Privacy Policy

1. Introduction

STM FoodHub is a restaurant technology brand operated by S T M CONSULTANCY LIMITED, the data controller responsible for personal information it processes in connection with this website. This policy covers the informational website, its fictional software demonstrations and correspondence you choose to send to us.

The platform is under development. Merchant enquiry registration is not open. No production merchant or customer accounts, live orders, live reservations, payment processing or paid subscriptions are available. Future services will require their own appropriate privacy information.

2. Personal information we collect

There is no working enquiry form on this website. It does not collect names, business details, email addresses, telephone numbers or messages through a form. Demonstration restaurant records are fictional; changes remain in the demonstration session and are not submitted as real transactions or saved to a production database.

If you independently email or telephone us, your correspondence may include your name, contact details, business information and message contents. Please provide only information relevant to your request and do not send payment details or unnecessary sensitive personal information.

Serving the website involves processing network request information, such as an IP address, requested resource and browser information, by hosting, security and font services. Security cookies are described in our Cookie Policy. This is distinct from Lovable’s analytics, which does not retain IP addresses.

Lovable visitor analytics records pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors and clicks on buttons and links. Clicks are identified by their location on the page, not their text. With no consent banner connected on this website, clicks and the other listed information are recorded for every visitor.

Page visits, time on page, page speed and errors are recorded for every visitor, without cookies and without identifying anyone. Lovable’s analytics uses no cookies, stores nothing on the visitor’s device, does not keep IP addresses and does not identify visitors or recognise returning visitors. Detailed data is kept for 90 days and daily summaries for a year.

Lovable collects this data for us. Lovable’s privacy policy explains how it handles it. These statements describe Lovable analytics, not all hosting, security or third-party processing on this website.

3. Purposes of processing

Relevant purposes are delivering website pages and fonts, maintaining availability, investigating technical problems, preventing abusive traffic and understanding website performance. Where you contact us, we use the information you provide to consider and respond to that correspondence. Information may also be needed to comply with an applicable legal requirement or to address a legal claim.

We do not use the demonstration to fulfil orders, book tables, create merchant accounts or take payments.

4. Lawful bases for processing

For personal information used to deliver and secure the website, the relevant basis is legitimate interests: operating an available website and protecting it against abuse. For ordinary business correspondence, the relevant interest is understanding and answering the request and keeping an appropriate record of the exchange, balanced against the individual’s rights.

Where correspondence involves steps you ask us to take before a contract with you personally, the basis may instead be taking steps at your request before entering a contract. This does not mean a merchant subscription contract is currently available. Where a specific law requires processing, the basis is compliance with that legal obligation.

Consent is relevant where the law requires it for a particular activity, rather than being a blanket basis for all processing. This website has no marketing signup or optional-cookie consent mechanism. Cookie-free, non-identifying visitor statistics are described separately above; their presence does not mean all other processing is anonymous.

5. Sharing information

Lovable supplies the published website hosting and visitor analytics. Cloudflare security technology was observed on the published site. Google receives requests for Google Fonts from fonts.googleapis.com and fonts.gstatic.com. These services receive the information needed to serve their respective requests; their handling is also described in their own privacy information.

See Lovable, Cloudflare and Google privacy policies. No application database, authentication service or form-delivery email service is connected to this website. These observations do not identify the provider of the company’s separately operated email or telephone service.

Information may be disclosed where required by law or where necessary to establish, exercise or defend legal rights. No personal-data sale or advertising audience integration is implemented on the website.

6. International data transfers

Website infrastructure, security and font providers operate internationally, so requests may be processed outside the United Kingdom. Cloudflare’s documentation states that cookie data may, by default, be processed in the United States. The observed site configuration does not establish the processing location for every request.

This policy does not assert a particular data-localisation arrangement, adequacy decision, contractual safeguard or transfer assessment for the company. You may contact us for information about a transfer relevant to your personal information and any applicable safeguards.

7. Data retention

Lovable retains detailed visitor analytics for 90 days and daily summaries for one year. Cloudflare documents the __cf_bm security cookie as expiring after 30 minutes of continuous inactivity. An additional hosting cookie, __dpl, was observed with an expiry approximately one day after the visit; this is an observation, not a verified maximum lifetime.

No enquiry records are collected by this website and there is no form-record retention process. This website does not implement a retention schedule for independently received correspondence or provider-operated security and technical logs; the analytics periods must not be treated as their retention periods.

Relevant considerations for correspondence are the purpose and progress of the exchange, any applicable statutory requirement and the need to address a dispute. Contact us to ask about a particular record or make a deletion request; no fixed deletion period or automated deletion process is represented here.

8. Data security

The published website is served over HTTPS. Hosting security cookies were observed, including Cloudflare bot protection. Demonstration controls do not send fictional restaurant records to a production data service.

No method of transmission can be guaranteed completely secure. Do not send confidential credentials through ordinary correspondence. We do not claim independent security certification, a completed security audit or a particular organisational control that has not been verified.

9. Individual rights

Depending on the circumstances and subject to UK GDPR conditions, you may have rights of access, rectification, erasure, restriction, objection and data portability. Where processing is based on consent, you may withdraw consent without affecting the lawfulness of earlier processing. You may object to processing based on legitimate interests, subject to the applicable exceptions.

Send requests to support@stmfoodhub.com. Describe your request and the information concerned. We may need proportionate information to confirm identity before disclosing personal data. Non-identifying visitor statistics may not allow a visit to be associated with a particular person; please do not send extra sensitive information merely to identify an analytics visit.

10. Complaints

You may contact us first about a privacy concern, but you are not required to do so before complaining to the UK Information Commissioner’s Office. Information about the right to complain is available at ico.org.uk.

11. Children’s information

The website is intended for a business audience, not directed at children, and has no child registration or age-verification feature. Please do not send children’s personal information through business correspondence. If you believe such information has been provided, contact us so that the matter can be considered.

12. Cookies and similar technologies

Cookie-free Lovable analytics is separate from hosting security cookies and Google Fonts network requests. The observed cookies and available browser controls are described in the Cookie Policy.

13. Policy changes

Updated versions will be made available on this page with a revised last-updated date. Where a change materially affects personal information and the law requires a further notice, the appropriate notice will be provided. Check this page when using the site; this version does not cover unlaunched merchant services.

14. Contact details

Data Controller: S T M CONSULTANCY LIMITED. Privacy enquiries may be sent using the following operator-supplied details.