Privacy Policy — Kudosly

🏢 Who We Are

Kudosly is a hospitality staff performance and recognition platform operated by Kudosly Ltd. We provide software that helps venues track team performance, share recognitions, and communicate with their staff.

For the purposes of UK data protection law, Kudosly Ltd is the data controller for data relating to our customers (venue managers and enterprise owners), and a data processor for personal data relating to your employees, which you as the venue operator control.

      📬 Data Protection contact: privacy@kudosly.co.uk

      🌐 Website: kudosly.co.uk

📋 What Data We Collect

Data you give us directly

Account details — name, email address, job role
Venue information — venue name, location, team structure
Performance data — weekly sales figures entered by managers (meals served, upsells, reviews collected, etc.)
Communications — recognition messages, notices, and chat messages sent through the platform
Mood check-ins — anonymous weekly pulse responses submitted by team members
Reviews — customer review text pasted into the platform by managers

Data we collect automatically

Login activity — when you sign in and from which device type
Usage data — which features you use and how often
Technical data — browser type, IP address, time zone

Data we do not collect

We do not collect payment card details (payments handled by third-party processors)
We do not track your location
We do not use advertising trackers or sell your data to advertisers

⚖️ Legal Basis for Processing

Purpose	Legal Basis
Providing the platform and its core features	Contract — necessary to deliver the service you've subscribed to
Employee performance tracking	Legitimate interests — employers have a legitimate interest in monitoring and improving team performance, balanced against employee rights
Sending account and service emails	Contract
Improving the platform	Legitimate interests
Complying with legal obligations	Legal obligation

      Important for employers: If you use Kudosly to track your employees' performance, you must inform your staff that their data is being processed and for what purpose. We recommend including this in your employment contracts or staff handbook.
    

🔗 Who We Share Data With

We only share data with trusted third parties necessary to operate the platform:

Provider	Purpose	Location
Supabase	Database, authentication, file storage, and real-time messaging	EU (London, UK)
Vercel	Web hosting and content delivery	EU servers available; CDN global
Anthropic	AI coaching summaries (manager-only feature, when explicitly triggered)	United States

We do not sell, rent, or share your personal data with any third parties for their own marketing purposes. Ever.

🌍 International Transfers

Our primary database infrastructure is hosted in the EU (London) via Supabase, meaning most data never leaves the UK/EU.

The AI coaching feature sends performance summary data to Anthropic (US) when a manager explicitly triggers it. This transfer is covered by appropriate Standard Contractual Clauses (SCCs) under UK GDPR Article 46. No personally identifiable information beyond first names and anonymised performance scores is included in AI prompts.

🗓️ How Long We Keep Your Data

Data type	Retention period
Account and profile data	For the duration of your subscription, plus 90 days after cancellation
Performance data (weekly entries)	Up to 3 years, or until your subscription ends
Chat messages	12 months rolling, then automatically deleted
Pulse check-ins	12 months rolling
Recognitions and notices	For the duration of your subscription
AI coaching summaries	90 days
Uploaded files (photos, attachments)	12 months, or until manually deleted

🔒 How We Keep Your Data Safe

All data is encrypted in transit (HTTPS/TLS) and at rest
Database access is restricted by Row Level Security (RLS) — each venue can only see its own data
Passwords are never stored — Supabase handles authentication using industry-standard hashing
File uploads are stored in private buckets — not publicly accessible without a valid signed URL
We do not store Anthropic API keys or payment credentials in application code
Access to production systems is limited to authorised personnel only

✅ Your Rights Under UK GDPR

If you are a Kudosly user or an employee at a venue using Kudosly, you have the following rights:

Right of access — you can request a copy of the personal data we hold about you
Right to rectification — you can ask us to correct inaccurate data
Right to erasure — you can ask us to delete your data, subject to legal retention obligations
Right to restrict processing — you can ask us to limit how we use your data
Right to data portability — you can request your data in a machine-readable format
Right to object — you can object to processing based on legitimate interests

To exercise any of these rights, email us at privacy@kudosly.co.uk. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

🍪 Cookies

Kudosly uses a minimal set of cookies:

Authentication cookies — to keep you signed in securely. These are strictly necessary and cannot be disabled.
Session cookies — to remember your preferences during a session. These expire when you close your browser.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

📝 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active users of any significant changes by email or via an in-app notice. The date at the top of this page always reflects the most recent update.

📬 Contact Us

For any privacy-related questions, data subject requests, or concerns:

📧 Email: privacy@kudosly.co.uk
🌐 Website: kudosly.co.uk