Privacy policy
How KitchenPass handles personal data, written for the owners and staff who use it. Last updated 15 October 2026.
Who we are
KitchenPass is run by Starkey Digital Ltd, 108 Queens Road, Chester CH1 3BF, registered in England and Wales with company number 13439989. We are registered with the Information Commissioner’s Office under number ZC139476.
For anything in this policy, email support@kitchenpass.co.uk.
Our role, and the business’s role
A food business that uses KitchenPass decides what checks its staff do and keeps the records as part of its food safety management. For those records, the business is the controller and we process them on its behalf, as set out in our terms. For account details and the running of the service itself, we are the controller.
What we collect
- Names and email addresses of owners and staff, and which businesses they belong to and in what role.
- Check records: temperature readings, checklist ticks, tasks handed off and signed off, with who did each one and when.
- Photos taken in the app as proof that a job was done, and a profile photo if you add one. Staff should photograph the equipment, not people.
- Setup answers from a new owner: how many sites and staff, what matters most, and how far along their Safer Food, Better Business pack is. An AI assistant you connect can read them to help set up your checks.
- Rota and hours: shifts, when each person clocked in and out, and requests for time off. The reason given for time off is shown only to the business’s owners and managers.
- Employment details a business chooses to keep on its staff: job title, pay rate, contract type and hours, start date, training confirmed, and photos of certificates such as a food hygiene certificate. Pay and contract details are shown only to the business’s owners and managers and to the person themselves.
- Personal details a business chooses to add for a member of staff: date of birth, National Insurance number, home address and personal email. These are encrypted before they are stored, are never copied to other staff members’ phones, and can be opened only by that business’s owners and managers and by the person themselves. They are not shared with AI assistants you connect.
- Incidents a business records, such as accidents, complaints and near misses, including who was involved.
- Daily quiz answers and scores for the food safety quiz.
- Food costs: dishes, their ingredients, costs and prices, shown only to owners and managers.
- Push notification tokens, which let us send a notification to a particular phone.
- Sign-in details from Apple or Google if you sign in with them: an account identifier, and the name and email address you choose to share.
- Crash and performance reports from the app and our servers, collected with Sentry: what went wrong, how long it took, the app version, the type of phone, and your account ID so we can find the fault. They don’t include your name, email address or records.
We do not collect location data, contacts, or anything from the rest of your phone. KitchenPass is free, so we hold no payment details. This website sets no cookies and uses no analytics.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Run your account and the app, and keep each business’s records | Contract, and the business’s legitimate interest in keeping food safety records |
| Keep a business’s rota, hours, time off and staff records, including personal details | The business’s obligations as an employer, and its legitimate interest in running its staff |
| Send a notification when a job is handed to you or one you handed off is finished, and when a check is due (to whoever is clocked in, or to owners and managers if nobody is). If a notification can’t be delivered, a handed-off job is sent by email instead. | Contract. You can turn notifications off in your phone’s settings. |
| Keep the service secure and find faults, including from crash reports | Legitimate interests |
| Answer support emails | Legitimate interests |
We do not sell personal data, use it for advertising, or use it to train AI models.
Who processes it for us
We run the app, its database and this website on servers we manage in the UK and EU. Crash reports go to our own copy of Sentry on those servers, not to Sentry the company. These companies process data for us:
| Who | What for | Where |
|---|---|---|
| Wasabi Technologies | Storing photos | EU |
| Apple | Sign in with Apple, and notifications to iPhones | Worldwide, mainly the US |
| Sign in with Google, and notifications to Android phones | Worldwide, mainly the US |
Where Apple and Google process data outside the UK, the transfer is covered by the UK Extension to the EU-US Data Privacy Framework, or by standard contractual clauses with the UK Addendum.
AI assistants you connect
If you connect Claude, ChatGPT or another assistant, the assistant receives whatever KitchenPass data it asks for on your behalf, such as today’s checks. That provider is not our processor: you choose to use it under your own agreement with them, and their privacy policy applies to your chats.
How long we keep it
- Check records, photos and incidents: for as long as the business uses KitchenPass, so it can show an inspector its history. They are deleted when the business is closed.
- Rota, hours, time off and staff records, including personal details: for as long as the business uses KitchenPass, or sooner if the business removes them.
- Push tokens: until you sign out of the app on that phone or delete your account.
- Account details: until you delete your account, when they are removed straight away.
- Crash and performance reports: 90 days.
- Backups: overwritten within 90 days, so deleted data is gone from them by then.
See how to delete your account and what a business keeps afterwards.
Keeping it safe
Data is encrypted in transit. Passwords are stored only as salted hashes. Each business can only see its own records, enforced in the database itself, and staff only see what their role allows. Staff personal details (date of birth, National Insurance number, home address and personal email) are also encrypted at rest with a key kept apart from the database. The database is backed up daily, and only we can reach the servers.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data
- correct it if it is wrong
- delete it
- limit how we use it, or object to how we use it
- give it to you, or someone else, in a format a computer can read
Email support@kitchenpass.co.uk. We reply within one month. If your request is about records a business keeps, we may pass it to that business, since it decides what happens to them.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.
Children
KitchenPass is a workplace tool for people aged 16 and over. It is not meant for children, and we do not knowingly collect their data.
Changes to this policy
If we change this policy in a way that matters, we will tell business owners by email and show a notice in the app before the change takes effect.