Hygivo · Privacy · Cookies · Terms · Support · Delete your account

Privacy

DRAFT — REVIEW REQUIRED. This page describes what the Hygivo app actually does today. It has not yet been reviewed by a solicitor. Items marked [TO CONFIRM] are business or legal facts that must be settled before launch.

Hygivo is a food-safety (HACCP) record-keeping app for hospitality businesses: food deliveries and label scanning, batch and use-by records, fridge and freezer temperatures, cleaning, allergen information, corrective actions, and the records and reports built from them. This page explains what we store, why, who is responsible for it, how long it is kept, and your rights.

Who is responsible

• A business's food-safety records — temperatures, deliveries (including label photos), cleaning, allergen information, corrective actions, and the names of the people who made them. The business that uses Hygivo is the controller: it decides what is recorded and how long it is kept. Hygivo processes these records on the business's behalf, as its processor [TO CONFIRM: data processing agreement offered to each business].
• Your Hygivo account (sign-in, security, notification settings), billing, support, and running Hygivo itself: Hygivo is the controller.

If you work for a business that uses Hygivo, questions about its records are best sent to that business; we will help it answer.

Hygivo is provided by [TO CONFIRM: the legal person providing Hygivo and their address. Hygivo Limited is not yet incorporated — this page must not name it as a company until it is]. We have not appointed a Data Protection Officer [TO CONFIRM whether one is required].

What we store, and why

• Your account — your name, email address and password (held by our authentication provider; Hygivo never sees your password), and which businesses you belong to and in what role. If you sign in with Google or Apple, we receive the name and email address they share. Why: to let you sign in and use Hygivo.
• Business details — business and location names, invite links and codes, equipment and its safe temperature ranges and check times, and the cleaning list. Why: to run the business's checks.
• Food-safety records — temperature readings (with any corrective action or the reason a reading couldn't be taken), deliveries (product, supplier, batch / lot code, date on the label, arrival temperature, accepted or rejected and why), cleaning completions (or why a task couldn't be done), allergen information and who approved it, alerts, and every correction with its reason. Each record keeps who made it, when, and whether it was saved offline and reached Hygivo later. Records are never overwritten: a correction is added, and the original stays. Why: these are the business's HACCP evidence.
• Label photos and scanning — when you photograph a delivery label, Hygivo reads it on your device: the photo is not sent to any reading or AI service. The reading software is downloaded to your device from Hygivo's own web server the first time you scan; no third-party service is involved. In the iPhone and Android apps the same reader runs on the phone, inside the app. When you save, the photo is uploaded to private storage for that business and location, along with the text read from it (so batch codes can be found in a recall search). Photos can only be opened by people at that business who can see that location's records.
• Notifications — alerts sent to owners and managers (out-of-range readings, missed checks), your quiet hours and muted alert types, and, if you turn on phone notifications, a registration for your phone.
• Billing (owners) — subscription status and dates, the number of locations billed, and our payment provider's customer and subscription references. Card details are held by Stripe, never by Hygivo.
• Security and audit records — administrative actions, billing events and join attempts. Why: to keep Hygivo and each business's records secure.
• Error reports — the technical details of an app error and the account it happened in. Why: to find and fix problems.
• Support messages — what you send us and our replies.

Hygivo does not use your location. Hygivo has no advertising, sells no data, and uses no analytics or tracking services — see Cookies.

Legal bases

[TO CONFIRM with a solicitor.] For what Hygivo controls, the proposed bases are: your account, notifications and billing — to provide the service you or your business signed up for (contract); security, audit and error records, and support — our legitimate interest in running a secure, working service; billing records we must keep — legal obligation. For a business's food-safety records, the business decides the basis as controller.

How long we keep it

• Food-safety and delivery records: each business chooses how long (Account › Business name › Record retention), counted from the end of the year a record was made; older records are then removed automatically. Until it chooses, they are kept. The business should check its own legal obligations.
• Label photos: kept with their delivery record. [TO CONFIRM: automatic removal of the photo file when its delivery record reaches the end of its retention period is not yet built.]
• Security and audit records: up to 24 months. Error reports: up to 24 months. Join attempts: 1 day.
• Your account, settings and phone registration: deleted when you delete your account.
• Billing records: as long as accounting law requires [TO CONFIRM with an accountant].

Deleting your account

You can delete your account at any time in the app (Account › Delete my account) or by emailing us — see Delete your account. Your sign-in, settings and phone registration are deleted straight away. Food-safety records you made are the business's HACCP records, so they stay with the business, shown as "Former staff member", for its retention period. They are detached from your account: nothing in them can be used to sign in as you.

Who else processes it

• Supabase — database, authentication, file storage and server functions. [TO CONFIRM: hosting region.]
• Netlify — hosting the web app and these pages; Expo — building the phone apps and hosting test versions; Expo push service, Apple and Google — delivering phone notifications to phones that have them turned on. They see the notification text, not your records.
• Stripe — payments for business owners who subscribe.
• Google and Apple — only if you choose to sign in with them.
• Email for sign-up and password reset [TO CONFIRM: email provider].

Some of these may process data outside the EEA; where they do, we rely on the safeguards they provide, such as the EU Standard Contractual Clauses [TO CONFIRM for each provider]. Each business's data is kept apart from every other business's, enforced by the database itself.

Your rights

Under the GDPR you can ask for a copy of your data, ask for it to be corrected, object to or restrict how it's used, ask for it to be deleted, and ask for a copy you can take elsewhere. For a business's food-safety records, the business is the controller, so we may pass your request to it; a business may need to keep HACCP records, and corrections are added rather than overwriting the original. To ask, email [email protected]. We aim to reply within one month. You can also complain to the Data Protection Commission (dataprotection.ie).

Security

Every request is checked by the database, per business, role and location. Photos are in private storage. Connections are encrypted. No service is perfectly secure: use a strong, unique password.

Children

Hygivo is a workplace tool and isn't intended for children. [TO CONFIRM: minimum age for accounts.]

Changes

If we change how we handle data, we'll update this page, its version and the date above, and tell business owners about significant changes.

Contact

Privacy questions and requests: [email protected].