Privacy policy.

01. Who we are

Lenzini’s is responsible for the personal information described in this policy. References to “we”, “us” and “our” mean Lenzini’s.

Lenzini’s POS is a venue-management app for authorised staff. Our related web menu lets customers place orders and manage their accounts. This policy also covers messages sent through this support website.

For privacy questions or requests, email support@lenzini.co.uk.

02. Information we handle

• Staff and venue operations. Staff names and identifiers, PIN-verification information, staff attribution on orders, device names and roles, and operational records such as sales, tabs, deposits, refunds, stock and wastage. Staff PINs are verified through the backend and stored there in hashed form.
• Customer accounts. If you create a web-menu account, your name, email address, account identifier, authentication information and associated rewards. Email/password authentication is managed by our authentication provider. Apple or Google sign-in may provide account information you choose to share.
• Orders and transactions. Ordered items, quantities and choices, table number, guest name where provided, order time and status, discounts, rewards, totals, payment method and payment references. Orders may be linked to your customer account when you are signed in. Named bar tabs can also contain the name given to staff.
• Device and technical information. An app-generated installation identifier, device model, assigned device name and role, last-seen information and a push-notification token where available. Hosting and service providers may process IP addresses and technical logs needed to operate and protect their services.
• Information you choose to provide. Venue coordinates selected by staff, recipe images chosen by staff, and the name, email, topic and message you send to support. Please do not include passwords, staff PINs, full card details or other sensitive information in support messages.

Not all of these categories apply to every person. A customer browsing the menu does not provide the same information as a staff member using the POS app.

03. Why we use it

We use information to fulfil orders, record payments and refunds, manage tabs and rewards, run venue operations, verify staff access, send relevant operational notifications and account or reward emails, respond to support requests, and prevent misuse.

Where UK data-protection law applies, our legal bases include performing a contract (such as fulfilling an order or providing an account), legitimate interests (such as running and securing the venue and responding to enquiries), and legal obligations (such as keeping required financial records). Where consent is required, including for optional marketing, we will seek it separately and you can withdraw it.

Optional permissions do not give us permission to use your information for unrelated purposes. The POS app and these support pages do not include third-party advertising trackers.

04. Device permissions

• Camera: used in the POS app to scan discount QR codes when that feature is opened.
• Photos: used when staff choose an image for a recipe. A selected recipe image may be stored with venue recipe data.
• Location: used if a staff member chooses “Use Current Location” to set the venue’s location. This is not continuous location tracking. The customer web menu does not request the customer’s device location.
• Notifications: used for operational alerts, including stock, expiry, waiting-order and waiter-request alerts. A device token is used to deliver remote notifications.

You can manage permissions in your device settings. Declining or withdrawing a permission may prevent the related feature from working, but does not require you to allow unrelated access.

05. Service providers

We use service providers to operate the app and website. Relevant providers include:

• Supabase: database, authentication and server-side functions for operational and account data. Supabase privacy information.
• Stripe: hosted online checkout and payment processing. In-person card transactions are handled by the venue’s payment terminal provider. Our clients do not collect full card numbers or card security codes. Stripe privacy information.
• Resend: delivery of support enquiries and customer emails. For this contact form it processes the name, email address and message you submit, so we can receive and respond to your enquiry. Resend privacy information.
• Cloudflare: hosting and security when these pages are deployed on Cloudflare Pages, which can involve processing IP addresses and request information. Cloudflare privacy information.
• Apple and Google: platform features and, where chosen in the web menu, sign-in. Apple also provides push notifications and mapping services.
• Open-Meteo: weather information based on venue coordinates, rather than the customer’s current location.

Information may also be disclosed when required by law or to protect the security and legal rights of Lenzini’s and its users. Providers operate under their own terms and privacy notices. Information may be processed outside the UK; applicable data-protection requirements and safeguards apply to international transfers.

06. Storage and security

The app stores some device settings and operational data locally. The customer web menu uses browser storage for sign-in sessions, cart or order context and recent order information. Clearing that storage may sign you out or remove locally saved information.

These support pages do not set advertising or analytics cookies and do not store your contact message in browser storage. The form sends your message over HTTPS to a server-side service for email delivery. Short-lived anti-abuse records use hashed identifiers rather than storing your message in the contact-form database. Hosting providers may use their own security mechanisms.

We use measures such as encrypted network connections, backend access controls and staff verification to protect information. No storage or transmission system is completely secure. Only share information relevant to your enquiry.

07. How long we keep it

We keep information for as long as needed for the purpose it was collected, including account services, operational records, resolving enquiries and complying with legal, accounting or tax requirements. Different types of information may need different retention periods.

Support correspondence may be kept while resolving your enquiry and for relevant follow-up or record keeping. Contact-form anti-abuse records are automatically cleaned up during subsequent form activity after their short retention window. Provider delivery and security logs are subject to each provider’s retention arrangements.

Sales and transaction records may need to remain after an account is deleted. Backups and records subject to a legal retention requirement may not be removed immediately.

08. Your rights and account deletion

Depending on the circumstances and applicable law, you may have rights to access your information, correct inaccurate information, request deletion, restrict or object to processing, receive certain information in a portable format, and withdraw consent where processing relies on consent.

Customer web-menu accounts: open Account and choose “Delete Account” to request deletion through the menu. This removes the authentication account, profile and saved reward assignments and unlinks past orders from the customer account. Venue transaction records may still be retained, including information needed for legal or accounting purposes.

Staff or other information: contact support@lenzini.co.uk with your request. We may need to verify your identity before acting, and some requests may be limited by legal obligations or the rights of others.

If you have concerns, please contact us so we can try to resolve them. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk, or your local data-protection authority where applicable.

09. Children

The POS app is intended for authorised venue staff, not as a service for children. Customer ordering services are subject to venue rules and applicable age restrictions. If you believe a child has provided personal information inappropriately, contact us so we can investigate.

10. Changes and contact

We may update this policy when our services or data practices change. The date at the top indicates the latest update. Where required, we will provide additional notice of significant changes.

For support or privacy enquiries, contact Lenzini’s at support@lenzini.co.uk.