Terms of Service

Last updated: 2 November 2026 · Digital Safety Records Ltd

These terms cover the HACCP Records.app website and the cloud-connected business web service at my.haccp-records.app. They include the data-processing schedule below.

1. Provider and scope

The provider is Digital Safety Records Ltd, company number 17109237, 36 Easterdown Close, Plymouth, United Kingdom, PL9 8SS. ICO reference: ZC277257. Contact us through our company support contact form or by post. Identify your organisation and the service concerned; never include passwords or full payment-card details.

The web service uses Supabase for hosted accounts and records and Stripe for online subscription payments where checkout is offered. These terms do not state that web records remain solely on your device. App-store subscriptions are separate purchases governed by the terms presented for that application and store; a purchase does not automatically include another product unless expressly stated.

By creating an account or placing an order you agree to these terms on behalf of yourself or the organisation you are authorised to represent. These terms must be made available before agreement. A separately signed agreement takes priority where it expressly conflicts with these terms.

2. Accounts and authorised users

Provide accurate registration and billing details, keep credentials confidential and only invite people who should have access. Customer administrators are responsible for permissions and removing access when staff leave. Do not share a personal login to avoid access restrictions. Tell us promptly if you suspect unauthorised access.

You must have authority to enter business records and personal information about other people. The service is intended for business use by people able to enter a binding agreement.

3. Food safety responsibilities

The service supports recording, organisation and review. It does not replace your HACCP-based procedures, competent supervision, staff training, physical checks or professional advice. You remain responsible for selecting appropriate checks, limits, review intervals, retention periods and corrective actions, and for the accuracy and completeness of your entries.

No subscription guarantees legal compliance, a food hygiene rating, an inspection outcome or the safety of food. Website articles and templates provide general information; verify their suitability for your jurisdiction and operation.

4. Prices, subscriptions and Stripe

Where a paid subscription is available, the applicable plan, price, currency, billing period, tax treatment and any trial conditions will be shown before you confirm the purchase. The checkout information governs your purchase; do not assume that prices for a mobile application apply to the web service.

Stripe processes online payments. By confirming a recurring subscription, you authorise the recurring charges described at checkout until cancellation. Payment processing is subject to applicable payment-provider arrangements. We do not store full payment-card details in the food safety database.

Where subscription management is available, use it to update billing details or cancel renewal. If you cannot access it, contact us before renewal. Cancellation normally stops the next renewal and leaves access until the end of the paid period, unless the checkout terms or a separate agreement state otherwise. Deleting an application, clearing browser data or ceasing use does not cancel a subscription.

Trial length, payment details required and any conversion to a paid plan must be stated before enrolment. A trial must not become chargeable without the agreement presented at checkout. Failed payments may result in restricted access after notice where practicable. Contact us if payment or cancellation status is unclear.

We will give reasonable advance notice of price changes affecting a renewal and an opportunity to cancel before the new price takes effect. Refunds are assessed under the purchase terms and applicable law. Nothing here removes a statutory cancellation, refund or other remedy.

5. Your records, synchronisation and exports

You retain ownership of the content you enter. You grant us the limited permission needed to host, process, transmit and display it to provide and secure the service and follow lawful instructions.

The web service may keep records in browser storage and synchronise them with Supabase. Offline changes are not safely stored on the server until synchronisation succeeds. Do not assume another device has the latest records. Clearing local data can remove unsynchronised entries.

Keep suitable independent exports or copies of records you must retain and check they are usable. Do not rely on uninterrupted access or assume provider backups constitute a customer-accessible archive. These responsibilities do not remove our own obligations to provide the service with reasonable care and skill.

Deletion and retention actions can permanently remove records and may synchronise to the server. Confirm the scope of an action before using it. Cancellation does not automatically delete business records. Before closing an organisation, request return or deletion of its data and retain any records needed for legal or operational purposes.

6. Acceptable use

Do not use the service unlawfully, upload malicious material, attempt to bypass organisation permissions, interfere with other customers or copy or resell the service without permission. Do not submit medical histories, detailed health information, criminal-offence information or other sensitive personal data. Keep staff references and free-text notes necessary and proportionate.

Our software, branding and website material remain ours or our licensors’. Your subscription provides a limited right to use the service, not ownership of the software. Nothing restricts rights that applicable law permits you to exercise.

7. Availability, changes and suspension

Internet services, hosting, authentication and payments can experience outages. We may maintain or update the service and will give notice of significant disruption where reasonably practicable. No specific uptime or response-time service level applies unless separately agreed.

We may restrict access where reasonably necessary for security, unlawful use, a material breach or unpaid charges. Where possible, we will explain the reason and allow a reasonable opportunity to resolve it. We will not suspend access arbitrarily. If we permanently discontinue a paid service, we will give reasonable notice, a reasonable opportunity to retrieve records and an appropriate refund for prepaid service we do not provide, subject to applicable law.

8. Responsibility and liability

We will exercise reasonable care and skill in providing the service. We are responsible for loss or damage to the extent required by applicable law. Customer responsibility for food safety does not excuse a failure by us to meet our own contractual or legal obligations.

Nothing excludes or limits liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence, or any other liability that cannot lawfully be excluded or limited. Nothing removes mandatory consumer rights where they apply. No blanket exclusion of all data loss or payment-related liability is made by these terms.

9. Privacy and communications

Our privacy notice explains account, operational, payment, technical and support processing. Service and security messages may be necessary to operate your account. Marketing choices are separate from essential account messages.

10. Data-processing schedule

This schedule applies when we process personal information in customer operational records on the customer’s behalf. It forms part of the service agreement and does not replace the customer’s own privacy notices.

Scope and instructions

The customer is controller and Digital Safety Records Ltd is processor for that content. Processing covers collection, recording, storage, organisation, retrieval, display, synchronisation, export and deletion to deliver the service for the agreement’s duration and any necessary return or deletion period. It may involve staff, authorised users, supplier contacts and other people necessarily identified in business records. Data can include names, identifiers, work responsibilities, training and operational activity, dates, times and relevant notes. Sensitive personal data is outside the permitted use.

We process this content only on documented customer instructions, including these terms and authorised account actions, unless law requires otherwise. We will inform the customer of a legal requirement before processing unless prohibited, and notify the customer if an instruction appears to infringe data-protection law. The customer determines the lawful basis, provides notices, ensures accuracy and issues lawful instructions.

Confidentiality and security

We will ensure people authorised to process customer data are bound by confidentiality and use appropriate technical and organisational measures proportionate to the risks, including access restrictions, authenticated access, secure transmission and controls on privileged access. We will maintain measures supporting confidentiality, integrity, availability and recovery, and review their effectiveness. Information about relevant measures will be made available on request without disclosing secrets or other customers’ data.

Subprocessors and transfers

The customer gives general written authorisation for subprocessors necessary for the service: Supabase for authentication, database and supported storage; Vercel for hosting and delivery; and MailerSend for transactional email. Stripe processes operational customer data only to the extent necessary for billing; it also acts independently for some payment and regulatory activities. The privacy notice provides provider links.

We will impose equivalent applicable data-protection obligations on subprocessors and remain responsible for their performance of those obligations. We will notify the customer in advance of intended additions or replacements and allow a reasonable opportunity to object on data-protection grounds. We will work to resolve an objection; if no reasonable resolution is possible, either party may end the affected service, with an appropriate refund of unused prepaid service. Restricted international transfers require applicable safeguards and documented instructions.

Assistance, incidents and assurance

Taking account of the processing and information available, we will assist the customer with individual-rights requests, security obligations, personal-data breaches, impact assessments and regulatory consultation. We will notify the customer without undue delay after becoming aware of a personal-data breach affecting its content, provide available relevant information and cooperate with investigation and remediation. We will direct requests relating to customer-controlled content to the customer unless law requires another response.

We will provide information reasonably necessary to demonstrate compliance with this schedule and allow and contribute to proportionate audits or inspections by the customer or its authorised independent auditor, subject to reasonable security and confidentiality arrangements. These arrangements must not prevent an audit required by law or a regulator.

End of service

At the customer’s choice, we will return or delete customer personal data after service ends, and delete existing copies unless law requires retention. We will agree practical arrangements for return and deletion, including any restricted backup copies retained temporarily until replacement. Such copies remain protected and are not used for unrelated purposes. The customer should request arrangements before closing access.

This schedule applies to processor activities. We remain controller for our own account, security, support and legally required financial records as explained in the privacy notice.

11. Changes, complaints and governing law

We may update these terms for changes in law or service operation. Material changes will be communicated with reasonable notice where practicable and will not retrospectively remove accrued rights. If a material change adversely affects a paid service, contact us to discuss cancellation and any appropriate unused-period refund.

Contact us first about a service complaint so we can investigate. These terms are governed by the law of England and Wales. For business customers, the courts of England and Wales have jurisdiction. If mandatory consumer protections apply, this does not deprive you of protections or local court rights that the law gives you.