PRIVACY POLICY
Last updated: October 2026
This Privacy Policy sets out how the operational portal RVN Culinary Studio ("Portal") handles user data in compliance with UK GDPR and the Data Protection Act 2018.
1. Data Controller
Controller: Peter Raven
Operational Region: Scotland, United Kingdom
Exclusive Data Protection Contact: rvn@superbit.co.uk
2. What data we collect and why
a) Data provided voluntarily via the "Submit Specials Idea" form:
- The name of your personal account, which is attached to the idea automatically (you do not type a name in the form)
- Message content / idea description, title and any diet or category tags you select
- Optional attachments (photos or files)
Ideas can only be sent while you are signed in to a personal account. When an idea is sent, the Data Controller receives a short alert through the notification service ntfy.sh. The alert only says that a new idea has arrived and its category; it does not contain your name, the title or any other details (see section 4).
Purpose: To review, manage, and implement menu ideas and communicate feedback.
Legal Basis: Your consent (Art. 6(1)(a) UK GDPR), which you give by choosing to send an idea. Sending ideas is optional. You can withdraw your consent at any time by emailing us, and we will then delete the idea with its photo and file.
b) Technical data and server logs:
Automatically collected basic transmission data (IP address, browser type, access time) via our hosting provider (OVHcloud).
Purpose: Portal security, preventing spam/abuse, and technical troubleshooting.
Legal Basis: Legitimate interests (Art. 6(1)(f) UK GDPR) in maintaining IT infrastructure security.
c) Anti-abuse (rate-limiting) records:
When you enter a wrong Access PIN or kitchen PIN, sign in, use a recovery code or a one-time link, submit an idea or ask for printing access, the Portal stores a hashed (one-way scrambled) version of your IP address together with the time and type of the attempt (for example PIN, idea or sign-in). This is used only to limit repeated attempts and automated abuse; your plain IP address is not stored in this record and it is not used to identify you or for profiling. Because a hashed IP address can still relate to an individual, we treat it as personal data.
Purpose: Preventing brute-force PIN guessing, spam and abuse of the idea form and the sign-in screens.
Legal Basis: Legitimate interests (Art. 6(1)(f) UK GDPR) in keeping the Portal secure.
d) Personal accounts and passkeys:
Personal accounts are created by the Data Controller. For each account the Portal stores the account name, the role (for example viewer or admin), the account status, the dates of creation and last sign-in and, only if one was recorded, an email address. Accounts sign in with a passkey (WebAuthn) instead of a password: the Portal stores the passkey's public key and credential identifier, the name you gave the passkey, a use counter, whether it is a synced passkey, and the dates it was added and last used. Your fingerprint, face scan, device PIN and the private key never leave your device and are never received by the Portal. The account that administers the Portal also has one-time recovery codes, which are stored only as one-way hashes, and short-lived one-time sign-in links, also stored only as hashes.
Purpose: Giving the right people access to recipes and the idea form, and keeping that access secure.
Legal Basis: Legitimate interests (Art. 6(1)(f) UK GDPR) in running an access-controlled portal and, where you asked for an account, performance of that arrangement (Art. 6(1)(b) UK GDPR).
e) Sign-in sessions, kitchen devices and security log:
While you are signed in, the Portal keeps a session record containing a one-way hash of your sign-in cookie, a hashed version of your IP address, the first part of your browser identifier (user agent) and the times of creation, last use and expiry. A kitchen device that the Data Controller has set up has a record with a label chosen by the Data Controller, a hash of its device cookie and the dates it was enrolled and last used. The Portal also keeps a security log of events such as sign-in, sign-out, passkey added or removed, device enrolled or revoked and kitchen PIN unlock, each with the time, who or what did it, and a hashed IP address.
Purpose: Keeping you signed in, protecting the Portal and investigating misuse.
Legal Basis: Legitimate interests (Art. 6(1)(f) UK GDPR) in keeping the Portal secure.
f) Entrance (Access PIN) sessions and visitor blocks:
The Portal sits behind an entrance screen that asks for an Access PIN. When the correct Access PIN is entered, the Portal stores an entrance session record containing a one-way hash of the entrance cookie, a hashed version of your IP address, the first part of your browser identifier (user agent) and the times of creation, last use and expiry. The Data Controller can see these records (without any plain IP address) in the admin panel, end an entrance session, and block the entrance for a hashed IP address for a chosen time. Such a block stores only the hashed IP address and the start and end time, and affects only the entrance screen.
Purpose: Keeping the Portal limited to the people it is meant for, limiting wrong-PIN guessing and stopping misuse.
Legal Basis: Legitimate interests (Art. 6(1)(f) UK GDPR) in keeping the Portal secure.
g) Printing access and print log:
Printing the Kitchen Sheet is switched on person by person. For each viewer account the Portal stores whether printing is switched on, how many prints are left, how many prints were granted in total and when the last grant was made. Each time a Kitchen Sheet is printed, the Portal records the time, who printed it (your account name, "Kitchen device", or the administrator's name), the dish, the number of portions and whether the print was counted against the prints left. If you ask for printing access, the request is saved in the security log (your account name and the dish you tried to print) and the Data Controller receives a short alert through ntfy.sh that names the dish but not you. These records can be seen by the Data Controller in the administration panel. Your browser also keeps, in Local Storage, the last print-access state it has seen, only so that the "Printing unlocked" message is shown once.
Purpose: Controlling who may print the recipe sheets, counting prints and answering requests for access.
Legal Basis: Legitimate interests (Art. 6(1)(f) UK GDPR) in protecting the Data Controller's recipes and managing access to them.
3. Cookies and Local Storage
This Portal does NOT use advertising, analytics, or tracking cookies (e.g., Google Analytics). We store only essential settings on your device:
- Local Storage (your choices): Remembers your chosen language and view (tiles or list) and whether you have already seen the welcome message and the print-access message, so the Portal opens the way you left it. It never contains passwords or sign-in credentials. You can turn this off at any time with "Remember my choices on this device" in the cookie notice (the "Cookie settings" link at the bottom of the Portal opens it again); the Portal then keeps these choices only until you close the browser.
- Local Storage (cookie notice): Remembers that you closed the cookie notice and your answer to "Remember my choices on this device", so we do not ask again and your choice is respected.
- Session Storage: A temporary note that you unlocked recipes with the kitchen PIN and, if you turned "Remember my choices on this device" off, your choices for this visit; your browser deletes it when you close the tab.
- Entrance cookie (essential): A secure, HTTP-only cookie that remembers that you entered the correct Access PIN, so the entrance screen is not shown again on every visit. It expires 30 days after you enter the PIN, or earlier if the Data Controller ends the session or changes the Access PIN.
- Sign-in cookie (essential): A secure, HTTP-only cookie that keeps you signed in to a personal account. It expires after 30 days without use and in any case 90 days after sign-in, or earlier when you sign out.
- Kitchen PIN session (essential): A secure session cookie that lasts up to 12 hours after you unlock recipes with the kitchen PIN on a kitchen device.
- Kitchen device cookie (essential): A secure, HTTP-only cookie of up to 400 days set only on a device that the Data Controller has enrolled as a kitchen device. It stays until the device is revoked or you clear your cookies.
- Temporary session cookie: A short-lived technical cookie used for the earlier, legacy PIN unlock while it remains switched on.
The cookies above and the cookie-notice record are strictly necessary for the entrance, signing in and security, so they are set without asking for consent. Your Local Storage choices only adapt the Portal to you, and you can object to them at any time as described above. You can clear all of them anytime in your browser settings; clearing the cookies signs you out.
4. Data Sharing
We do not sell your data or share it with third parties for commercial purposes. Access is restricted to the Data Controller and our technical hosting provider (OVHcloud) for infrastructure maintenance and hosting of the Portal's database. The one other service involved is the notification service ntfy.sh (ntfy LLC). It only carries short alerts to the Data Controller's devices, such as "New idea received" or a print access request with the dish name. These alerts contain no personal data: your name, your idea and its photo or file are never sent to it. We do not use any other third-party service that receives personal data from the Portal.
The Portal's server, database and files are hosted by OVHcloud in a data centre in France (EU), under OVHcloud's data processing agreement. UK law recognises EU and EEA countries as providing an adequate level of data protection, so this transfer needs no extra safeguards. If you contact us by email or WhatsApp, your message is also handled by your email or messaging provider under that provider's own policy.
5. Data Retention
- Form submissions (ideas): Kept as long as necessary for menu operations or until deletion is requested.
- Personal accounts and passkeys: Kept while the account exists. When the Data Controller deletes an account, its passkeys, recovery codes, sign-in links and sessions are deleted with it. Ideas that were already sent keep the author name as plain text until you ask for them to be removed.
- Sign-in sessions: Stop working when they expire or when you sign out (personal accounts: after 30 days without use and at most 90 days; kitchen PIN sessions: 12 hours). Expired records are then removed from the database automatically during routine operation.
- Entrance sessions: Stop working after 30 days or when the Data Controller ends them or changes the Access PIN; expired records are removed from the database automatically during routine operation. Entrance blocks (hashed IP address, start and end time) are removed automatically about a day after they end; a block set "until revoked" stays until the Data Controller lifts it.
- Kitchen device records (the label chosen by the Data Controller and the dates): Kept while the Portal runs, also after a device is revoked; a revoked device stops working immediately.
- Security log: Entries older than 90 days are deleted automatically.
- Print log: Entries older than 90 days are deleted automatically. Your print settings (switch and prints left) are kept while the account exists and are deleted with it.
- Server logs: Kept by our hosting provider OVHcloud for the period OVHcloud sets for security and legal reasons, then deleted automatically. We have asked OVHcloud for the exact period and will add it here.
- Anti-abuse records (hashed IP): Automatically deleted on a rolling basis, normally within 24 hours of being recorded.
6. Your Rights
Under UK GDPR, you have the right to access, rectify, erase, restrict processing, object to processing based on legitimate interests, or withdraw consent regarding your data, to ask for a copy of the data we hold about you, and to receive the data you gave us in a portable format (data portability). Withdrawing consent does not affect processing that took place before you withdrew it. Contact us at rvn@superbit.co.uk.
You do not have to give us any personal data, but without a personal account and the security records the Portal cannot let you in, show you recipes or accept your ideas. We do not make decisions with legal or similarly significant effects about you based solely on automated processing; the automatic short lock-out after wrong PINs is only a security measure.
7. Complaints
If you are unhappy with how we handle your personal data, please tell us first by email at rvn@superbit.co.uk, with "Data protection complaint" in the subject line. We will confirm that we have received your complaint within 30 days, look into it and tell you the outcome without undue delay.
You also have the right to complain to the UK supervisory authority, the Information Commission (known as the ICO), at ico.org.uk.
