Privacy Policy

Last updated 16 October 2026

Rellony provides due-diligence reports on hospitality properties in England. This policy explains what personal information we collect, why we collect it, and what we do with it.

Rellony Rescue, our service for food businesses, has its own section: 11 Rellony Rescue — including what we hold if we wrote to your business.

01 Who we are

Rellony is a small early-stage service. Our reports currently cover properties in England only. For any question about this policy, or about information we hold, contact support@rellony.com.

02 What we collect, and why

Most of what we hold is what you type into the check form on our home page:

The property address: So we can identify the property in public records and work out whether we can produce a useful report on it.
Your business type and the operating needs you select: Because suitability is conditional. The same unit can be fine for a cafe and a real problem for a late-night kitchen, so we need to know what you intend to operate in order to check the right things.
Any listing link or claim text you paste: This is the material we cross-check against the public record. If you paste text from a third party, please do not include anyone else’s personal details in it.
Your email address: So we can reply to your enquiry within 1 business day, ask follow-up questions, confirm what a report would cover and what it would cost, and deliver the report if you go ahead. We do not add you to a marketing list and we do not send newsletters.

Three other things reach us that you did not type, so they are worth naming on their own rather than leaving you to assume them.

What the coverage check works out from your address: Before the rest of the form appears, the home page checks whether the address is somewhere we cover. If what you entered contains a postcode, that postcode is looked up against a public postcode database — see section 05 — and the answer comes back as the postcode in its standard form, the country, the region, the local authority whose area it falls in, and the coordinates of the postcode itself. If you then send an enquiry, those details are attached to it, because they save us from looking the same thing up again. They are worked out from your address rather than collected separately, and they describe an area, not a particular building.
Whether the postcode falls inside a conservation area: The same check goes on to ask the government’s planning data service whether those coordinates fall inside a conservation area, and shows you the answer straight away. If one is found, we hold its name, its reference, and the link to the council’s own page about it. If none is found, we hold that fact. Either way it is attached to your enquiry if you send one. Like everything else the instant check produces, it describes the area around the postcode rather than a particular building — working out what it means for the property itself is what the full report is for.
Your email address, if you ask about a country we do not cover yet: If the coverage check finds the property is outside England, we do not ask you for anything else — there is no enquiry for us to take. We offer one field instead: an email address, so we can tell you if coverage ever reaches that country. If you fill it in, we hold that address and the name of the country you asked about, and we use them for that one message and nothing else. It is not a newsletter, we will not market to you from it, and you can ask us to delete it at any time.

If you arrive from an online advert, the enquiry form also records which advert campaign and search keyword you came from, so we can tell which adverts are useful.

Both forms also contain a hidden anti-spam field that is invisible to people. If it is filled in, the submission is treated as automated and discarded.

We do not use advertising trackers, analytics cookies or third-party pixels on this site. We count page visits with Cloudflare Web Analytics, which does not use cookies or local storage. If you prefer not to be counted, you can block static.cloudflareinsights.com in your browser, or email us. The site’s typefaces are served from this website itself, so loading a page sends no request to Google or any other font provider.

03 How reports are prepared, and automated decisions

Reports are researched from public records using our evidence-checking process. No automated decision producing legal or similarly significant effects is made about you.

We use software tools, including AI assistance, as part of preparing and drafting reports. What we put into those tools is the property information and the public records being analysed — not your email address or other contact details.

04 Legal basis for using your information

Taking steps at your request before entering a contract — using your enquiry to assess the property and reply to you.
Performing a contract — preparing and delivering a report you have paid for.
Our legitimate interests — keeping basic records of enquiries and orders, preventing spam and abuse, and improving the service.
Legal obligation — keeping records of payments where tax or accounting law requires it.

05 Who else sees your information

We keep the number of parties involved as small as we practically can:

Postcodes.io answers the coverage check on our home page. When you press the button, your browser sends the postcode contained in the address — just the postcode, not the rest of what you typed — directly to api.postcodes.io. That service therefore receives the postcode, and, as with any request your browser makes to any site, your IP address. This happens at that moment: before you have submitted a form, given us an email address, or agreed to anything. We built it that way on purpose, so that we can tell you straight away whether we cover the property without first asking you for personal details. The request goes from your browser to them and does not pass through us.
planning.data.gov.uk answers the conservation-area part of the same check. Once the postcode lookup has returned a set of coordinates, your browser sends those coordinates — a point on a map, not your address and nothing else you typed — directly to planning.data.gov.uk, the government’s own planning data service. That service therefore receives the coordinates and, as with any request your browser makes to any site, your IP address. As with the postcode lookup, this happens before you have submitted a form, given us an email address, or agreed to anything, and for the same reason: so we can answer instantly without first asking you for personal details. The request goes from your browser to them and does not pass through us.
Cloudflare Web Analytics counts page visits. Your browser requests a small script from static.cloudflareinsights.com, so Cloudflare receives that request and, as with any request your browser makes to any site, your IP address. It sets no cookie and stores nothing on your device.
Our form provider (Formspree) receives your form submission and passes it to us by email.
Our email provider carries our correspondence with you.
PayPal handles payment, but only if you choose to pay an invoice we have sent you by email. Nothing is charged on this website and this website collects no payment details: if you decide to go ahead after our emailed reply, we send you a PayPal invoice, and paying it happens on PayPal rather than here. PayPal therefore receives your payment details and whatever else it needs to take the payment. Those details never reach us, and we never store them. If you never ask for an invoice, PayPal receives nothing about you from us.

We do not sell your information, and we do not share it with anyone for marketing. We may disclose information if we are legally required to.

Rellony is operated from Georgia, so information you submit is processed outside the UK from the moment it reaches us — not only when it passes to someone else. Several of the providers named above are outside the UK too, and where information reaches them it is handled under the transfer safeguards they put in place. Your rights under UK data protection law apply to your information wherever it is processed, and section 08 explains how to use them.

06 Public records

The records we look up — planning applications, food hygiene inspections, licensing information, company filings and insolvency notices — are already published by the relevant public bodies. We look them up; we do not create them and we cannot change or remove them. If you believe a public record is wrong, the correction has to come from the body that published it.

07 How long we keep things

Enquiries that do not lead to an order are kept only while they are useful for following up, and then deleted. Reports we have delivered, and the records supporting them, are kept so that we can answer questions about a report you paid for, and so that payment records meet tax and accounting requirements.

A coverage-waitlist address is kept only until it has done the one job you gave it: we delete it once we have sent you the message saying coverage has reached the country you asked about, or sooner if you ask us to.

A specific retention period is still being set as the service takes shape, and this section will be updated with exact timescales once it is. In the meantime, you can ask us to delete your information at any time.

08 Your rights

Under UK data protection law you can ask us for a copy of the information we hold about you, ask us to correct it, ask us to delete it, or object to how we are using it. Email support@rellony.com and we will respond. If you are not satisfied with how we have handled the matter, you can complain to the Information Commissioner’s Office (ico.org.uk).

09 Changes to this policy

This is an early-stage service and this document will change. The date at the top shows when it was last updated. If a change materially affects people who have already submitted an enquiry, we will say so by email.

10 Contact

Questions about privacy, or about anything on this page: support@rellony.com.

11 Rellony Rescue

This section covers Rellony Rescue, our self-help service for food businesses in England, and the letters we send about it.

Who we are

Rellony is run by Giorgi Nonikashvili, an individual based in Tbilisi, Georgia, who is the controller of the personal data described here. Email privacy@rellony.com (or rescue@rellony.com). Full postal address: rellony.com/legal.

Two groups of people this covers

A. Food businesses we write to — we send one letter about Rellony Rescue to some food businesses in England.
B. People who use Rellony Rescue — visitors who use the free check or buy.

Many businesses we deal with are companies, whose details are not personal data. Sole traders and partnerships are people, so we treat every business’s details as personal data and give them these rights.

A. If we wrote to your business

What we use: your business name, business address, food hygiene rating and its date, the three scores the FSA publishes with it (hygiene, structure, confidence in management), the council that rated you, the FSA’s identifier for your business, and the unique code printed on our letter.
Where it comes from: the Food Standards Agency’s public food hygiene ratings data, published under the Open Government Licence.
Why: to send you one letter explaining your scores, your council’s re-visit process and Rellony Rescue, and to recognise your code if you visit our site.
Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)). Our interest is offering a relevant service to food businesses that have recently received a low food hygiene rating. We balance that against your interests: we use only public business information, write only to commercial premises (not homes), send one letter, and make it easy to opt out. Our assessment is available on request.
Your right to object: you can tell us to stop at any time — email stop@rellony.com or visit rellony.com/stop with your code. We will never write to you again. To make sure of that, we keep only your business name and postcode on a do-not-write list.
How long: letter data is deleted 12 months after the letter is sent. The do-not-write list is kept for as long as we send letters.

B. If you use Rellony Rescue

What we use:
- your answers about how your kitchen works (for example how you store, cook, chill and clean food, what equipment and records you have), your type of business and the number of food handlers (a number only — we never ask for staff names);
- optional details you choose to add: dish names for your allergen matrix (names only — we never record which allergens are in your food), supplier business names, your pest contractor’s business name, and anything you type in free-text boxes (please don’t type people’s names);
- your email address (to save your progress and send your pack), your business name and the FSA identifier for your business;
- payment details from PayPal: transaction ID, payer name and email, amount (we never see card or bank details);
- your progress (steps ticked on your pack page) and basic usage events tied to your code or order (for example “free check viewed”, “pack delivered”);
- a record of your order: the date and time you confirmed you were buying for your business and accepted our Terms, the version of the Terms, and the summary of the free check you saw before paying.
Do you have to give us this? No — but we can’t provide the service without your email address and your answers. Everything marked optional is optional.
Why and lawful basis:
- to fill in your SFBB pack, build your plan and your free check, and run the 4-week programme — steps you ask for before and under our contract (Article 6(1)(b));
- to take payment, deliver the pack, handle refunds and keep business records — contract and legal obligation (Article 6(1)(b) and (c));
- to prevent abuse of the free part and understand which letters and pages work — legitimate interests (Article 6(1)(f));
- to keep the record of your order so we can show what was agreed if there is ever a dispute — legitimate interests (Article 6(1)(f)).
Service emails (your order confirmation, your pack link and our replies) are part of the service you bought, not marketing. We don’t send marketing emails.
Automated decisions: our software decides automatically whether we can offer Rellony Rescue — for example, not for a rating of 0, a formal notice, a mention of illness or an allergic reaction, or a business that isn’t a caterer — and builds your pack from your answers. If you think it got something wrong, email us and a person will look at it. During our first orders a person checks every pack before release.
Your browser: our pages keep a session token in your browser so you can carry on where you stopped. We don’t use advertising or tracking cookies, and Rellony Rescue pages don’t use third-party analytics. Your SFBB pack is made in your browser and is never sent to us.
How long:
- answers from a session that never pays: deleted 30 days after the last activity;
- your answers, Rescue plan and progress: kept for 12 months so you can come back to them, then deleted (sooner if you ask). We never receive or keep your filled-in SFBB pack: it is made in your browser;
- order and payment records, including the record of your order: kept for as long as tax and accounting law requires.

Who helps us (processors)

Supabase: Database — data stored in Supabase’s London region (UK).
Resend: Sending emails — United States.
Stannp: Printing and posting our letters — United Kingdom (data stored in the EEA).
GitHub Pages: Hosting the website — United States.
Cloudflare: Email routing — international.
PayPal: Payments — PayPal is a separate controller for its own purposes; international.

GOV.UK (not our processor): to make your SFBB pack, you save the Food Standards Agency’s PDF from GOV.UK (assets.publishing.service.gov.uk) and choose it on your pack page. GOV.UK sees your IP address, as with any website visit. Our page reads the file only on your device to fill it in; neither the PDF nor your filled-in copy is ever sent to us or to GOV.UK.

International transfers

Rellony is run from Georgia, so your details are handled outside the UK. Where a processor is outside the UK, we rely on the safeguards in its data processing terms: Resend uses the UK standard contractual clauses (the EU clauses with the UK Addendum) and states that it complies with the EU-US Data Privacy Framework and its UK Extension; Supabase stores our data in London and its terms include the UK Addendum; Stannp stores data in the EEA (which UK law treats as adequate). GitHub and Cloudflare state that they comply with the EU-US Data Privacy Framework and its UK Extension, and Cloudflare’s terms also include the UK standard contractual clauses (the EU clauses with the UK Addendum).

Your rights

You can ask for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, and — where it applies — ask for it in a portable format. Your objection to direct marketing is always respected. Email privacy@rellony.com; we reply within one month.

Complaints

If you’re unhappy with how we handle your data, tell us first: email privacy@rellony.com with “Complaint” in the subject. We acknowledge every complaint within 5 working days, look into it, and tell you the outcome without undue delay. You can also complain to the UK’s data protection regulator, the Information Commission (known as the ICO): ico.org.uk/make-a-complaint.