Privacy Policy
Last updated: 8 July 2026 · Version: 1.0
1. Who we are
This policy explains how Sleepingmongoose.app Ltd ("PrepShield", "we", "us"), a company registered in Scotland (company no. SC893221, registered office 34 Hunter Grove, Bathgate, EH48 1NW), handles personal data for which we are the controller.
Contact for privacy matters: privacy@prepshield.app.
We are registered with the UK Information Commissioner's Office (ICO), registration reference ZC185426.
2. Scope — what this policy does and does not cover
This policy covers personal data where PrepShield is the controller — principally the personal data of our account holders and their authorised users (the owners, managers and staff who sign up to and use a PrepShield account) and visitors to prepshield.app.
This policy does not cover the staff and employee records that a customer business creates within the PrepShield platform (for example training and sickness records). For that data, the customer (the food business) is the controller and PrepShield is the processor, and our processing is governed by our Data Processing Agreement. If you are a member of staff whose records are held in PrepShield by your employer, please contact your employer, who is responsible for that data.
3. The personal data we collect
- Account and registration data: name, work email address, business/organisation name and details, role, and account settings.
- Billing data: subscription plan and billing records. Card payments are processed by Stripe; we do not store full card details.
- Usage and technical data: IP address, device/browser information, log data, and information collected through essential cookies (see section 7).
- Communications: messages you send us (for example, support requests submitted through the app or via our contact form) and related correspondence.
4. How we use your data, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing, operating and securing the Service; managing your account | Performance of a contract |
| Taking payment and managing subscriptions | Performance of a contract |
| Responding to support enquiries and communicating about the Service | Performance of a contract / legitimate interests |
| Sending operational notifications (for example, out-of-range temperature alerts you have configured) | Performance of a contract / legitimate interests |
| Improving and maintaining the Service; preventing fraud and abuse | Legitimate interests |
| Meeting our legal and regulatory obligations (e.g. accounting) | Legal obligation |
| Sending optional marketing communications | Consent (where required) |
Where we rely on legitimate interests, we have considered that those interests are not overridden by your rights. You may ask us for more detail.
5. Sharing your data
We share personal data only as needed to run the Service:
- Service providers / processors: our hosting, infrastructure and communications providers — currently Supabase (database, authentication and storage, hosted in the United Kingdom), Vercel (application hosting), Stripe (payments), and MXroute (transactional email delivery, United States). They act on our instructions under appropriate contracts. Our DNS is provided by Cloudflare.
- Legal / regulatory: where required by law, regulation or legal process.
- Business transfers: in connection with a merger, acquisition or sale of assets, subject to appropriate protections.
We do not sell your personal data.
6. International transfers
Our primary application data is hosted in the United Kingdom. Some of our service providers may process limited data outside the UK — in particular our payment processor (Stripe) and our transactional email provider (MXroute, United States). Where data is processed outside the UK, we rely on an appropriate safeguard — such as UK adequacy regulations or the UK International Data Transfer Agreement (or the International Data Transfer Addendum to the EU Standard Contractual Clauses) — so that your data receives an equivalent level of protection.
7. Cookies
We use essential cookies only — those necessary to sign you in, keep your session secure, and operate core features of the Service (such as our demo and read-only modes). We do not currently use advertising or non-essential tracking cookies. If this changes, we will update this policy and put in place any consent mechanism required by law.
8. How long we keep your data
We keep account and billing data for as long as you have an account and for a reasonable period afterwards to meet legal, accounting and dispute-handling needs (financial records are generally kept for 6 years). We then delete or anonymise it.
9. Your rights
Subject to conditions in data protection law, you have the right to: access your data; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and withdraw consent where processing is based on consent. To exercise these rights, contact privacy@prepshield.app. We will respond within the time limits set by law.
10. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and per-organisation tenant isolation within the platform. No system is completely secure, but we take reasonable steps to protect your data and to respond to any breach.
11. Marketing
If you have opted in (or where otherwise permitted), we may send you information about PrepShield. You can opt out at any time using the unsubscribe link or by contacting us.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version here and, where changes are significant, notify you.
13. Complaints
If you have concerns about how we handle your personal data, please contact us first at privacy@prepshield.app. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk.
Sleepingmongoose.app Ltd · Registered in Scotland, company no. SC893221 · Registered office: 34 Hunter Grove, Bathgate, EH48 1NW · Trading as PrepShield · ICO registration ZC185426.