Privacy
Who we are
Brewed and Baked is run by PREMIERHOSPITALITYGROUP LTD (company number 16783960, registered office 128 City Road, London EC1V 2NX), which is responsible for your information. The ordering app is built and run for us by an independent developer, who uses it only to provide the app, on our behalf.
What we keep
When you order we store the first name you give, your order, which train you chose, and your email if you supplied one for a receipt. We also set one cookie containing a random identifier so your order can be shown back to you. It identifies a browser, not a person. If you turn on alerts, we store the address your browser gives us for those alerts, and delete it when the phone stops accepting them. If you save a usual order, that stays in this browser only until you order or forget it.
Who handles it for us
Your order is stored by Supabase (database, in Ireland), the app runs on Amazon Web Services (in London), and payments go through Square. None of them may use it for anything else. If you save a commute, it stays on your phone and is never sent to us.
Card details
We never see them. Payment is handled entirely by Square, who act as our payment processor. We store only the reference Square gives us for your payment.
Train times
Departure information comes from National Rail. Looking at the board sends nothing about you anywhere — the times are fetched once for the whole station and shared by everyone.
“Get me home” asks for trains between two stations, which says nothing about who you are. “Nearest” uses your location on your phone only; it is never sent to us. If you tap “I’m on this train”, that is kept on your phone. Only if you then ask to be buzzed about it do we store the alert address your phone gives us, the two stations and the trains, to check them every couple of minutes. That is deleted when you get home, or 4 hours after the train left, whichever is first.
If you turn on morning alerts, we store the alert address your phone gives us, your two stations, your usual time and when to start checking, so we can check your train on weekday mornings: that day’s train, so we can tell you if it got in late enough to claim Delay Repay, and which engineering works we’ve already told you about. Nothing else, and no name. When a train does get in late enough to claim for, we keep that journey (the date, the stations and the times) so you can find it again on the Delay Repay page, and delete it 35 days later. It is deleted when you turn them off, or when your phone stops accepting alerts.
How long
Order records are kept for six years because HMRC requires it of business records. Anything not needed for accounts is removed sooner.
Getting your data removed
Email shannonmail2024@gmail.com and we will delete what we are not legally required to keep, and anonymise the rest.