Cook application privacy notice

1. Controller

OMILY LABS LTD, trading as SupperMarket, is the controller for this recruitment service. Company number 17376796; registered in England and Wales; registered office 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

2. What the application collects

• Account details: name, email, optional phone number and a securely hashed password.
• Application information: intended area, trading setup, eligibility acknowledgements, identity details, council-registration information, training, insurance, kitchen-readiness information and photographs, menu/allergen drafts and planned fulfilment capacity.
• Private evidence you upload to support these requirements, such as identity documents, registration records, certificates and insurance evidence; file-safety, ownership, review and deletion records.
• Consent record: the server-owned terms version and digest accepted, with time of acceptance.
• Support messages you choose to send.
• Limited technical and security information needed to operate and protect the service, such as request and login records.

Only provide the information requested in the private application. Do not put identity or other private evidence in public photo fields or support messages. Bank and payout details, real orders and payment data are not collected for application submission. The platform preview uses sample data and does not save its edits to your account.

3. Why we use it

• To create and secure your requested account and save your private recruitment draft.
• To review your application and supporting evidence, request corrections where needed, and understand where prospective cooks plan to operate.
• To answer support requests and maintain an audit trail of your choices.
• To prevent abuse, diagnose faults and protect applicants and the service.
• To comply with legal obligations and establish, exercise or defend legal claims where necessary.

We use account and application information to take steps you request before a possible agreement and to assess your request to join as a prospective independent food business. We use necessary security, review and audit information for our legitimate interests in protecting applicants and maintaining an accountable review process. Where a legal duty requires processing, we rely on that duty. Acceptance of application terms records your agreement to those terms; it is not blanket consent for unrelated uses. There is no AI eligibility decision or unrelated advertising in this recruitment release.

4. Who receives it

Access is limited to authorised SupperMarket personnel and service providers needed for hosting, database, private file storage, image-safety processing, security and necessary service communication. Private evidence is not a public menu image. Access is restricted to its applicant and authorised review or operational access. We do not share recruitment data with buyers, couriers or payment providers, and we do not sell it. We may disclose data where law requires it.

We use Railway for application hosting, databases and isolated image reconstruction, Cloudflare R2 for private evidence, and Postmark/ActiveCampaign for necessary service email. The current Railway application and database services are in California; image reconstruction processes files there. Evidence objects are stored in a separate EU-jurisdiction R2 bucket. EU object storage does not make all processing EU-only. Authorised staff may access applications from their operating location, including South Korea. Private evidence is not sent as an email attachment. The providers publish processing and transfer terms; applicable contractual safeguards and UK transfer provisions govern restricted transfers. You can request information about the safeguards through privacy@omily.ai.

5. Retention and deletion

A private evidence file expires 90 days after upload, regardless of the later review date. At expiry it cannot be downloaded or used as current supporting evidence. Physical removal is handled by a manual cleanup process checked at least weekly, with failed deletions retried; expiry and physical removal are distinct. You can delete files sooner in the application. Adding a file does not automatically erase earlier files; superseded files cannot be reused, and can be explicitly deleted. A withdrawal alone does not erase your account or files. A deleted file’s minimal review or deletion record may remain.

We keep active application and account data while you participate and review inactive, withdrawn or rejected records quarterly to remove information no longer needed. You may request earlier erasure, subject to lawful exceptions. Account closure removes recruitment and support data and deletes owned evidence before closure completes; a storage failure requires retry. Minimal security and accountability records may remain while needed and are reviewed separately.

Protected maintenance backups, if made, may retain historical information for up to 30 days; restored systems must have subsequent erasures reapplied before recruitment reopens. This service does not claim continuous backups, automatic timed deletion of application records, or immediate deletion from every historical recovery copy.

6. Your rights

Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase, restrict, object and receive a portable copy of personal data. You can export or delete through your account where available, or contact us. You may complain to the UK Information Commissioner’s Office atico.org.uk.

7. Security and contact

We use access controls, encryption in transit, private application records and operational audit controls. Private uploads must be JPEG or PNG images. An isolated, resource-limited process decodes and rebuilds each image, applying its orientation and removing metadata. Only the rebuilt copy is stored and made available for private viewing or download; original uploads are not stored. Rejected or failed processing cannot support an application. This is image reconstruction, not a claim of an antivirus scan or document authenticity. No system is risk-free; upload only the evidence specifically requested in the application. Privacy requests can be sent to privacy@omily.ai or by post to our registered office. See also our cookie notice.