Privacy Policy

CakeIQ is provided by TECH LCA LTD(company number 15682096), registered at 9 Oxford Court, Manchester, M2 3WQ (“CakeIQ”, “we”, “us”). This policy explains how we handle personal data when you use CakeIQ, our order-management platform for bakeries and cake decorators.

CakeIQ sits in two different roles, and it matters which one applies:

• As controller — for the personal data of the bakery account holder and their staff (names, logins, billing details, support requests), and for our own website and business communications. This policy covers that data in full.
• As processor— for the personal data a subscribing bakery enters about its own customers (order details, contact information, delivery addresses) to run its business through CakeIQ. There, the bakery is the data controller and decides how that data is used; we process it only on the bakery’s instructions, under the terms of our Data Processing Agreementwith that bakery. If you are a customer of a bakery that uses CakeIQ, please contact that bakery directly about your data — see “If you’re a bakery’s customer” below.

Depending on how you interact with CakeIQ, we collect:

• Account & staff data: name, email address, phone number, role/permissions, hashed password, and branch assignment for anyone who logs into a CakeIQ account.
• Billing data: billing name, email, and subscription details. Card payments for your CakeIQ subscription are handled directly by our payment processor, Stripe — we do not store full card numbers ourselves.
• Customer & order data (processed on a bakery’s behalf): names, contact details, delivery addresses, order specifications, reference photos, and signatures that bakery staff enter to manage orders.
• Usage & technical data: log data, device/browser information, and essential session cookies needed to keep you securely logged in.
• Communications: support requests and other messages you send us.

• To provide, operate, and secure the CakeIQ service — necessary to perform our contract with you.
• To process subscription billing and comply with tax and accounting obligations — contract and legal obligation.
• To send account, order, and service notifications (e.g. order confirmations, password resets) — necessary to perform our contract.
• To provide customer support and respond to enquiries — contract and our legitimate interests.
• To maintain security, prevent fraud, and monitor for technical issues — our legitimate interests.
• To improve CakeIQ’s features and reliability — our legitimate interests.
• To send lifecycle marketing emails on a bakery’s behalf to that bakery’s own customers, only where the bakery has enabled this and holds the appropriate marketing permission — the bakery’s instruction, under our Data Processing Agreement.
• To comply with our legal obligations, including responding to lawful requests from authorities.

We do not sell personal data, and we do not use a bakery’s customer data to independently market CakeIQ or third-party products to that bakery’s customers.

Where a bakery switches on lifecycle marketing (for example, order-anniversary or re-order reminders), those messages are sent on that bakery’s instruction and under its responsibility for holding a lawful basis or marketing permission. Every marketing message includes an unsubscribe link; we record unsubscribe requests and keep a minimal suppression record only to avoid accidental re-contact.

We share personal data only with service providers who help us run CakeIQ, under contracts that protect that data, and only to the extent needed to provide the service:

• Vercel — hosts the CakeIQ web application.
• Railway — hosts our application servers and database.
• Stripe — processes CakeIQ subscription payments.
• Resend — delivers transactional and lifecycle emails on our behalf.
• Google (Places API) — powers delivery-address autocomplete when staff enter an order.

We may also disclose personal data where required by law, to protect our rights, or in connection with a business transfer such as a merger or acquisition. We do not sell personal data to third parties.

Some of our service providers may process or store data outside the UK. Where that happens, we rely on UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another legally permitted safeguard, and we require those providers to maintain appropriate protections for personal data.

• Encrypted connections (HTTPS/TLS) for all access to the service.
• Secure, httpOnly session cookies using signed tokens, and passwords stored using bcrypt hashing — we never store passwords in plain text.
• Role-based access controls, so staff only see the data relevant to their role and branch.
• Managed hosting infrastructure (Vercel, Railway) with provider-level security controls and logical separation between bakeries’ data.
• Regular backups, dependency and vulnerability monitoring, and incident-response procedures.

We keep personal data for as long as your account is active. If a subscription ends, the account normally enters a 30-day export/reactivation window, during which outbound customer communications are disabled. After that window, we delete data from our active systems, and residual backup copies are removed through our scheduled backup cycle, normally within 90 days — unless we’re required to keep it for longer to meet a legal obligation or to resolve a dispute.

Under UK data protection law, you have the right to:

• ask us for a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data, in certain circumstances;
• ask us to restrict or object to certain processing;
• ask us to provide your data in a portable format; and
• withdraw consent, where processing is based on consent.

To exercise any of these rights over data we hold as controller, contact us at info@techlca.com. If your request concerns data held by a bakery that uses CakeIQ (for example, your own order history with that bakery), please contact that bakery directly — we’ll support them in responding. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

CakeIQ currently uses only essential cookies — for example, the secure session cookie that keeps you logged in, and cookies needed to support installing CakeIQ as an app on your device. We don’t currently use third-party advertising or analytics cookies. If that changes, we’ll update this policy and, where required, ask for your consent first.

CakeIQ is a business tool intended for use by bakery owners and staff, and is not directed at children. Bakeries are responsible for the age and consent status of their own customers whose data they enter into the platform.

If you’ve placed an order with a bakery that uses CakeIQ, that bakery is the controller of your personal data — they decide what’s collected and why, and they’re responsible for giving you their own privacy notice. CakeIQ processes that data only to provide the service to the bakery, under our Data Processing Agreement, and we don’t use it for our own purposes. Please direct any requests about your data to the bakery you ordered from.

We may update this policy from time to time, for example to reflect changes in the law or in how CakeIQ works. We’ll update the “last updated” date above, and where a change is material, we’ll take reasonable steps to let account holders know.

TECH LCA LTD, 9 Oxford Court, Manchester, M2 3WQ, United Kingdom
Email: info@techlca.com
Read our Data Processing Agreement and Customer Data Protection Commitment for how we handle data on behalf of subscribing bakeries.