Privacy
SS Cosiness is run by [YOUR TRADING NAME], a sole trader in London, UK (the "we" below). This page says what we keep, why, and how to get it removed. It is written to meet UK GDPR and the Data Protection Act 2018.
What we keep
- Your account: your email address and sign-in links.
- Your family: first names, ages, colours, allergies, foods people avoid or like, sport days and the notes you write. We ask for first names only. Allergy information is special category data under UK GDPR; you give it to us so that we can leave those ingredients out, and you can delete it at any time.
- Your plans: weekly menus, shopping lists, calendar events and tasks, and the text we read from the letters you send us. The photo of a letter is used to read it and is not stored afterwards.
- Payments: handled by Stripe. We see your plan, the status of your subscription and the last four digits of your card. We never see your full card number.
- Technical: server logs with IP address and time, kept for 30 days for security.
Why we keep it
To run the service you pay for (contract), to keep it secure (legitimate interest), and, for allergies, because you explicitly ask us to use that information (consent, which you can withdraw by deleting it).
Where it lives
Your data is stored in the United Kingdom (London) with [Supabase / hosting provider]. To plan menus and read letters we send the relevant details to Anthropic's Claude API under Anthropic's data processing terms, with the UK's safeguards for international transfers. We never send names: people appear as "Person 1", "Person 2" with their ages and food notes, plus the text of the letter you upload. Medicines are never sent to AI. Nothing is used to train AI models.
Who else sees it
Stripe (payments), [Resend] (sign-in emails) and the hosting and AI providers above, each under a data processing agreement. We do not sell data and we show no advertising.
Children
The account belongs to a parent or carer. Children's details are entered by that adult and managed by them. We never contact children directly.
How long
For as long as your family account is active, then 90 days in backups. Delete your account and the data goes with it.
Your rights
You can export everything from Family → Export my data, and you can ask us to correct or delete anything by emailing [hello@yourdomain] from your account address. We reply within 30 days. You can complain to the ICO at ico.org.uk.
Cookies
One cookie keeps you signed in. No tracking cookies, no analytics that follow you across sites.
Contact
[YOUR TRADING NAME], [postal address], [hello@yourdomain]. ICO registration [number].