacy notice, linked in the storefront footer.

This policy is written to reflect the UK GDPR and the Data Protection Act 2018.

1. Who is the controller

The Platform is operated by BakeCheck, a business based in the United Kingdom. BakeCheck is a trading name and the business is not currently incorporated. We have not appointed a Data Protection Officer, as we are not required to. Data protection questions and rights requests go to support@bakecheck.com.

• For your account and platform-management data (see §2), BakeCheck is the controller.
• For your Shoppers' personal data (names, contact details, and orders placed through your storefront), you (the Member) are the controller and BakeCheck is your processor — see §4.

2. Account data we collect and why

When you use the member platform we process:

• Account identity — your email address, your name, and a securely hashed password. We never store your password in plain text.
• Workspace content — the ingredients, recipes, products, and label records you create, including the audit trail of label actions (which records the acting user's email against each generate, approve, or export event).
• Authentication data — a secure, HTTP-only session cookie, and one-time invite and password-reset tokens (stored only as hashes).
• Technical security data — our web server records standard access logs (IP address, timestamp, requested URL, browser user-agent), and we count sign-in attempts per IP address and per email address in memory to throttle brute-force attacks. This is used only to keep the Platform secure.

We use this data to provide the Platform, authenticate you, maintain the label audit trail that food-labelling good practice requires, and communicate with you about the service.

• Analytics — only if you accept the cookie banner, we use Google Analytics 4 to count visits and see which pages of the member platform and marketing site are used. It records a randomly generated device identifier, the pages you view, approximate location derived from a truncated IP address, and your browser and device type. We do not enable Google's advertising or ad-personalisation features, and we do not use it to build a profile of you or a device fingerprint. If you decline, no analytics cookies are set and no data is sent — see §9.

We use no analytics on a bakery's storefront. Google Analytics runs only on the member platform and our own marketing pages. It is switched off entirely on bakecheck.com/shop/… and on bakery custom domains, so a Shopper browsing your shop is never measured by us.

We do not use advertising or cross-site tracking. Apart from the optional analytics above, the only cookies we set are those strictly necessary to keep you signed in.

3. Lawful bases

We rely on:

• Performance of a contract — to provide the Platform under the Membership Terms.
• Legitimate interests — to keep the Platform secure, prevent misuse and abuse, maintain the label audit trail that food-labelling good practice expects, and answer your support requests. We have considered these against your interests: the data used is limited to account identity and the record of actions taken in your own workspace, it is not combined with anything else or used to profile you, and you can object at any time using the contact details in §11.
• Consent — for analytics cookies and the data they collect (§2, §9). We ask before anything is set, you can decline without losing any part of the service, and you can withdraw at any time from the link at the foot of this page — withdrawal takes effect immediately and deletes the analytics cookies already on your device.
• Legal obligation — where we must retain or disclose data to comply with the law.

4. Shopper data: our role as your processor

When your Shoppers place orders, the Platform processes their personal data — typically name, email, phone number, delivery/collection address, and order history — on your instructions and only to provide the Platform to you. In respect of this data:

• You are the controller and BakeCheck is the processor.
• We process Shopper data only to operate your storefront, take and manage orders, and send the transactional emails you enable (order confirmations, acceptance, and collection reminders).
• We apply appropriate technical and organisational security measures, including tenant isolation, encryption of stored SMTP credentials, and hashed passwords and tokens.
• On termination we make your data available for export and then delete it (see §7).
• We do not use Shopper data for our own purposes and will not process it outside your documented instructions.

Sub-processors

We will give you reasonable notice before adding or replacing a sub-processor that handles Shopper data. See §6 for what the locations above mean for international transfers.

This section is intended to serve as the data-processing terms required by Article 28 UK GDPR between you (controller) and us (processor).

5. Email

Platform emails (such as user invitations and email verification) are sent over SMTP through Namecheap Private Email. Order-related emails to your Shoppers are sent using the SMTP settings you configure for your own Workspace — where you do that, the provider you choose is your sub-processor, not ours. Stored SMTP credentials are encrypted at rest.

6. International transfers

Some of the sub-processors listed in §4 store or access personal data outside the UK. At present the Platform is hosted in the United States, so account data and the Shopper data we process on your behalf are stored there; our email and AI sub-processors are US-based too. Where you consent to analytics, Google may also process that data in the United States. We may change hosting region or add a second region for resilience, and we will update the table in §4 and this section when we do.

Transfers outside the UK are covered by the transfer terms each provider offers — the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified — together with the technical measures described in §4.

7. Retention

We keep data for no longer than we need it:

Backups follow the same schedule and are overwritten in the normal cycle, so a record deleted from the live database may persist in a backup for a short period afterwards.

8. Your rights

Under UK data protection law you have rights to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. To exercise these rights in respect of your account data, contact us using the details below. Where the request concerns Shopper data, the Shopper should contact the relevant bakery (the controller), and we will assist that bakery as its processor. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We set two kinds of cookie:

Strictly necessary cookies are set without consent, as the law allows, because the Platform cannot sign you in without them.

Analytics cookies are opt-in. Nothing is loaded from Google and no cookie is set until you press Accept on the banner. Declining is a single press of Reject, given the same prominence as Accept, and costs you nothing — every part of the Platform works either way. Simply dismissing or ignoring the banner is not treated as consent.

Withdrawing consent is as easy as giving it: use Change your cookie choice at the foot of this page. Choosing Reject there stops collection immediately and deletes the analytics cookies already on your device. You can also clear them in your browser, or use Google's own opt-out add-on.

Analytics runs on the member platform and our marketing pages only. It is switched off on every bakery storefront, so it never runs on bakecheck.com/shop/… or on a bakery's own domain.

Note that a bakery's own storefront may embed a Google Maps panel on its contact page if that bakery has entered an address; that embed is covered by the storefront's own consumer privacy notice, not this policy.

10. Affiliate links

Some of our public articles at /learn recommend products — label printers, label rolls — and link to Amazon.co.uk using an Amazon Associates tag (bakecheck-21). If you buy something after following one of those links, we may earn a commission from Amazon at no additional cost to you. We link only to products we use ourselves, and a commission never influences what we recommend. Every article containing such links says so, visibly, above the article.

What this means for your data:

• We do not receive any personal data about you from Amazon. Amazon reports commissions to us in aggregate — numbers of clicks and orders — never the identity of the person who bought, what else was in their basket, or their address.
• We do not set any cookie of our own on these links. Following one is an ordinary link click. There is no tracking script, no redirect through a third party, and nothing is recorded on our side beyond the anonymous page analytics described in §9, which only run at all if you have accepted them.
• Amazon sets its own cookies once you arrive on Amazon's site, to attribute the referral. That happens on Amazon's domain, under Amazon's control, and is governed by Amazon's privacy notice — not by this policy. Nothing about that is set in motion until you choose to click.
• Affiliate links are marked rel="sponsored" in the page's HTML, as search engines require of paid links.

If you would rather not use the link, searching for the product by name on Amazon reaches exactly the same page without any attribution to us.

11. Changes and contact

We may update this policy; the current version and effective date are shown at the top of this page. Questions or requests — including to exercise any of the rights in §8 — can be sent to support@bakecheck.com. If you are not satisfied with our response you can complain to the Information Commissioner's Office at ico.org.uk.