Earlier version. This is version 3 of the managero Privacy Policy, last updated 2026-10-22. It is kept so that it can still be read, and it is not the current version. The current version is at https://managero.co.uk/privacy.
managero Privacy Policy
1. Who we are
managero is provided by Managero Software Limited, a private limited company registered in England and Wales (company number 17500331), trading as managero.
- Registered office: Ileden Farm House, Ileden Lane, Canterbury, CT4 6HP, United Kingdom
- Contact for anything in this policy: hello@managero.co.uk
- The service: https://app.managero.co.uk
2. Controllers and processors
Which relationship you are in decides who answers you.
A restaurant with a managero account is the controller of the records it keeps about its staff and about incidents in its business. Managero Software Limited is its processor. You decide what goes in. We hold it and act on your instructions. Our obligations to you are in the Data Processing Terms.
An employee invited to managero by a manager should ask their employer about their data. The employer is the controller. If you write to us we will acknowledge you, tell you which business holds your data and pass the request to them. We cannot correct or delete an employer's records on your instruction.
For our own account and billing records (the name and email of the person who signs up, what they pay, and the emails we send them) Managero Software Limited is the controller.
3. What we hold, and why
3.1 The account holder (we are the controller)
| What | Source | Lawful basis |
|---|---|---|
| Name, email address | Sign-up | Contract, Article 6(1)(b) |
| Sign-in credentials, handled by Firebase Authentication. We do not see your password | Sign-up | Contract, Article 6(1)(b) |
| Business name, site names and site addresses | Your setup of the account | Contract, Article 6(1)(b) |
| Emails we send you: staff invitations, failure and miss alerts, the owner digest, payment notices, the export on cancellation | Automatic | Contract, Article 6(1)(b) |
| Billing records: customer and subscription ids, status, amounts, renewal dates | You, and Stripe | Contract, Article 6(1)(b), and legal obligation, Article 6(1)(c), for tax records |
| Security and diagnostic data: IP address, browser user agent, error logs | Automatic | Legitimate interests, Article 6(1)(f): keeping the service secure and working |
Providing this data is a contractual requirement, not a statutory one. Without it we cannot open or run an account for you.
3.2 Your employees (you are the controller; we process on your instructions)
This data reaches us either from you or from the employee, who enters it when completing their invitation. The lawful basis column gives the basis a UK restaurant ordinarily relies on. The basis is yours to determine, not ours.
| What | Where in the app | Lawful basis the controller ordinarily relies on |
|---|---|---|
| Name (first and last) | Invitation completion; copied onto every record the person creates | Contract, Article 6(1)(b): the employment contract |
| Email address | The invitation; sign-in | Contract, Article 6(1)(b) |
| Phone number | Invitation completion | Contract, Article 6(1)(b), and legitimate interests, Article 6(1)(f): reaching staff about shifts |
| Date of birth | Entered by the employee on the invitation page | Legal obligation, Article 6(1)(c): age governs the hours a young worker may lawfully work, and identity checks; and contract, Article 6(1)(b) |
| Home address | A field exists in the data model but no screen captures it and nothing writes it | Not processed at present |
| Emergency contact name, relationship and phone number | Invitation completion | Vital interests, Article 6(1)(d), for the emergency itself; legitimate interests, Article 6(1)(f), for holding it in advance. This is personal data about a third party: the employee should tell the person they name |
| Signature images | Signing a form, and counter-signing an incident report. Stored as a PNG in Cloud Storage | Legal obligation, Article 6(1)(c): a food-safety record must be attributable; and legitimate interests, Article 6(1)(f) |
| IP address and browser user agent | Captured into the audit block of every signature, with the time and the account email. Shown on screen and printed in the export | Legitimate interests, Article 6(1)(f): the audit trail is what makes a signed record stand up |
| Photographs taken as evidence | Daily checks, corrective actions, deliveries, incident scenes, Camera Uploads of completed sheets, and photo answers inside forms. People frequently appear in them | Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f) |
| Right-to-work check answers and document images | The built-in right-to-work form template: full name, date of birth, document reference and a photograph of the identity document | Legal obligation, Article 6(1)(c): the statutory excuse under immigration law depends on holding the check |
| Training records and quiz results | Training screens. A quiz attempt stores the paper, the answers, the marking and the score | Legal obligation, Article 6(1)(c): food handlers must be supervised and trained; and legitimate interests, Article 6(1)(f) |
| Certificates uploaded about a named person | The document vault, where a document can have a person as its subject | Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f) |
| Shift and rota data: who worked, when, in what role, and who requested or approved a shift swap | Rota planning and publication | Contract, Article 6(1)(b), and legal obligation, Article 6(1)(c): working time records |
| Attribution on operational records: who recorded each temperature, check, delivery, note and correction, and when | Automatic, on every record | Legal obligation, Article 6(1)(c): an unattributable food-safety record is not a record |
| Free-text notes typed by managers about records | Record notes and corrections | Legitimate interests, Article 6(1)(f). Text typed into a free-text box is personal data if it is about a person, and what goes in one is the controller's responsibility |
Not collected. managero holds no location or GPS data, no National Insurance number, no bank details and no salary or pay rate. The only staff health information it holds is in the fitness to work records (section 3.5) and the incident records (section 3.3).
3.3 Incident and injury records: special category data
An incident report in managero can hold: the injured person's name; whether they are staff, a customer, a contractor or a delivery driver; their organisation; their contact number, email address and postal address; a narrative of what happened; a description of the injury; what treatment was given and by whom; the names and contact details of witnesses; photographs of the scene; whether a RIDDOR prompt was raised; a counter-signature with its audit block; and any later corrections.
A description of an injury and of the treatment given is data concerning health. Health data is special category personal data under Article 9(1) of the UK GDPR and may not be processed unless a condition in Article 9(2) is met in addition to an Article 6 basis.
The Article 9 conditions relied on:
- Injured person is a worker: Article 9(2)(b): processing necessary for carrying out the obligations and exercising the specific rights of the controller or the data subject in the field of employment law and social security law. In UK law that condition requires an authorising provision, which is Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018 (employment, social security and social protection). The obligations served are the duty to report certain injuries under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR) and the duty to keep an accident book under the Social Security (Claims and Payments) Regulations 1979.
Schedule 1, Part 4 of the Data Protection Act 2018 requires a controller relying on that paragraph to have an Appropriate Policy Document in place. If you use managero to record injuries to your staff, that document is your obligation, not ours.
- Injured person is not a worker (a customer, a delivery driver, a contractor): the employment condition does not apply. The condition relied on is Article 9(2)(f), processing necessary for the establishment, exercise or defence of legal claims, with Article 6(1)(f), legitimate interests. A contemporaneous record of an injury on your premises exists because a claim may follow.
- Article 9(2)(c), vital interests, may apply in the moment of a serious incident where the person cannot consent, for example when emergency contact details are used. It is not relied on for keeping the record afterwards.
Consent is not relied on for any of this. An employer cannot take freely given consent from an employee for something the employee cannot realistically refuse, and a record that disappears when consent is withdrawn is not a record.
As processor we do not choose these conditions. The controller does.
Controls in the app. Reading an incident record requires being the account owner or holding an explicit permission. Incident records are excluded from ordinary employee views and from the owner digest email, and an export containing them carries a special-category warning. The public counter-signing link shows the injured party only what they need to sign and withholds the date of birth field.
3.4 Customer complaints about food
When a customer complains about the food, any member of staff at the site can write it down in managero: what kind of complaint it is (illness after eating, something found in food, an allergic reaction, undercooked food, or another food complaint), when and how it was received, the meal and the dish, a short description of what the customer says happened, photographs if any, and, optionally, the customer's name, phone number and email address, which are there only so the business can reply. Managers then record what they checked, what was done, the reply, and whether the council was told. Why: to deal with the complaint and to show an inspector how complaints are handled; the controller's basis is typically Article 6(1)(f), legitimate interests. For illness and allergic reactions the record holds the kind of complaint and that short description and no other medical detail; that is data concerning health, and the condition typically relied on is Article 9(2)(f), legal claims. As with incidents, the controller chooses these conditions, not us. Who sees it: the member of staff who wrote it down cannot read it back; reading it is limited to the account owner and to managers holding the Report incidents permission. The export and any share link list each complaint without the customer's name, contact details or photographs, and the owner digest email does not read complaints. Retention: a complaint is kept with the compliance records for at least five years (section 6), and goes when the owner empties the account.
3.5 Fitness to work: sickness, exclusion and the questionnaire
Food handlers must report diarrhoea, vomiting and some infections, and a business must keep anybody who may contaminate food away from it. managero records this in three ways: a member of staff saying they are unwell, by choosing a category (diarrhoea and/or vomiting, another infection, a skin infection or wound, or another illness), never a description; a manager's decision to exclude them or to let them work with checks, and later their return to work, with the checks made and who cleared them; and a fitness to work questionnaire based on the Food Standards Agency's form SC7, which a new starter completes before their first shift, a manager may ask anybody to complete, and a person returning after illness completes as part of the return. The questionnaire holds four yes/no answers (diarrhoea or vomiting in the last 48 hours, medication to control it, infected wounds or skin infections, discharge from the eye, ear or gums/mouth), the date, the person's signature, and the manager's signed review and outcome. There is no free-text field for medical detail anywhere in these records. Each signature carries the audit block described in section 3.2.
This is data concerning health. Why: to meet the food hygiene duty to keep a person who may contaminate food away from it (Regulation (EC) No 852/2004 as retained in UK law, Annex II, Chapter VIII), and to show an inspector that it was met. The controller's bases are typically Article 6(1)(c), legal obligation, with Article 9(2)(b) and Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018 (employment), which needs an Appropriate Policy Document in place. As with incidents, the controller chooses these conditions, not us. Who sees it: the person it is about, and the account owner and managers given the Manage fitness to work permission at that site. Nobody else can read it; everybody at the site sees only that a number of people are excluded, with no names. Exports: these records are left out of every export unless the person producing it holds that permission and turns them on. Questionnaire answers are never in an export, a CSV or a share link: an export says at most how many returns after illness had a signed questionnaire, and on which days, with no names and no answers. Share links never carry any of it. Retention: nothing can be edited or deleted once signed; the records are kept with the compliance records for at least five years (section 6), and go when the owner empties the account.
3.6 On your device
- A photo queue in your browser's IndexedDB. Photographs taken while offline are held on the device, compressed, until they upload. This is what makes recording work in a walk-in fridge with no signal.
- Sign-in state and the selected site, in browser storage, so you are not signed out between screens.
- Firebase Analytics, if it initialises, sets cookies for usage measurement. It is optional in the code and non-fatal if it fails.
3.7 Visits to managero.co.uk
When a page on managero.co.uk loads, your browser sends us a count of it: the page, the domain of the site that linked to it (such as google.com, never the full link), any campaign tags in the address, and whether the screen is phone, tablet or desktop sized. Opening or sending the contact form and clicking Sign up or Sign in are counted the same way. Each count adds one to a daily total, and only the daily totals are kept. The counting stores nothing on your device, no cookie and no local storage, and no IP address or identifier is saved with the counts, so they cannot be linked to you or to each other. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is counted. Lawful basis: legitimate interests, Article 6(1)(f), in knowing which pages are read and how people find the site.
3.8 managero news by email
If you tick "Send me occasional managero news and tips. Unsubscribe any time." on the website or when you create your account, we send you occasional emails with news about managero and tips on using it. We send them only to people who ticked that box, and the box always starts unticked. We keep your email address, when and where you ticked it, and the words next to the box. Every email has an Unsubscribe link that works in one click, and an account owner can also turn it off in Settings, under the emailed digest. When you unsubscribe we keep your address on a list so we do not email you again. Unsubscribing does not affect the emails your account needs, such as invitations, digests, alerts, password resets and billing emails. The emails are sent through Domeneshop (section 4.3) and are not tracked: we do not record whether you open them or click a link. Lawful basis: consent, Article 6(1)(a), as the Privacy and Electronic Communications Regulations require for marketing email.
3.9 The mailing list on the app's sign-up page
Before sign-up opened, the sign-up page at https://app.managero.co.uk/signup offered a mailing list. If you joined it, we keep your email address, your name if you gave one, when you joined, and the sentence that was shown above the button: "We will email you once, when managero opens. Nothing else. Unsubscribe any time." We use your address for one email, to tell you managero has opened, and for nothing else. Joining the mailing list was not a yes to managero news (section 3.8). If you joined while the sentence above the button also offered managero news and tips, you may also get the emails in section 3.8. Every email has an Unsubscribe link that works in one click, and when you unsubscribe we keep your address on a list so we do not email you again. The email is sent through Domeneshop (section 4.3) and is not tracked. Lawful basis: consent, Article 6(1)(a).
3.10 Partner links
If you reach managero.co.uk through a partner's link (an address ending `?ref=` and their name), we keep that partner's name in a cookie called `mg_ref` and in your browser's local storage for 60 days, so that if you sign up we know which partner introduced you and can apply their offer at checkout. Nothing else is stored, it is not shared with the partner or anybody else, and it is not used to track you. If you sign up, the partner's name is kept with your account. Lawful basis: legitimate interests, Article 6(1)(f).
3.11 Campaign links
If you reach managero.co.uk or the managero app through a link carrying campaign tags (the `utm_` parts of an address, used in our adverts and emails) and then sign up, we keep the campaign's name, source and medium with your account so that we know which advert or email worked; they are not shared with anybody. Lawful basis: legitimate interests, Article 6(1)(f).
4. Recipients and sub-processors
4.1 Google (Firebase and Google Cloud): the platform
Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions and Firebase Hosting. Everything described in section 3 is stored on Google's infrastructure. There is no other database.
4.2 Google (Gemini, via the Google AI Studio API): reading what you upload
When someone in your business uses one of the features below, the file, or the text taken from it, is sent to Google's Gemini API at generativelanguage.googleapis.com to be read.
| Feature | What is sent to Google |
|---|---|
| Form import: a paper form made into a form in the app | A photo, PDF or Word document of the form |
| Menu import | A photo, PDF or Word document of the menu |
| Recipe import | A photo, PDF or Word document of your recipes. A spreadsheet (CSV or Excel) is read on your device and is not sent |
| Staff list import | A photo, PDF or Word document of a staff list or rota, with the names, email addresses and any other details on it. A typed list or a CSV is read on your device and is not sent |
| Paper records: typing up the records you kept on paper before managero | A photo or PDF of the sheets, with the names, initials and signatures on them |
| Temperature sheet transcribed from Camera Upload | The photo of the sheet |
| Invoice import, in ingredient pricing | A photo of a supplier invoice or delivery note, or a scanned PDF with no text in it. A PDF that has text in it is read without Gemini and is not sent |
| Risk assessment import | A photo, PDF or Word document of the risk assessment |
| Bulk upload: the sorting step | Any file whose name and type do not show what it is, for example "scan0142.pdf". That file can be anything in the folder, including a staff document. A file whose name points to health, an injury or someone's identity is not sent for sorting. Once sorted, a file may be sent again by the matching import above |
- What you upload is sent as it is, including any names, signatures, handwriting or other personal information on it. A photo or a PDF is sent whole, base64-encoded, with no cropping or redaction. For a Word document, only the extracted text is sent.
- It happens only when someone uses one of these features. Nothing is sent to Gemini in the background.
- What comes back is a draft for someone in your business to check and confirm. Nothing is saved from it until they do. The import prompts forbid the model from producing allergen information of any kind.
- The uploaded file stays in your own area of Cloud Storage afterwards, and nothing deletes it. An invoice is the exception: it is not stored unless the person ticks "Keep this invoice".
A sheet filed under Camera Upload is kept as an image and is not read or sent to any model, which the app states on the record itself: "managero has not read this photograph." The one exception is a temperature sheet you choose to transcribe (above): every value read from it is shown beside the photo and confirmed by a person before it is saved. If you would rather a document with personal information on it did not go to Google, file it under Camera Upload instead of importing it.
4.3 Domeneshop: email delivery
Outbound email (staff invitations, failure and miss alerts, the owner digest, payment notices, the export on cancellation, managero news and the launch email to the mailing list) is sent through Domeneshop's SMTP service. Domeneshop receives the recipient's email address and the content of the message. An invitation names the business, the person who invited you, the sites you will work at and any forms waiting for you.
4.4 Stripe: payments
Subscriptions are taken through Stripe Payments UK Ltd. Stripe receives your name, your email address and your card details, and it holds the card: we do not see or store a card number. You type it on Stripe's own page, not on ours.
From Stripe we receive only what tells us whether your account is paid: a customer id, a subscription id, the status, the amount, the renewal date and whether a payment failed. That is what your account's billing record holds.
Stripe is a controller in its own right for fraud prevention and its own legal obligations, and a processor on our behalf for the rest. Its privacy policy is at https://stripe.com/gb/privacy. No employee record, compliance record or incident report is sent to Stripe.
5. Where your data is stored, and transfers out of the UK
Your records are stored in the United Kingdom. The Firebase project is managero-162d0. Its Cloud Firestore database is in Google Cloud region `europe-west2`, which is London, and uploaded files (signature images, evidence photographs and documents) are in the Cloud Storage bucket managero-162d0.firebasestorage.app, also in `europe-west2`. Both are single-region, not multi-region. The region was read back off the created database on 31 August 2026. A Cloud Firestore database cannot be moved once it exists.
Two things are processed outside the UK:
- Google's Gemini API, used only when someone uses one of the features in section 4.2. What is sent to it may be handled outside the UK, including any names, signatures or other personal information on the file.
- Stripe, which handles subscription payments and operates internationally. It receives your billing details and no compliance record.
For both, the transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which Google Cloud, Firebase and Stripe incorporate into their terms as standard.
6. Retention, and the right to erasure
Retention. managero keeps records for at least five years, and nothing hard-deletes. This is enforced in the database rules: a function that refuses deletion is applied to every record collection, and signed forms and quiz attempts refuse updates as well. Removing an item archives it.
The right. Article 17 of the UK GDPR gives a person the right to have their personal data erased. It is not absolute. How the two fit together, category by category:
- Compliance records are retained and are not erased on request. Temperature readings, daily checks, deliveries, signed forms, self-audits, training records, quiz attempts, Camera Uploads and incident reports are kept because the restaurant is under a legal obligation to keep them: food hygiene record-keeping duties, RIDDOR, accident book requirements, working time records. Article 17(3)(b) of the UK GDPR disapplies the right to erasure where processing is necessary for compliance with a legal obligation. That is why a leaver cannot have the fridge temperatures they recorded in March deleted.
- A person's name stays on the record they made. The name, the time and the audit block are the record. They are retained on the basis in point 1.
- HR details that are not part of a compliance record can be erased. Once someone has left, their date of birth, phone number, emergency contact details and any address details are no longer needed: the record needs to say who did the thing and when. On the controller's written instruction we delete or minimise those fields on a leaver's profile and leave the compliance records intact. So the answer to "can you delete me" is: most of you, yes; the records you made, no.
- Right-to-work document images are retained for the statutory period after employment ends and then deleted, on the controller's instruction.
- Photographs in which a person appears incidentally are part of the evidence record and are retained under point 1. A photograph that captured something it should not have is deleted on the controller's instruction.
- Account holders' own data (name, email and billing history) is retained while you have an account, and afterwards for as long as it is needed for tax and for the free read-only access promised in section 8 of the Terms of Service.
Two qualifications.
- There is no self-service erasure button and no automated deletion. The app has no user-facing delete for anything except a pending invitation that was never accepted. Erasure under points 3, 4 and 5 is a manual operation we perform on the controller's written instruction. Write to hello@managero.co.uk.
- There is no automatic deletion at five years. Five years is a floor, not a ceiling, and no code enforces a ceiling.
Unresolved. Where a former employee insists their name be removed from records the restaurant must keep, points 1 and 2 collide with Article 17 directly, and the balance is a legal judgement that needs legal advice. Until that advice is taken we apply the position above, tell the person asking what we are doing and why, and tell them they may complain to the ICO.
7. Your rights
You have the right to be informed, to access your data, to have inaccurate data corrected, to erasure (subject to section 6), to restrict processing, to data portability, and to object. Where processing relies on consent you may withdraw it. There is no automated decision-making with legal or similarly significant effects in managero.
- If you are an employee: ask your employer. They control the records. If you write to hello@managero.co.uk we acknowledge you, tell you which business holds your data, and pass the request to them.
- If you are an account holder: write to hello@managero.co.uk. We answer within one month.
Complaints. You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. You do not have to raise it with us first.
8. Security
- Data is separated per account by Firestore and Cloud Storage security rules, enforced by the server rather than by the app in your browser.
- Signature images, evidence photographs, uploaded documents and imports are write-once at the storage layer: the rules refuse update and delete on those paths.
- Signed forms and quiz attempts cannot be edited after signing. Corrections are appended as new entries, so a change is visible rather than silent.
- Incident records are restricted to the account owner and holders of an explicit permission.
- Passwords are handled by Firebase Authentication. We do not see or store them.
- The Google AI key is a server-side secret and is not in the browser bundle. The browser does not talk to a model directly.
- Access to the production project is limited to the director of Managero Software Limited.
Breaches. If a personal data breach affects data we hold for you, we notify you without undue delay, so that you can meet your own 72-hour duty to the ICO. The detail is in the Data Processing Terms, clause 11.
9. ICO registration and the data protection fee
Managero Software Limited is registered with the Information Commissioner's Office and pays the data protection fee. ICO registration number: ZC274948. You can check it on the ICO's register of fee payers: https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/
10. Changes
If we change this policy materially we email account holders and update the date below. The current version is always at https://managero.co.uk/privacy.
Version: 3. Last updated: 2026-10-22.
Earlier versions: version 1, 2026-10-05; version 2, 2026-10-13.