Who we are

FOH Tools is a free suite of hospitality tools available at fohtools.co.uk. For the purposes of UK GDPR, FOH Tools is the data controller for personal data collected through this website.

Contact: support@fohtools.co.uk

What data we collect and why

Data	When	Why	Lawful basis
Email address, display name, password (hashed)	When you create an account	To authenticate you and provide account features	Contract
Email verification token	On registration	To confirm your email address is valid	Contract
Saved session data (rota, menu content)	When you save to account	To let you access your work across devices	Contract
Last login timestamp	On each login	Internal service monitoring only	Legitimate interests
Name, email, message	When you submit the support form	To respond to your enquiry	Legitimate interests
IP address	On login attempts	Rate limiting to prevent brute-force attacks	Legitimate interests

Tools without an account. All four tools work without an account. In this case, everything you enter is saved only in your browser's localStorage — nothing is sent to our servers.

Staff data in saved sessions

If you save a rota that contains real employee names, hours, wages, or availability, that constitutes personal data about third parties. By saving this data to your FOH Tools account, you act as the data controller for your employees' data. You are responsible for ensuring you have a lawful basis to store that data and that you handle it in compliance with UK GDPR. FOH Tools acts as a data processor on your behalf for that data.

We recommend using first names only where possible, and deleting saved sessions you no longer need.

How we store your data

• Data is stored in a MariaDB database on a UK-based server
• Passwords are hashed using bcrypt — we cannot read your password
• All traffic is encrypted in transit via HTTPS (TLS)
• Support form submissions are stored in a server-side log file
• We do not use third-party analytics, tracking pixels, or advertising

Cookies

We set one cookie: a session cookie (PHPSESSID) when you log in. This is strictly necessary to keep you signed in and is exempt from consent requirements under UK cookie law. It expires when you close your browser or sign out. We do not use any tracking, analytics, or third-party cookies.

Third parties

We use Ionos (ionos.co.uk) as our email provider to send verification emails and support confirmations. Your email address is transmitted to their SMTP servers for this purpose. We do not sell, rent, or share your data with any other third parties.

How long we keep your data

• Account data — kept while your account is active. Delete your account at any time from /account to have it removed immediately.
• Saved sessions — kept until you delete them or delete your account.
• Support form submissions — kept for up to 12 months in our server log, then deleted.
• Unverified accounts — removed after 30 days if email is never verified.

Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — delete your account and all associated data at any time via /account, or by emailing us
• Portability — request your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Complain — lodge a complaint with the ICO (Information Commissioner's Office) if you believe we have mishandled your data

To exercise any right, email support@fohtools.co.uk. We will respond within 30 days.

Changes to this policy

We may update this policy as the service evolves. The date at the top of this page reflects the most recent revision. Continued use of the service after changes constitutes acceptance.

---

FOH Tools  ·  support@fohtools.co.uk  ·  fohtools.co.uk