Privacy Policy

1. Who is responsible for your data?

Kernel is the data controller for personal data processed through the Kernel platform. If you have any questions about how we handle your data, please contact us at support@kernelapp.co.uk.

2. What data we collect

We collect and process the following categories of data:

• Account information: your name, email address, and business name when you register for an account.
• Compliance records: checklists, production records, batch logs, audit trails, goods in/out records, and any other food compliance data you enter into the platform.
• Supplier data: supplier names, contact information, and approval records you add to the system.
• Usage data: log files, IP addresses, device information, and information about how you interact with the platform, used to maintain security and improve the service.
• Payment information: billing details processed securely by our payment provider. We do not store payment card details directly.

3. Lawful basis for processing

We process your data on the following lawful bases under UK GDPR:

• Performance of a contract: processing your account and compliance records is necessary to deliver the Kernel service you have signed up for.
• Legitimate interests: security monitoring, fraud prevention, and service improvement, where these interests are not overridden by your rights.
• Legal obligation: where we are required by law to process or retain data.

4. How we use your data

• Providing, maintaining, and improving the Kernel platform
• Sending service notifications, including missed check alerts you have configured
• Responding to support requests and account queries
• Billing and subscription management
• Complying with legal and regulatory obligations

5. Data retention

We retain your account and compliance data for the duration of your active subscription. Following cancellation or termination, we retain data for up to 6 years in accordance with standard commercial record-keeping requirements under English law. After this period, data is permanently deleted. You may request earlier deletion where we have no legal obligation to retain the data — see Section 8 for your rights.

6. Sub-processors and third parties

We use the following third-party sub-processors to operate the Kernel platform. Each is bound by appropriate data processing agreements:

• Supabase Inc. — database hosting and user authentication. Data is stored within the EU.
• Vercel Inc. — platform hosting and content delivery. Data is processed in the EU/UK.

We do not sell your data to third parties or use it for advertising purposes.

7. International data transfers

Your data is stored and processed within the EU and UK by our sub-processors. Where any transfer outside the UK or EEA is required, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

8. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of your data where we have no legal obligation to retain it.
• Right to restriction: to request that we limit how we use your data in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to processing based on legitimate interests.

To exercise any of these rights, contact us at support@kernelapp.co.uk. We will respond within 30 days.

9. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. We would, however, appreciate the opportunity to address any concerns directly first.

10. Cookies

Kernel uses strictly necessary cookies for authentication and session management only. These cookies are essential for the platform to function and cannot be disabled. We do not use advertising, tracking, or analytics cookies.

11. Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email. The date at the top of this page reflects when the policy was last updated.

12. Contact

For any questions about this Privacy Policy or how we handle your data, please contact: