Privacy policy
What Pubbit collects, why, who else sees it, how long it's kept, and your rights.
Who we are
Pubbit is run by PUBBIT LTD, a company registered in England and Wales under company number 17510943, registered office 128 City Road, London, EC1V 2NX.
ICO registration number: [to be added]
For anything about your data, email help@pubbit.co.uk.
Pubbit is an AI marketing team for pubs, bars, cafés, restaurants and other venues: their websites, posts, newsletters, posters and Google. So we handle two kinds of information: about the businesses that use Pubbit and their teams, and about the people who use those venues' websites. This page covers both.
If you use a venue's website
Each venue's website is run by that venue using Pubbit. When you join its list, message it, share photos, buy tickets or join a group booking, the venue is responsible for your details (the controller) and Pubbit looks after them on its behalf (the processor). We only use them to do what the venue asks, never for our own marketing, and we never sell them. To ask about your details, contact the venue, or email us and we'll pass it on and help.
Joining a venue's list
We keep your first name, email, mobile if you give it, which messages you ticked to get (email, texts or neither), the exact words you agreed to and when, and when you confirmed your email. You have to be 18 or over.
- Joining opens the venue's photo gallery whatever you tick. You'll only be emailed or texted if you ticked to be, and new members confirm their email first.
- Every email and text has a way to stop them, and unsubscribing is one tap. We keep a note that you unsubscribed so you aren't messaged again.
- If an email bounces or is marked as spam, we stop sending to that address.
- The venue's account holders can see and download the list. Other staff at the venue see contact details partly hidden.
- Newsletter links carry a marker so the venue can count how many visits came from its newsletter. We don't track whether you opened an email, or who clicked what.
Sending a venue a message
What you type in "Send a message" (or a function room enquiry) goes to the venue by email, so they can reply to you directly. Pubbit doesn't keep a copy or add you to any list.
Asking a question on a venue's site
If a venue's site answers questions, what you type is answered from the venue's own details, sometimes with the help of an AI service (Anthropic's Claude). We keep the question for 30 days, with any phone numbers or emails taken out, so the venue can add the answer to its FAQs. We don't keep who asked.
Sharing photos
Photos you share from a venue's QR code page are stored by Pubbit for that venue and shown only to people on its list, in its gallery. There's a box, unticked to start, to say you're happy for the venue to share your photo on its website and social media; only if you tick it can it be used there, and we keep that you ticked it and when. The venue may check photos before they appear, and can remove them. To have one taken down, ask the venue or email us.
Buying tickets
Payment goes through Stripe, straight to the venue: Pubbit never sees your card details. We keep your name, what you bought and the amount, so the venue knows who's coming. Stripe's own privacy policy covers what it collects.
Group bookings
If you're in a group booking at a venue, we keep the name you give and your food choices (and any note you add) so the kitchen can prepare. The organiser's name and mobile are kept so we can remind them by text before choices close. Everything about a group booking is deleted 30 days after the day.
Today's word
If you play the word game on a venue's QR code page, your browser keeps a random code so you can carry on and play once a day. If you put a name on the venue's weekly board, other players see it, so use a nickname if you'd rather.
Visiting a venue's site
We count visits to help venues see how their site is doing, without cookies and without knowing who you are. To count each person once a day, we make a one-way code from your internet address and browser, mixed with a secret and that day's date; it can't be turned back into your address or linked across days or venues, and it's deleted after 60 days. We also count taps on buttons such as Call and Directions, as numbers only. Visit counts are kept as totals by hour and day.
Booking a table, directions and messaging apps open other companies' services (for example the venue's booking provider, Google Maps or WhatsApp), which have their own privacy policies.
If you run a venue on Pubbit
For the businesses that use Pubbit and their teams, Pubbit is responsible for your details (the controller).
- Your login: your name, email, mobile if you add it, your role at each venue, and a securely scrambled password (we can't read it), or the Google, Apple or Microsoft account you sign in with.
- Signing up and billing: your business name, venue details and address, and your subscriptions. Card payments are handled by Stripe; we never see your full card number.
- A sign-up you haven't finished: once you've typed your email, what you've filled in so far is saved (never your password or photo), so you can carry on from a link. If you stop part way, we send one email with that link, about a day later.
- Using Pubbit: your venue's content and photos, a record of changes (who changed what, and when, so mistakes can be traced and undone), what you ask Pubbit, support requests and our replies. Pubbit's team also keeps short notes from what you tell it (such as "Sam is the chef" or "no posts on Sundays") so it remembers how you like things; never phone numbers, emails or card details. Say "forget that" and it goes.
- WhatsApp: if you link your WhatsApp, we keep your WhatsApp number linked to your login, and the latest conversation so Pubbit can follow it (a fresh one starts after a few hours' quiet). Voice notes are turned into words and not kept. Send STOP, or unlink it from Your account, to remove the link.
- Updates by email or text: where switched on, a change you email or text to Pubbit is matched to your account and kept for three days while you check it.
- Facebook and Instagram: if you connect them, we keep the Page and Instagram account you chose and the key Meta gives us to post for you, encrypted. Disconnecting deletes the key and asks Meta to withdraw Pubbit's permission.
- Your till: if you connect Square or Epos Now, we keep its keys, encrypted, and your sales as totals for each item by hour and day: never a single sale, a customer or a card. Only account holders, admins and managers at the venue see them.
- Messages from us: emails about your account, billing and security, texts about missed payments if you've given a mobile, and, if you use them, WhatsApp messages and a Monday round-up. Your weekly and monthly emails from Pubbit can be turned off from a link in each one. We don't send you marketing unless you've asked for it.
- If we visited you: if someone from Pubbit has talked to you about Pubbit, we keep notes about your venue, and your name and contact details only if you said we could get in touch.
Why we use it, and the law we rely on
- To provide Pubbit to your business (accounts, sites, posts, newsletters, billing, support): our contract with your business, or our legitimate interest in serving the business you work for.
- To keep Pubbit secure and working, and improve it (sign-in checks, change records, error reports, counting what's used): our legitimate interests.
- To keep financial records: the law requires it.
- For venues' customers: we act on the venue's instructions as its processor; the venue decides its own lawful basis, which for marketing emails and texts is your consent.
- Contacting someone we visited: their consent, which they can withdraw at any time.
We don't make decisions about people that have legal or similarly significant effects by automated means alone.
Services we use
We use a small number of trusted companies to run Pubbit. Each only gets what it needs for its job, under a contract that protects your data:
Some of these companies are based in the United States or process data there. Where data leaves the UK, it's protected by the UK's approved safeguards, such as the UK–US data bridge or the UK's international data transfer agreement.
How long we keep things
- A venue's site, photos and list: while it uses Pubbit. After its subscription ends or a payment is missed, the site is paused, and everything is deleted 90 days later unless it's restarted. We keep a record of the venue, its people, its support requests and its change history, so accounts and billing add up.
- List members: until you leave the list or the venue removes you. A note that you unsubscribed is kept so you aren't messaged again.
- Messages to a venue: not kept.
- Questions asked on a venue's site: 30 days, never who asked.
- Group bookings: 30 days after the day.
- Visit counts: the daily visitor codes go after 60 days; the counts themselves are kept as totals.
- A sign-up you haven't finished: 14 days from when you last changed it, or until you sign up, whichever comes first.
- Updates emailed or texted to Pubbit: three days.
- WhatsApp, Facebook, Instagram and till connections: until they're unlinked or disconnected.
- Till sales totals after a venue leaves Pubbit (removed, or a new owner): kept so we can learn what helps venues sell more, but no longer linked to the venue, its name or its owner. They're totals by item, hour and day with that day's weather, never a single sale, a customer or a card.
- Error reports: 90 days.
- Backups: a copy of the database is made every day and kept for 35 days, then deleted.
- Billing records: six years (by us and Stripe), as the law requires.
Keeping it safe
Everything travels encrypted. Passwords are scrambled so nobody can read them, and the keys for a venue's till and Facebook Page are stored encrypted. Everything someone can change is checked against their role on our servers, and Pubbit staff sign in with Pubbit's own Google accounts. Only the people who need to see your data can, and anything a Pubbit staff member does on a venue's behalf is logged.
Your rights
You can ask to see the data held about you, have it corrected or deleted, have its use restricted, take a copy with you, or object to how it's used. Where we rely on your consent, you can withdraw it at any time. Email help@pubbit.co.uk and we'll reply within one month (or tell you within that month if a complicated request needs up to two months more). We may need to check who you are first.
If it's about a venue's list or anything else a venue is responsible for, we'll pass it to the venue and help them sort it out.
Children
Pubbit is for businesses, and you have to be 18 or over to join a venue's list. We don't knowingly collect children's details. If you think a child has given us theirs, or a photo shared to a gallery shouldn't be there, email us and we'll deal with it.
Changes
If we change how we use your data, we'll update this page and, if it matters to you, tell you before it applies.
Complaints
If you're not happy with how your data has been handled, please tell us first at help@pubbit.co.uk and we'll try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.