Version 2.0. Effective date: 15 October 2026.
Candour is run by Sullivan Applications Ltd, a company registered in England and Wales ("we", "our", "us"). By creating an account or using the Candour app or any related services, you agree to these Terms of Service, including the Customer Data Processing schedule at the end. Please read them carefully.
If you do not agree, you must not use Candour.
Candour is a platform for restaurants, cafes, pubs, and similar food-serving businesses. It gives businesses a single QR code and NFC link that customers can tap to see a digital menu, get Wi-Fi details, join a loyalty stamp card, and leave feedback, without downloading an app. It also keeps a customer list for each venue and can send emails to those customers on the venue's behalf.
These Terms govern your use of Candour as a business account holder. If you are a customer tapping a QR code at a venue, you are not entering into any contract with us. Your use is covered by our Privacy Policy.
To create a Candour account, you must be at least 18 years old and have the authority to act on behalf of the business you are registering. You sign in with your email address and a password. Some older accounts sign in with Apple instead. You are responsible for keeping your account secure and for all activity that happens under it.
You must give accurate information about your business. We may suspend or close accounts where the information given is inaccurate or misleading.
If you invite other people to your business on Candour, you are responsible for what they do there. Only an owner of the business on Candour can accept these Terms for the business.
There are no in-app purchases in Candour. Some features are free. If you agree a paid plan with us, we set it on your account ourselves. We agree the price and billing period with you before the plan starts, and payment is processed by Stripe.
We may change our prices. We will give you reasonable notice before a price change affects a plan you are already on.
You can upload menu images or enter menu items yourself. You are responsible for making sure your menu is accurate, lawful, and up to date. You must not upload content that is illegal, misleading, or that infringes anyone else's rights. AI-assisted menu reading is a convenience: check and correct its output before you publish it.
If you use the Wi-Fi feature, you are responsible for making sure you have the right to share your Wi-Fi details through Candour. We store them securely, but you are responsible for the consequences of sharing your Wi-Fi password with customers.
You are responsible for the loyalty programme you set up, including the rewards you offer. Candour issues and tracks stamps but does not guarantee or provide any reward on your behalf. Customers who earn stamps or complete a loyalty card do so in a relationship with your business, not with us.
Email addresses that customers give at your venue, for example to join your loyalty card, to get your Wi-Fi or with their feedback, go on your customer list. You can send marketing emails only to customers who ticked the box agreeing to them and then confirmed by email. Every marketing email carries an unsubscribe link. How we handle this list for you is set out in the Customer Data Processing schedule below.
Customers who leave feedback through your Candour page may be invited to leave a review on Google if their feedback reads as positive. To decide this, we check the sentiment of the feedback text with Google's Cloud Natural Language API.
You must not use the feedback feature to ask for, filter, or suppress genuine customer reviews in a way that breaks Google's review policies or any consumer protection law. The feature is there to make it easy for happy customers to share their experience, not to hide negative feedback.
You must not use Candour to:
Candour uses AI to check the sentiment of feedback, to help read menu content, and to answer your questions about your feedback in the dashboard assistant. These features are tools and are not guaranteed to be accurate. Do not rely only on AI output for business-critical decisions. The providers we use for them are listed in our Privacy Policy, and those that handle your customers' data are listed in the Customer Data Processing schedule.
If you buy QR stands or related products in the Candour shop, in the app or on the web dashboard, those purchases are covered by our separate Terms of Sale, shown at checkout. Payment is processed by Stripe.
Candour and its software, design, and brand belong to Sullivan Applications Ltd. Using Candour does not give you any ownership rights in it.
You keep ownership of the content you upload, such as menu images and business information. By uploading it, you give us a limited licence to store, display, and process it to provide the service to you.
We aim to keep Candour available at all times, but we do not guarantee an uninterrupted service. We may need to take it down for maintenance, updates, or reasons outside our control. We will try to give notice of planned downtime.
We are not liable for any loss caused by an interruption, as long as we have acted reasonably.
To the extent the law allows, Sullivan Applications Ltd's total liability to you in connection with Candour will not exceed the total fees you paid us in the three months before the event that gave rise to the claim.
We are not liable for indirect, consequential, or special losses, including loss of revenue, loss of customers, or damage to reputation, even if we were told such losses were possible.
Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be excluded under English law.
You can close your Candour account at any time in the app or by contacting us. If you are on a paid plan, it ends at the end of the billing period you have paid for.
We may suspend or close your account if you break these Terms, if the law requires it, or if we stop providing the service. If we close your account without cause, we will refund any fees you paid in advance for the time remaining.
When your account closes, your business data, including your customer list, is deleted within 30 days, as set out in our Privacy Policy and in the Customer Data Processing schedule.
We may update these Terms from time to time. If we make significant changes, we will tell you by email or in the app before they take effect, and we will ask an owner of your business to accept the new version the next time they sign in.
These Terms are governed by the laws of England and Wales. Any dispute arising from them is subject to the exclusive jurisdiction of the courts of England and Wales.
If you have any questions about these Terms, contact us at contact@candour.app.
Sullivan Applications Ltd, United Kingdom.
This schedule forms part of the Terms. It is the written agreement between your business and us that UK GDPR Article 28(3) requires for the customer data we process for you, and it sets out, under Article 26, which of us is responsible for what. Where it differs from the rest of the Terms on customer data, this schedule wins.
Customer data means the personal data of your venue's customers that we hold through Candour: their first name, email address, birthday (day and month only), loyalty card and stamps, visits, whether they agreed to marketing emails and how, the emails sent to them, rewards and vouchers, and any details they give with their feedback.
What we do with it: store it, show it to you in your dashboard, issue and update loyalty passes, send emails to your customers on your behalf, and the other processing needed for the features you switch on.
How long: for as long as you use Candour, then as set out in section 8.
For your customer data, your business is the controller and we are your processor. We process it on your behalf and on your instructions, except for the processing listed in section 5, where we are a controller ourselves.
We will:
You authorise us to use these sub-processors for customer data:
We will give you at least 30 days' notice, by email or in the app, before we add or replace a sub-processor. If you object, tell us. If we cannot address your objection, you can close your account before the change takes effect.
Some sub-processors may process data outside the UK. Where they do, we rely on safeguards that UK law recognises, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
We decide some things for ourselves, across every venue that uses Candour, and are responsible for them:
For these, your business and we are joint controllers under Article 26. We are responsible for telling customers about this processing in our Privacy Policy, which sets out the essence of this arrangement, and for handling requests about it. A customer can contact either of us. If a request reaches you that is about this processing, pass it to us.
You are responsible for:
On your behalf, unless you delete it sooner:
Our backups keep data for up to 98 days. If we ever restore from a backup, we re-apply every deletion made since.
When you close your account, or we close it, we delete your customer data within 30 days. Before you close it, you can export your customer list from the dashboard. We keep only what the law requires us to keep, and the suppression list in section 7. A loyalty card your business shares with another business you own can pass to that business, as set out in our Privacy Policy.