Privacy policy

Last updated: 20 October 2026 · Version 1.4

1. Who we are

Rated5 ("we", "us", "our") is a UK food-safety compliance product operated by BB AI Limited, a company registered in England and Wales under company number 17441545, with its registered office at Astute House, Wilmslow Road, Wilmslow, England, SK9 3HP. We are registered with the Information Commissioner's Office (ICO), registration number ZC239971. The contact point for any privacy query is support@rated5.app.

2. What we collect, and where

On this website (rated5.app), we collect:

  • Contact form submissions: name, email address, and the content of your message.
  • Answers to our "Is Rated5 right for you?" questions on the free trial page: your business type, size, number of premises, how you keep records today, your business name, your name, and your email address. Each answer is saved as you give it, so we keep what you've told us even if you don't finish the questions or go on to sign up. We also record which page and advert brought you to us.
  • Basic, aggregated, cookieless analytics via Cloudflare Web Analytics (see our cookie policy), which collects no personal data.
  • Only if you accept our cookie banner: Google Analytics, Google Ads and Meta Pixel cookies, recording the pages you visit, which advert brought you here, and whether you went on to answer our questions or sign up. We use this to measure our advertising and to show Rated5 ads to people who have visited.

In the Rated5 app (go.rated5.app), once you sign up:

  • Account data: your name, email address, and password (stored as a salted hash, never in plain text).
  • Business data: your premises details, appliances, suppliers, and team roster.
  • Food-safety records: temperature readings, checklist answers, cleaning logs, corrective actions, training records, and documents your business creates in the course of using the app. Where these records include the names of your staff (for example, who recorded a reading, or who signed off a safe method), we process that data as a data processor on your business's behalf. Your business is the data controller for its own operational records, and we are the controller only for account-level data (your own login, billing, and support communications).

3. Payment information

Card details never touch Rated5's servers. Payments are handled entirely by Stripe, our payment processor. We only ever store the card brand, last four digits, and expiry month/year, purely for display purposes (for example, "Visa ending 4242").

4. Lawful bases for processing

  • Contract: account data and food-safety records, to provide the service you've signed up for.
  • Legitimate interests: responding to contact form enquiries; understanding how people find and use the free trial page, and following up with someone who has asked about Rated5 through our questions; keeping the site and app secure and functioning.
  • Consent: sending you food-safety tips and Rated5 updates by email, only if you tick the box to ask for them. You can withdraw consent at any time using the unsubscribe link in any email or by contacting us.
  • Consent: analytics and advertising cookies (Google Analytics, Google Ads, Meta Pixel), only if you accept the cookie banner. You can change your choice at any time from our cookies page.
  • Legal obligation: where retaining certain records helps demonstrate compliance with food-safety law (this is your business's obligation as the data controller for those records; Rated5 supports it by keeping records intact and exportable).

5. Retention

Answers to the free trial page questions are kept for 12 months from your last answer if you don't sign up, then deleted automatically. If you do sign up, they become part of your account data.

Food-safety records in the app are never automatically deleted while a subscription is active: the whole point of the product is a permanent, unfalsifiable diary. If a subscription lapses or is cancelled, the account moves to a paused, read-only state: for 12 months, the account owner keeps the ability to log in and export a full copy of every record, but no other role can log in and no new records can be created. Records are not automatically deleted after that 12-month window either; retention beyond it is reviewed on a case-by-case basis, and we'll contact the account owner before any data is permanently removed. If you'd like your data removed sooner, contact us at the address above and we'll handle it manually.

6. Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Have inaccurate data corrected
  • Request erasure of your data, subject to our legal obligations
  • Object to or restrict certain processing
  • Receive your data in a portable format (the app's own export features cover most of this directly)

To exercise any of these rights, email support@rated5.app. If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

7. Sub-processors

We use the following sub-processors to run Rated5:

  • Railway: application hosting.
  • Cloudflare (including R2 object storage): content delivery, DNS, and file storage for photos, documents, and signatures.
  • Brevo: transactional email (invites, password resets, reminders, notifications).
  • Stripe: payment processing and card storage.
  • Google (Analytics and Ads) and Meta (Meta Pixel): website and app analytics and advertising measurement, only where you've accepted cookies.

Each of these providers may process data outside the UK; each maintains its own UK/EU data transfer safeguards (such as Standard Contractual Clauses) as part of their standard terms of service. We choose providers with credible security and compliance commitments, and review this list as our sub-processors change.

8. Security

Passwords are stored as salted hashes, never in plain text. Sessions use secure, httpOnly cookies. Food-safety records are immutable once written: nothing is silently edited or deleted, which is both a product feature and a security property.

9. Changes to this policy

We'll update the "last updated" date above whenever this policy changes, and post material changes here.