Privacy Policy

Effective Date: 15 October 2026

Did you tap a QR code or NFC stand at a cafe, restaurant or pub? Read the short version for customers, available in 16 languages. This page is the full policy.

Who We Are

Candour is operated by Sullivan Applications Ltd, a company registered in England and Wales under company number 11142684, with its registered office at Anglo Dal House 5 Spring Villa Park, Spring Villa Road, Edgware, Middlesex, HA8 7EB, United Kingdom. When this policy refers to "we", "our", or "us", it means Sullivan Applications Ltd.

Candour is a platform that gives restaurants, cafes, pubs, and other food businesses a single QR code linking their customers to a digital menu, Wi-Fi, loyalty stamp cards, and a feedback form - with no app download required for your customers.

This policy explains what data we collect, why we collect it, and how we handle it. We keep it in plain English.

The Two Types of People Who Use Candour

Candour has two distinct groups of users, and we treat their data differently:

• Business owners - restaurants, cafes, pubs, and similar businesses that create a Candour account to manage their profile.
• Customers - members of the public who tap a QR code or NFC stand at a venue. No account or app download is needed.

Data We Collect From Business Owners

Account Information

When you create a Candour account, you sign in with your email address and a password. Some older accounts sign in with Apple instead - for those, we receive your Apple user ID and, if you chose to share it, your email address. While you are setting up, the app may give you a temporary anonymous sign-in so your progress is saved. We also ask you to provide your business name and address to set up your profile.

Enquiries, Demo Requests and Sign-ups

If you request a demo, fill in an enquiry form on candour.app, join the Android waitlist or sign up for Candour, we keep your email address and anything else you give us (such as your name, business name and phone number), your language setting, and where your request came from (for example, which page or ad). We use this so we can reply to you.

Scanner App for Staff Devices

If you use the loyalty stamp card feature, you can install the Candour Scanner app on a staff device - for example, an Android phone or tablet kept at the counter - to stamp customers' loyalty cards. There are two ways to set a device up:

• Sign in - an owner or manager signs in with their Candour account email and password to authorise the device. We use this once to set the device up. We do not keep staff signed in, and the sign-in details are not stored on the device.
• Pairing code - alternatively, you generate a short, single-use code in your dashboard and enter it on the device. No staff login is needed.

Once a device is set up, we issue it a unique device token - a random identifier that authorises that specific device to stamp cards for your business. We store this token, in hashed form, so we can recognise the device and revoke it if needed. The token is tied to the device rather than to any individual member of staff, and it contains no personal information. You can remove a device at any time from your dashboard, which immediately revokes its token.

The scanner reads your customers' loyalty QR codes in order to add stamps. It does not collect any new information about those customers.

Menu Data

If you use the digital menu feature, you can upload photos of your menu or enter menu items manually. These files are stored securely in Google Firebase Storage. If you use our AI menu reader, images or text are sent to Anthropic's API to extract menu items automatically. We do not use your menu data to train AI models.

Wi-Fi Credentials

If you use the Wi-Fi feature, your Wi-Fi network name (SSID) and password are stored in our database so they can be shared with customers who tap your QR code. This data is encrypted at rest.

Loyalty and Customer Analytics

If you use the loyalty stamp card feature, your customers join with their name and email address, and we store their stamp counts and card status. You can see your members in your dashboard, along with aggregate analytics (e.g. total stamps issued, cards completed). If you share a loyalty card with another business you own, staff at that business can see each member's name, email address and stamps when the card is shown at their venue. If your business closes, a card you share can pass to another business on it, together with its members. See "Data We Collect From Customers" below for what customers give us and how they can delete it.

Subscription and Billing

There are no in-app purchases in Candour. If you are on a paid plan, we set it on your account ourselves, and we store which plan you are on and when it ends.

If you purchase physical products (QR stands) through the Candour shop, in the app or on the web dashboard, payments are processed by Stripe. Stripe handles all payment data in accordance with their own privacy policy. We receive order confirmation and fulfilment details only.

Feedback Received at Your Venue

Feedback submitted by your customers through your Candour profile is stored in our database and made available to you in your dashboard. See the section below on customer data for what is collected from the person submitting feedback.

Data We Collect From Customers

Customers are people who tap a QR code or NFC stand at a venue. We deliberately collect as little data as possible from this group. A short version of this section is available in 16 languages.

Who is responsible for your data

The venue you visit decides how your details are used and what it sends you, so it is the data controller for your name, email address, birthday, visits and loyalty card. Sullivan Applications Ltd (Candour) processes those details on the venue's behalf, under the terms the venue accepts when it uses Candour. Candour is itself the controller for: counting how the customer web page and App Clip are used; the record that proves you agreed to marketing emails; the list of email addresses that have asked not to hear from any venue using Candour; and the rules that decide when a venue's automatic emails may go out. You can contact the venue or us about your data, and we will help the venue answer you.

What we collect and why

• Feedback - if a customer submits feedback, we store the text and any photo they add. No name, email, or account is needed to leave feedback, and feedback is anonymous unless the customer chooses to add their details. If the venue asks the dashboard assistant about its feedback, the feedback text and the date it was left are sent to Anthropic's AI service to answer the venue's question. Anthropic does not use it to train its models.
• Contact requests - if a customer asks the venue to get back to them about their feedback, they give a name and a phone number, email address or WhatsApp number. The venue sees these alongside the feedback. If they give an email address, it is also added to that venue's customer list with a count of their visits (see below), so the venue can recognise them when they return. No marketing email is sent to that address unless the customer later agrees to it.
• Sentiment check - to decide whether to invite a customer to leave a Google review, we check whether their feedback reads as positive. Whether the feedback is left in the App Clip or on the web page, the text is sent to Google's Cloud Natural Language API, which returns a score. From the App Clip, our servers send the text to Google when the feedback is saved, and the score that comes back is stored with the feedback and decides whether the customer is shown a link to leave a Google review. On the web page, the customer's browser sends the text to Google directly and that score decides whether the link is shown; our servers then send the text to Google again when the feedback is saved, and that second score is the one stored. If Google cannot score the text, we use the score sent with the feedback instead: the App Clip works its score out with Apple's language tools, and the web page treats feedback it could not score as neutral. We do not use feedback text to train AI models.
• Google Reviews redirect - if feedback is positive, the customer may be shown a prompt to leave a Google review. Clicking that link takes them to Google, which is governed by Google's own privacy policy. We do not receive any data from Google about whether they completed a review.
• Loyalty cards - to join a venue's loyalty scheme, a customer gives their name and email address. We use these to issue their card as an Apple Wallet or Google Wallet pass, email it to them, and keep their stamps up to date. Their name appears on the pass. A loyalty card can be shared by several businesses that have the same owner. The card then works at every venue of those businesses, the pass lists them, and staff at each of them can see the member's name, email address and stamps when the card is shown. The business that created the card is responsible for it. If a business on a shared card closes, the card keeps working at the others, and if the business that created it closes, the card can pass to another business on it.
• Wi-Fi - some venues ask for an email address, and optionally a first name, before showing their Wi-Fi details. That email address goes on the venue's customer list with a count of visits (see below).
• Venue customer lists - email addresses given at a venue (to join its loyalty scheme, to get its Wi-Fi, or with feedback) go on that venue's customer list, with the customer's first name if they gave one and a count of their visits. The venue can see this list in its dashboard. For this list, the venue decides how the details are used, and we hold them on the venue's behalf. Sharing a loyalty card does not share this list: agreement to marketing emails is given to one venue and is never passed to another.
• Marketing emails - a venue can only send marketing emails to customers who ticked the box agreeing to them and then confirmed by clicking the link in the email we send. Customers who have agreed may also choose to give their birthday (day and month only, never the year) for a birthday treat. Every marketing email has an unsubscribe link, and a customer can stop offers from one venue or from every venue using Candour. When a customer ticks the box, we keep a record of what they agreed to and when, with a scrambled (hashed) copy of their IP address as proof.
• Offers that suit the customer - if a venue switches on automatic emails, we use a customer's visit count, the date of their last visit and their birthday month to decide which emails they get, for example a "we miss you" offer after a gap, or a birthday treat. These emails only go to customers who agreed to marketing emails. None of these choices has a legal or similarly significant effect on anyone.
• Do-not-email list - if a customer chooses to stop offers from every venue using Candour, or an email to them bounces or is marked as spam, we add a scrambled (hashed) copy of their email address to a list we check before every marketing email, so they are not emailed again by any venue.
• Device and language - when a customer joins a loyalty card in the App Clip, the App Clip sends an identifier that Apple gives our app on that iPhone (the identifier for vendor), so we can recognise the card on that phone without asking the customer to sign in again. We also keep the language the customer's phone or browser uses, so emails reach them in that language.
• Do customers have to give their details? - no. Feedback, the menu and the Wi-Fi at most venues need no details at all. An email address is needed only for a loyalty card, for the Wi-Fi at venues that ask for one, for a reply to feedback, or for offers by email. Without it, the customer simply does not get that one thing.
• Lawful basis - we rely on:
  • the customer's consent for marketing emails;
  • providing the service they asked for (a loyalty card, Wi-Fi access, or a reply to their feedback) for the details needed to provide it;
  • legitimate interests for the rest: the venue's and our interest in recognising returning customers (adding an email given with feedback or for Wi-Fi to the venue's customer list, with a visit count) and in choosing which agreed marketing emails suit a customer; our interest in being able to prove that a customer agreed to marketing emails (the hashed IP address and consent record); our interest in honouring every request not to be emailed (the do-not-email list); our interest in showing a Google review link only to customers who seem happy (the sentiment check); and our interest in understanding how the page and App Clip are used (analytics).
  A customer can object to any use based on legitimate interests (see "Your Rights").
• Analytics, no advertising - the Candour web page and App Clip that open when a customer taps a QR code use Google Analytics for Firebase to count how they are used (for example, which features are tapped). On the web page, this sends anonymous usage information to Google Analytics without setting cookies. Firebase also keeps an anonymous app installation ID in the browser's storage, and the web page stores a few small settings on the device - for example, whether the customer has already given their email at that venue, so they are not asked again. We do not serve ads to customers or sell their data.

How We Use Your Data

• To create and manage your Candour account and business profile
• To provide the features you have enabled (menu, Wi-Fi, loyalty, feedback, customer list)
• To send customers their loyalty pass, and the marketing emails they agreed to receive from a venue
• To process and confirm your subscription or shop orders
• To provide you with feedback and loyalty analytics in your dashboard
• To improve the reliability and quality of our service
• To contact you about your account or service updates
• To send you one personal email from our founder after you get in touch or sign up, and to reply if you answer it. We don't add you to a marketing list. If you'd rather not hear from us, reply and say so, or email contact@candour.app, and we won't email you again.
• If you reply to our founder email, your message is processed by an AI service (Anthropic) to draft a response. A person reads and edits every draft, and a person sends every reply - nothing is sent automatically. We only do this for messages from people who contacted us or whom we have emailed, and we do it on the basis of our legitimate interest in answering you, the same as for the founder email itself.

We do not sell your data. We do not use your data for advertising.

Third-Party Services We Use

Candour is built on a number of third-party services. Here is what each one does and why we use it:

• Google Firebase - our database (Firestore), file storage, sign-in (Firebase Authentication), and backend infrastructure. Your data is stored on Google Cloud servers, primarily in the EU. Firebase is operated by Google LLC.
• Google Analytics for Firebase and Firebase Crashlytics - usage analytics for the Candour app, App Clip, web dashboard and customer web pages, and crash reports from the Candour app. On candour.app's home page, analytics cookies are only set if you accept cookies.
• Google Cloud - the Cloud Natural Language API checks the sentiment of feedback left in the App Clip or on the web page, and the Cloud Vision API checks images uploaded to demo pages for inappropriate content.
• Google Wallet - loyalty cards added to Google Wallet are created through Google's Wallet API, including the customer's name shown on the card.
• Anthropic - we use Anthropic's AI API to parse menu content, to answer your questions about your feedback in the dashboard assistant (which sends it your customers' feedback text and the date each was left), to help build demo pages, and to draft our replies when you answer our founder email (a person reviews and sends every reply). Text or images are sent to Anthropic's servers for processing. Anthropic does not retain this data for model training.
• ScrapeCreators - when someone builds a demo page from an Instagram account, we fetch that account's public profile and recent posts through ScrapeCreators.
• Apple - some older accounts sign in with Apple. Apple Wallet passes for loyalty cards are delivered and updated via Apple's infrastructure.
• Stripe - payment processing for physical product orders placed through the Candour shop.
• Sentry - error reports from candour.app and the web dashboard, so we can fix bugs. Reports contain technical details about the error, such as the page and browser.
• Microsoft Clarity - if you accept cookies on candour.app's home page, Clarity records how the page is used (for example, clicks and scrolling).
• Resend - our email delivery provider. We use Resend to send emails from candour.app. It processes the recipient's email address and the content of the email in order to deliver it.
• Google - positive feedback may prompt customers to leave a review on Google. We link to Google Reviews but do not exchange personal data with Google in this flow.

International Data Transfers

Some of the providers we use process data outside the UK. Here is where, and the safeguard we rely on for each:

• Google Cloud and Firebase (database and file storage) - our database (Firestore) is stored in the European Union, which the UK recognises as giving adequate protection to personal data. Google may process your data in the US. Those transfers are covered by the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge), under which Google LLC is certified, with the ICO UK Addendum to the EU standard contractual clauses as a fallback.
• Google Cloud Natural Language - feedback text sent for the sentiment check may be processed in the United States by Google LLC, covered by the same UK-US Data Bridge certification, with the UK Addendum as a fallback, as above.
• Google Wallet - a customer's name and loyalty card details sent to Google Wallet may be processed in the United States by Google LLC, covered by the same UK-US Data Bridge certification, with the UK Addendum as a fallback, as above.
• Google Analytics for Firebase - usage data from the app, App Clip and web pages may be processed in the United States by Google LLC, covered by the same UK-US Data Bridge certification, with the UK Addendum as a fallback, as above.
• Firebase Crashlytics - crash reports from the Candour app may be processed in the United States by Google LLC, covered by the same UK-US Data Bridge certification, with the UK Addendum as a fallback, as above.
• Resend - the recipient's email address and the email's content are processed when we send an email. Resend (Plus Five Five, Inc.) processes email data in the US under the EU standard contractual clauses with the ICO UK Addendum, and is also certified to the UK Extension to the EU-US Data Privacy Framework.
• Apple - Apple Wallet pass updates and Sign in with Apple are handled by Apple. For Sign in with Apple and Apple Wallet, Apple acts as an independent controller. For UK users that is Apple Distribution International Ltd in Ireland, and Apple transfers data outside the UK under standard contractual clauses.
• Anthropic - menu content, dashboard questions with the customer feedback text and dates they include, demo page content and replies to our founder email are processed by Anthropic. Feedback text sent to the dashboard assistant is processed by Anthropic Ireland, Limited and may be processed in the US under the EU standard contractual clauses with the ICO UK Addendum. The same terms cover the other content listed here.
• Stripe, Sentry, Microsoft Clarity and ScrapeCreators - these providers are used for business owners and visitors to candour.app rather than venue customers. Stripe, Sentry and Microsoft (Clarity) are certified to the UK Extension to the EU-US Data Privacy Framework, which covers transfers to them in the US, and their terms also provide standard contractual clauses as a fallback. ScrapeCreators (Web Scraping Guy LLC, US) receives only the Instagram handle a person types when building a demo page and returns that account's public profile; it does not receive names, emails or feedback.

You can ask us at contact@candour.app for a copy of the safeguard that applies.

Data Retention

We keep your business account data for as long as your account is active. If you close your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or financial compliance purposes.

If you get in touch but don't create an account, we keep your enquiry details for up to 24 months and then delete them. If you ask us not to contact you, we keep only a one-way scrambled copy of your email address (a hash) so we can make sure we don't contact you again.

If you sign up for Candour and later delete your account, we delete the details we noted about your sign-up. If we had already sent you our one founder email, we keep only a one-way scrambled copy of your email address and the fact that the email was sent, so we never send it to you twice.

If you reply to our founder email, we keep a short excerpt of each message in the conversation for up to 90 days, so we have the context to reply, and then delete it automatically.

Feedback and loyalty cards are kept for as long as the venue's account is active, so it can access its history, and are deleted when the venue closes its account. A customer can delete their loyalty card and their details at any time from the link in the email that comes with their loyalty pass, or by asking the venue or us. We then remove their name, email address, birthday and language, and the hashed copy of their IP address. Their past visits and the emails sent to them stay in the venue's records with nothing linking them to the person, so the venue's totals stay correct. A minimal record of when they agreed to, confirmed and withdrew their consent to marketing emails, with no email or IP address, is kept for 30 days so the venue can show it stopped emailing them, and is then deleted.

For venue customers, including those who only gave an email address for Wi-Fi or with feedback:

• Details stay on a venue's customer list until the customer deletes them, the venue removes them, or the venue closes its account.
• If a customer has had no visit, stamp, voucher, email or change to their consent for 24 months, we anonymise their details: we remove their name, email address, birthday and language, and reset their visit and stamp counts to zero.
• If a customer ticks the box for marketing emails but does not confirm within 14 days of the last confirmation email we sent them, the unconfirmed agreement lapses. If they hold no loyalty card and no open reward at that venue, we then delete their whole record at that venue; if they do, we keep their card and remove only the unconfirmed agreement and its hashed IP address.
• The record that a customer agreed to marketing emails, with the hashed copy of their IP address, is kept while they stay on the list, including after they unsubscribe. When their details are deleted or anonymised, the hashed IP address is removed straight away. A minimal record of when they agreed, confirmed and withdrew, and which wording they saw, with no email or IP address, is kept for 30 days so the venue can show it did not email them after they withdrew, and is then deleted.
• The do-not-email list (a hashed copy of an email address that asked not to hear from any venue) is kept permanently, because its purpose is to make sure that address is never emailed again.

If you disable the Wi-Fi feature, your stored Wi-Fi credentials (network name and password) are deleted from our systems immediately. If your account is closed, any stored Wi-Fi credentials are deleted as part of the standard account deletion process.

Your Rights

Whether you run a business on Candour or you are a customer of one, you have the following rights under UK GDPR:

• Access - you can request a copy of the data we hold about you.
• Correction - you can ask us to correct inaccurate data.
• Deletion - you can ask us to delete your account or your details, and associated data.
• Portability - you can request your data in a portable format.
• Restriction - you can ask us to limit how we use your data, for example while you check that it is accurate.
• Objection - you can object to any use of your data based on legitimate interests, and to marketing at any time.
• Withdraw consent - where we rely on your consent, such as for marketing emails, you can withdraw it at any time, for example with the unsubscribe link in every marketing email. Withdrawing does not affect anything sent before you did.
• Complain - you can complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would welcome the chance to sort out your concern first.

To exercise any of these rights, contact us at the email address below. If you are a customer of a venue, you can also ask the venue. We will respond within one month.

Data Security

We take reasonable steps to protect your data, including encryption at rest, secure HTTPS connections, and access controls on our backend systems. No system is completely immune to risk, and we cannot guarantee absolute security, but we take this responsibility seriously.

Children

Candour business accounts are not intended for anyone under the age of 18. Customers must confirm they are 13 or over (18 or over at some venues) before agreeing to marketing emails. We do not knowingly collect data from children under 13.

Changes to This Policy

We may update this policy from time to time. If we make significant changes, we will notify business account holders by email. The effective date at the top of this page will always reflect the most recent version.

Contact Us

If you have any questions about this policy or want to exercise your data rights, please contact us at contact@candour.app.

Sullivan Applications Ltd, registered in England and Wales, company number 11142684. Registered office: Anglo Dal House 5 Spring Villa Park, Spring Villa Road, Edgware, Middlesex, HA8 7EB, United Kingdom.