Privacy policy

1. Who we are

Crepe Salut Limited ("Crepe Salut", "we", "us") runs the crepesalut.com website, the Crepe Salut app for iPhone and Android, our creperies and our mobile crepe vans. We are registered in England and Wales as Crepe Salut Limited, company number 14387230, and our registered office is Unit 1a Chapel Lane, Westcott, Dorking RH4 3PJ.

We are the data controller for the personal information described in this policy. If you have any question about it, or want to exercise any of your rights, email support@crepesalut.com or write to us at the address above.

2. What this policy covers

This policy explains what we collect, why, who we share it with and what your rights are when you use our website, our app, our loyalty programme, order ahead, buy a gift card, shop online, enquire about hiring a van, sign up to our newsletter, apply for a job or get in touch. It covers the website and the app together, because your account is the same in both.

Our Cookie policy explains the cookies and similar technologies the website uses. Our Terms and conditions set out the rules for using our services.

3. Information you give us

• Your account. To create an account you give us your mobile number, which we confirm with a one-time code sent by text message. During set-up we ask for your first and last name, your email address and, if you'd like a birthday treat, your date of birth. You also choose whether to receive marketing from us.
• Orders placed ahead. The items you order, the creperie, the collection time, any note for the kitchen, and the order's total and payment status. Your card details go directly to Square, our payment provider, and are never stored by us.
• Gift cards. The sender's name and email, the recipient's name and email, the amount, the delivery date and any message. If you check a gift card's balance, the card number and the email it was sent to.
• Event and van hire enquiries. Your name, email, phone number, the occasion, date, location, guest numbers, any extras and your message.
• Shop orders. Orders placed in our online shop are taken through Shopify, which collects your name, delivery address, email and payment details on our behalf. We see the order and delivery details so we can fulfil it.
• Newsletter. Your email address and, if you give them, your first and last name, together with the wording you agreed to when you signed up.
• Job applications, franchising and partnership enquiries. The details you enter in the form, including any CV you attach.
• Messages. Anything you send us by email, through our contact form, or in the app.

4. Information we collect automatically

• From the app. The device type, operating system version and app version, so we can support it. A push notification token, if you allow notifications. Crash and error reports, sent to Sentry without your name, email or phone number, so we can fix problems. Records of what you do in the app (for example signing in, placing an order or viewing a screen), which we use to understand how the app is used and to send you relevant notifications.
• Your location, only if you allow it. The app asks for your location, while you are using it, to show your nearest creperie and where the vans are. It never collects your location in the background, and you can turn it off at any time in your phone's settings. The website's location finder works the same way, through your browser.
• Advertising identifiers, only if you allow tracking. On iPhone the app asks, through Apple's App Tracking Transparency prompt, whether we may share your app activity and email address with Meta so we can show you Crepe Salut offers on Facebook and Instagram and measure which ads work. On Android the app asks the same question in its own settings. If you say no, nothing is shared with Meta for advertising. You can change your answer at any time in the app or in your phone's privacy settings.
• From the website. Essential cookies that keep you signed in and remember your basket. If you accept analytics cookies, anonymous records of the pages you visit, so we know what to improve. Our server logs record the network address and browser of each request for a short time, for security.

5. Information we receive from others

• Square, our till and payments provider. When you give your phone number or scan your loyalty code at a creperie or van, Square records the stamp against your loyalty account and tells us, so your stamps and rewards appear in the app and on the website. Square also tells us when an order you placed ahead has been paid for and collected.
• Apple and Google. If you add your loyalty pass to Apple Wallet or Google Wallet, those companies handle the pass on your device. If you pay with Apple Pay or Google Pay, they pass the payment to Square. The app stores know that you have installed the app, but do not tell us who you are.
• Meta. If you allowed tracking, Meta tells us in aggregate how our adverts performed. It does not tell us which individuals saw them.

6. Why we use your information, and the legal basis

• To provide what you've asked for (performance of a contract): creating and running your account, taking and fulfilling orders ahead and shop orders, issuing and redeeming gift cards, running our loyalty programme and crediting your stamps and rewards, answering enquiries and preparing quotes, and sending you the messages those things need, such as a login code, an order confirmation or a gift card.
• To run our business properly (our legitimate interests): keeping our services secure and preventing fraud and misuse, checking our records against Square's, fixing crashes and bugs, understanding how the app and website are used so we can improve them, responding to your messages, and keeping records of the decisions we make. Where we rely on legitimate interests we have weighed them against your interests and rights, and you can object at any time.
• With your consent: sending you marketing by email and push notification; sharing your app activity and email address with Meta for advertising; using your location; and setting analytics cookies on the website. You can withdraw consent at any time, and it won't affect anything that happened before.
• To meet our legal obligations: keeping payment and tax records, responding to lawful requests from authorities, and keeping a record that we acted on a request to delete an account.

7. Our loyalty programme

Our loyalty programme runs on Square's loyalty system, linked to your mobile number. Stamps are earned when you visit a creperie or van and give your number or scan your code, and when you collect an order placed ahead. We store your stamp balance, your rewards and a history of stamps earned and redeemed, so you can see them in the app and on the website and so we can resolve any dispute about them.

You can add a loyalty pass to Apple Wallet or Google Wallet. The pass carries your name, your loyalty reference and a barcode, and nothing else.

8. Marketing and notifications

We only send marketing email and marketing push notifications if you have said yes, either when you set up your account, in the app's settings, or when you signed up to our newsletter. Marketing may include news, offers, new locations and events. Every marketing email has an unsubscribe link, and you can change your choices at any time in the app under Account > Communications, or by emailing us.

Some messages are not marketing and we send them whether or not you have opted in: your login code, order confirmations and updates, gift card deliveries, replies to your enquiries, and important notices about your account or these terms.

We send text messages only to confirm your mobile number when you sign in. We don't send marketing by text.

9. Who we share your information with

We share information with the companies that help us run our services. Each acts on our instructions, under a contract that requires them to protect your data and use it only for the purpose we give them.

• Supabase (Ireland): the database and sign-in service behind your account, orders, enquiries and gift cards.
• Square (United States and Ireland): card payments for orders and gift cards, our tills, and the loyalty system behind our programme. Square is a data controller in its own right for the payments it processes; its privacy notice is at squareup.com/legal.
• Customer.io (European Union): the service that sends our emails and app notifications and holds your communication preferences.
• MessageBird (Netherlands): sends the text message that carries your login code.
• Resend (United States): sends our transactional emails, such as gift cards, enquiry confirmations and form submissions.
• Pipedrive (European Union): the system our events team uses to manage van hire enquiries and quotes.
• Shopify (Canada and United States): our online shop's checkout, orders and delivery details.
• Sentry (Germany): collects crash and error reports from the app and website, without your personal details.
• Sanity (European Union and United States): hosts the content of our website. Job application and enquiry forms sent through the website are forwarded by email and not stored in Sanity.
• Vercel (United States, with servers in Europe): hosts the website.
• Mapbox (United States): provides the maps in the app and on the website. Mapbox receives the map area you look at, and may collect anonymous usage statistics.
• Meta Platforms (United States): only if you allow tracking, receives your app activity and a protected (hashed) form of your email address, to show you our adverts and measure them. Meta is a joint controller with us for this.
• Apple and Google: the app stores, push notification services and digital wallets, under their own privacy notices.
• Faire (United States): the wholesale storefront embedded on our Become a stockist page, which may set its own cookies when you use it.

We also share information where the law requires it, with our professional advisers, and with a buyer or successor if our business changes hands. We never sell your personal information.

10. Where your information is kept

Our main systems are in the United Kingdom and the European Union. Some of the companies above are in the United States, Canada or elsewhere. When your information leaves the UK we make sure it is protected to UK standards, by relying on the UK government's adequacy decisions (for the European Union and, under the UK-US Data Bridge, participating US companies) or by putting the UK International Data Transfer Agreement or Addendum in place with the recipient. You can ask us for details of the safeguards that apply.

11. How long we keep it

• Your account, loyalty record and communication preferences: for as long as you have an account. You can delete it at any time, in the app or by asking us (see Deleting your account).
• Orders placed ahead and gift card purchases: six years from the purchase, because UK tax and accounting law requires us to keep records of sales. Once your account is deleted these records are no longer linked to your name.
• Event and van hire enquiries and quotes: two years after our last contact about them, or longer if they lead to a booking, in which case six years from the event.
• Shop orders: six years, held by Shopify and in our accounts.
• Login codes: deleted within minutes of being used or expiring.
• Crash and diagnostic reports: 90 days.
• Website analytics and app usage records: up to 24 months.
• Newsletter sign-ups: until you unsubscribe, after which we keep a record of your address and the date you unsubscribed so that we don't email you again.
• Records of marketing consent and of account deletions: six years, so that we can show we acted properly.
• Messages and job applications: 12 months after we last dealt with them, unless they lead to employment.

12. How we keep it safe

Information travels to and from our systems over encrypted connections. Access is limited to the people who need it to do their jobs, and sign-in to your account uses a one-time code sent to your phone rather than a password. We never hold your card number: payments are handled by Square and Shopify, who are certified to the payment industry's security standard. No system is perfectly secure, so if you think your account has been misused, tell us straight away.

13. Your rights

Under UK data protection law you have the right to ask us for a copy of the personal information we hold about you; to correct it if it's wrong; to delete it; to restrict or object to how we use it; to receive the information you gave us in a portable form; and to withdraw any consent you have given. Where we rely on legitimate interests you can object, and we will stop unless we have a compelling reason to continue.

To make a request, email support@crepesalut.com. We may ask you to confirm your identity, usually by sending a code to your registered mobile number. We respond within one month, and there is no charge unless a request is clearly unfounded or excessive.

If you are unhappy with how we handle your information, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

14. Deleting your account

You can delete your account yourself at any time in the app, under Account > Settings > Account > Delete my account, or by following the steps at crepesalut.com/delete-account, which also explains exactly what is deleted and the few records we must keep. Deletion is immediate and cannot be undone, and any unused stamps are lost.

15. Children

Our services are not aimed at children, and you must be at least 16 to create an account. We don't knowingly collect personal information from anyone younger. If you believe a child has given us their details, email us and we will delete them.

16. Cookies and similar technologies

The website uses a small number of cookies and similar technologies. Our Cookie policy explains each one, which are essential and which you can refuse, and how to change your choice.

17. Links to other sites

Our website and app link to other companies' sites and services, such as Instagram, Google Maps, Shopify's checkout and Faire. Those companies have their own privacy policies, and this policy does not cover them.

18. Changes to this policy

We update this policy when our services or the law change. The date at the foot of this page shows when it was last revised. If a change is significant, we will tell you by email, in the app or on the website before it takes effect.

19. Contact

Crepe Salut Limited (company number 14387230), Unit 1a Chapel Lane, Westcott, Dorking RH4 3PJ. Email support@crepesalut.com.