Privacy Policy

Privacy Policy

Last updated: 28 October 2026

This privacy policy explains how personal data is collected, used and protected when you use the Business In A Box website at demo.thebusinessinabox.co.uk and the following mobile apps:

• BIAB Buyer (Android package com.app.biab.buyer): the customer app for ordering food and booking tables.
• BIAB Merchant (Android package com.app.biab.merchant): the restaurant app for managing orders, menus and bookings.
• BIAB Delivery (Android package com.app.biab.delivery): the driver app for accepting and completing deliveries.

The same apps are also available for iPhone under the same names.

1. Who we are

The apps are published on Google Play by JDC Digital, the developer named on their Google Play store listings, on behalf of SCIAC LTD, trading as Business In A Box.

SCIAC LTD is the data controller for the personal data described in this policy. SCIAC LTD is a company registered in England and Wales (company number 17211842). Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE, United Kingdom.

In this policy, “we”, “us” and “our” mean SCIAC LTD (Business In A Box) and JDC Digital acting for it.

Contact: info@thebusinessinabox.co.uk, phone +44 7356 264859, website thebusinessinabox.co.uk.

2. About this service

This website and the apps are connected to a demonstration marketplace with sample restaurants and menus, so that people can try the Business In A Box ordering platform. Orders placed in the demonstration marketplace are not prepared, paid for or delivered, and the marketplace is reset to its starting state regularly, which removes accounts and orders created since the last reset.

3. What we collect

All apps and the website

• Account details: name, email address, phone number, password (stored only in hashed form) and a user ID.
• Device and notification data: a push notification token, device type and app version, so we can send order and account notifications.
• Crash logs and diagnostics, through Firebase Crashlytics, to find and fix faults.

BIAB Buyer and the website

• Delivery addresses you save, and your order history, favourites, table bookings and reward points.
• Location: with your permission, your precise or approximate location to find nearby restaurants and to pick a delivery address on the map. The app works without it if you enter an address yourself.
• Photos: a profile picture, only if you choose to add one from your camera or gallery.
• Reviews you write about restaurants. Reviews are shown publicly with your name.
• Searches you make in the app, to show results.
• Payment information: card payments are entered on the payment provider’s page (for example Stripe). We do not see or store your full card number. We keep a record of the payment status and amount for each order.
• Usage data: how the app is used (for example screens opened), through Firebase Analytics, and app events (installs, app opens, device information and viewing an order summary) through the Meta (Facebook) SDK, which also provides Sign in with Facebook.
• If you choose Sign in with Google or Sign in with Facebook, we receive your name, email address and account ID from that service.

BIAB Merchant

• Restaurant account and business details.
• Bank account or PayPal details that you enter to request a withdrawal of the restaurant’s earnings.
• Bluetooth is used only to connect to a receipt printer. No data about nearby devices is stored.
• The app shows customers’ names, phone numbers and delivery addresses on their orders so the restaurant can fulfil them.

BIAB Delivery

• Profile details and a profile photo, if you add one.
• Location, including in the background: while you are online and working, the app collects your precise location, also when the app is closed or not in use, so that you can be offered nearby orders and the restaurant and customer can follow the delivery. Location is collected only while you are online, and stops when you go offline.
• Your completed deliveries and wallet balance.
• The app shows customers’ names, phone numbers and delivery addresses for the orders you accept.

4. How we use your data

• To create and manage your account and let you sign in.
• To take, process and track orders and table bookings between customers, restaurants and drivers.
• To send notifications about orders, bookings and your account.
• To process payments and withdrawals.
• To keep the service secure, prevent fraud and fix faults.
• To understand how the apps are used so we can improve them.

Our legal bases under UK GDPR are: performing our contract with you (running your account and orders), our legitimate interests (security, fixing faults and improving the service), your consent (location, camera and photo access, and optional analytics where consent is required), and legal obligations (for example keeping financial records).

5. Who we share data with

We do not sell your personal data. We share it only where needed to run the service:

• Within an order: the restaurant receives the customer’s name, phone number, address and order; the driver receives what is needed to collect and deliver it; the customer and restaurant can see the driver’s location during a delivery.
• Service providers acting for us: Google Firebase (push notifications, Crashlytics, Analytics, real-time order updates), Google Maps and Places (maps, addresses and distances), payment providers such as Stripe (card payments), SMS and email providers (verification codes and messages), and our hosting provider (Hostinger) in the UK/EU.
• Meta Platforms: the BIAB Buyer app sends app events and device information to Meta through the Facebook SDK for analytics, and for Sign in with Facebook if you use it.
• Legal reasons: where the law requires it, or to protect the rights, property or safety of our users, the public or us.

Some of these providers process data outside the UK. Where they do, the transfer is protected by an adequacy decision or the standard contractual clauses approved for the UK.

6. How long we keep data

We keep account data while your account is open. In the demonstration marketplace, accounts, orders and uploads are removed at each regular reset. Order, payment and invoice records that the law requires us to keep for tax and accounting are kept for the legally required period (normally six years) and are then deleted. Crash and analytics data is kept by Firebase for its standard retention period.

7. Security

All data between the apps and our servers is encrypted in transit (HTTPS). Sign-in tokens are stored in the device’s secure storage (Android Keystore or iOS Keychain), passwords are hashed, and access to our servers and database is restricted.

8. Your rights and choices

Under UK data protection law you can ask to access, correct, delete or receive a copy of your data, to object to or restrict how we use it, and to withdraw consent at any time.

• Get a copy of your data: in the app, open Account and choose Request My Data.
• Delete your account: in the app, open Account and choose Delete My Account, or follow the steps on our Delete your account page. We process deletion requests within 30 days.
• Permissions: you can turn off location, camera, photos, Bluetooth and notification access at any time in your device settings. BIAB Delivery drivers can stop location collection by going offline.

To use any of these rights, email info@thebusinessinabox.co.uk. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk).

9. Cookies

The website uses cookies that are needed for sign-in, your basket and language settings, and, if you accept them, cookies for analytics. You can choose which cookies to accept in the cookie banner and remove cookies in your browser settings. The mobile apps do not use browser cookies.

10. Children

The apps and website are intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We will post any changes on this page and update the date at the top. If a change materially affects how we use your data, we will tell you in the apps or by email.

12. Contact us

SCIAC LTD (trading as Business In A Box), 82a James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE, United Kingdom
App developer on Google Play: JDC Digital
Email: info@thebusinessinabox.co.uk
Phone: +44 7356 264859

See also our Terms and Conditions.