Bursar & Co Privacy Policy
Bursar & Co is operated by SwitcherMate Ltd (“we”, “us”) — the data controller for the Bursar & Co ordering platform and our mobile app.
1. Ordering as a guest, or signing in
You can order entirely as a guest — no sign-up, no password, nothing stored about you beyond the order itself. You may also choose to sign in, which saves your details for next time and lets you collect loyalty stamps. Signing in is always optional: nothing on the ordering page requires an account, and you can place a full order without one.
2. What we collect when you order
To fulfil an order we collect the details you type at checkout: your name, phone number, optional email, and (for delivery) your address. These are shared with the takeaway you ordered from so they can prepare and deliver your food, and are retained only as long as needed for order handling and legal record-keeping.
3. Payments
Card and wallet payments are processed by our payment provider, Stripe. Your full card details go directly to Stripe and never touch our servers — we receive only a payment confirmation and reference.
4. Order-status notifications
If you allow notifications, we store a push token on your device’s behalf bound to your current order only, so we can tell you when it is ready or on its way. Tokens expire automatically within 24 hours and can be revoked at any time in your device or browser notification settings.
5. Loyalty stamps
Where a takeaway runs a loyalty card, your stamps are keyed to the phone number you give at the counter or checkout — nothing more. Ask the takeaway to remove your number to erase the card.
6. No advertising or tracking
The Bursar & Co app and ordering sites carry no third-party advertising and no cross-site tracking. We use only the data above to run the ordering service. We count how many people view the menu, start a basket and fill in their details, using a code made from your connection details that is discarded at the end of each day. This sets no cookies, stores nothing on your device and is never linked to an order.
7. Offer texts sent for shops
A shop may occasionally text its own online customers about offers, and it may add a number a customer gave it in person and agreed to. Texts go out in the shop’s name between 9am and 8pm UK time, by SMS or RCS, through Twilio. Every text carries an opt-out link; replying STOP also works and applies across every shop on the service. Only the customer can opt back in, by replying START. The list of who can be texted is worked out from recent orders at the moment of sending; the opt-out list holds a coded (hashed) version of the number with the date and shop, and each text sent leaves a record of the coded number, its delivery status and the network’s message reference.
8. AI assistants a shop connects
A shop may connect its own AI assistant, such as ChatGPT, Claude or Grok, to its account. The assistant can then ask for the shop’s business information: counts and totals such as orders, takings, best sellers and busy times, and the shop’s menu and opening hours. It can also prepare menu, banner or opening-hours changes, which only the shop can approve. It never receives a customer’s name, phone number, email, address or allergy and dietary notes. Only if the shop’s owner separately allows it can the assistant also read the text of reviews, shortened and without the reviewer’s name, and that text may include what customers wrote about themselves. This information is sent to the AI provider on the shop’s instruction and under that provider’s own terms, and it may be processed outside the UK. The shop chooses the provider; it is not one of our service providers. The shop can disconnect the assistant at any time. We keep a record of each request the assistant makes (what it asked for, never what it was sent) for 12 months, and the record of the connection for 12 months after it is disconnected.
9. Your rights
Under UK GDPR you may request access to, correction of, or erasure of your personal data. Contact us at [email protected] and include the takeaway name and approximate order time so we can locate the record.
10. Contact
SwitcherMate Ltd, operator of Bursar & Co. Email: [email protected].