Draft for legal review. This describes accurately what the software actually does, which is the useful starting point. It is not a lawyer's work and should not go live until yours has been through it.
Privacy
What we collect
When you file a report we collect: the restaurant you selected, the date and time of your visit, what you told us you ate and drank, the symptoms you selected and when they began, how many people were in your party, your name, your email address, and your phone number if you chose to give one. We also record the time of submission and a one-way fingerprint of your IP address, which we use only to stop bulk abuse of the form.
How your identity is protected
Your name, email address and phone number are encrypted before they are written to our database, using a key held outside that database. Ordinary listings in our admin area show these fields masked. A reviewer has to deliberately choose to reveal them, and every time that happens it is recorded against that reviewer's account in a log that cannot be edited.
What we share, and with whom
If two or more separate people report the same restaurant within a short window, we may contact that restaurant. We tell them how many reports we received and over what period. We do not tell them your name, your contact details, or anything else that could identify you. We do not sell data, we do not share it with advertisers, and we do not publish reports anywhere.
How long we keep it
Reports that are never confirmed by email are marked expired and their contact details are erased automatically. Verified reports are retained so that patterns over time remain visible. You can ask us to delete your report at any time.
Your choices
Email us from the address you used, quoting your reference number, and we will delete your report or send you a copy of what we hold. We will confirm when it is done.
Cookies and tracking
This site sets no advertising or analytics cookies. WordPress may set a session cookie if you log in to the administration area, which visitors have no reason to do.