This policy explains how MHD Inc. Ltd ("Brevona", "we", "us") handles personal data when you visit brevona.com, use the Brevona app, or order from or join the loyalty programme of a Store that uses Brevona.
1. Our role
- We are the controller of the data of the businesses that use Brevona and their Staff (account, billing and usage data), and of visitors to our website.
- We are a processor for the data a Store collects about its own Guests (for example orders, names and phone numbers given for WhatsApp orders, and loyalty card members). The Store is the controller of that data and decides how it is used; our Data Processing Agreement sets out how we process it. If you are a Guest, please contact the Store first; we will help the Store answer your request.
2. Data we collect
When you create and use an account
- Account details: name, username, email address, phone number (if you add it), password (stored only as a secure hash), language and app preferences.
- Sign-in with Google, Apple or Facebook: the name, email address and account identifier the provider shares with us.
- Business details: Store names, addresses, logos, menus, prices, tables, opening hours, currency and settings, and the names and emails of the Staff you invite.
- Billing: plan, invoices, payment status and the identifiers Stripe gives us. Card details are collected and stored by Stripe, not by us.
- Sign-in and security records: IP address, approximate location derived from it (country and city), browser, device type, operating system and the date and time of sign-ups and sign-ins. We use these to protect accounts and detect misuse.
- Support: messages you send us by email or WhatsApp.
Data Stores collect about Guests (we process it for the Store)
- Orders: items, quantities, notes, table, order number, totals, time, and the name or phone number a Guest enters for a WhatsApp or pickup order.
- Loyalty members: name, phone number or email (as the Store asks), membership number, stamps, points, visits and rewards, and wallet pass identifiers if the Guest adds the card to Apple Wallet or Google Wallet.
Guests can view a menu without giving any personal data.
When you visit our website
- Technical data needed to deliver the pages (IP address, browser, pages requested), handled by our hosting and security providers.
- If you accept analytics cookies: how you use the site, through Google Analytics. See our Cookie Policy.
- Campaign tags in links (such as utm_source) so we know which advertising works.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing the Service: accounts, Stores, menus, orders, POS, loyalty, wallet passes | Contract with you |
| Billing, invoices and collecting payments | Contract; legal obligation (tax and accounting) |
| Service emails: verification, password reset, receipts, renewal and security notices | Contract; legitimate interests |
| Security, fraud and abuse prevention, debugging | Legitimate interests (keeping the Service and its users safe) |
| Support | Contract; legitimate interests |
| Improving the Service using aggregated usage information | Legitimate interests |
| Website analytics | Consent (you can withdraw it at any time) |
| News about Brevona to existing customers | Legitimate interests; you can unsubscribe from any such email |
| Processing Guest data on behalf of Stores | The Store's instructions under our Terms of Use |
We do not sell personal data, and we do not use Guest data for our own marketing.
4. Who we share it with
We use carefully chosen service providers ("sub-processors") who handle data only on our instructions:
| Provider | What for |
|---|---|
| Our hosting provider | Servers and databases that run Brevona |
| Cloudflare | Content delivery, protection against attacks |
| Stripe | Payments, subscriptions and invoices |
| Mailtrap | Sending service emails |
| Analytics (with consent), Google sign-in, Google Wallet passes, maps | |
| Apple | Sign in with Apple, Apple Wallet passes |
| Meta | Facebook sign-in; WhatsApp, when you or a Guest choose to send a message |
| Rollbar | Error monitoring, so we can fix problems quickly |
We may also share data:
- within a Store: Staff and owners of a Store can see that Store's data, according to the roles the owner gives them;
- with professional advisers, such as accountants and lawyers;
- when required by law, or to protect rights, property or safety;
- with a buyer or successor if our business is sold or merged, under this policy.
5. International transfers
Our providers may process data outside your country, including in the United States. Where data from the UK, the European Economic Area or other countries with transfer rules leaves those regions, we rely on adequacy decisions or on standard contractual clauses (including the UK addendum) or equivalent safeguards.
6. How long we keep it
- Account and Store data: while your account is open.
- After you delete your account: it is deactivated straight away and its subscriptions are cancelled. We keep the data for up to 90 days so that an accidental deletion can be undone, then delete or anonymise it. You can ask us to erase it sooner.
- Billing records: for as long as tax and accounting laws require (usually six years).
- Sign-in and security records: up to 12 months.
- Guest data: for as long as the Store keeps it in its account, and deleted with the Store's account as above. Stores can delete loyalty members and Guest details at any time.
- Backups are overwritten on a rolling basis.
7. Security
We protect data with encrypted connections (HTTPS), hashed passwords, access controls that limit each user to their own Stores, and restricted access to our servers. No system is completely secure; if a personal data breach affects you, we will tell you and the authorities where the law requires.
8. Your rights
Depending on where you live (for example under the UK GDPR, the EU GDPR or similar laws), you may have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- have your data erased;
- restrict or object to some uses, including direct marketing;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To use these rights, email support@brevona.com. We will reply within one month and may ask you to confirm your identity. You can also complain to your data protection authority; in the UK this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to deal with your concern first.
9. Children
Accounts are for businesses and people aged 18 or over. Stores must not knowingly use Brevona to collect data from children where the law requires parental consent, without that consent.
10. Changes
We will publish any changes on this page with a new "last updated" date, and tell account holders by email or in the app about important changes.
11. Contact
MHD Inc. Ltd, trading as Brevona. Email: support@brevona.com. WhatsApp: +44 7537 105400.