Privacy policy

Last updated 11 October 2026

Who we are

Five Star Diary is a Highfold Group brand. Address: Office 21848, 182-184 High Street North, East Ham, London, E6 2JA. The "controller" of the personal data described here ("we", "us") is Highfold Group.

Questions about your data? Email hello@fivestardiary.co.uk. We read every message and we'll get back to you as soon as we can.

What we collect

• Details you give us - your name, email address and password (stored only as a secure hash); your business name, type, address, postcode, opening hours and food hygiene rating ID; the names of staff you add and a scrambled (hashed) version of their 4-digit PIN, never the PIN itself; the food safety records you and your staff enter: checks, temperatures, problems and actions, cleaning, deliveries, supplier contact details, training records and reviews; the email address and mobile number you choose for missed-check alerts; billing records from Stripe (we never see your full card number); if you sign up for our monthly food safety tips, your email address (until you unsubscribe; every email has a one-click unsubscribe link).
• Payment details - handled entirely by Stripe. We never see or store your full card number.
• Messages - what you send us by email or through our contact forms.
• Basic usage data - we count page views without cookies. To count unique visitors we use a one-way, daily-changing hash of your IP address and browser; we can't use it to identify you and it resets every day.
• Security logs - like most websites, our web server and mail server keep logs of each request: your IP address, the date and time, the page or service requested and your browser details (and, for emails, the sender and recipient addresses). We use them only to keep our services secure and working.
• Live chat - the messages you type into our chat assistant and any details you choose to send through it (see Live chat below).

Why we use it, and our lawful basis

Who we share it with

We never sell your data. We share it only with the suppliers below, who help us run Five Star Diary. Suppliers that act for us may use it only on our instructions, under contracts that require them to protect it. Where a supplier also uses data for its own purposes (as the table says), its own privacy policy covers that use.

Some of these suppliers may process data outside the UK (for example in the USA). Where they do, the transfer is protected by UK adequacy regulations (including the UK–US data bridge), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

How long we keep it

• Food safety records, and the site and staff details that go with them: while your account exists, including after a plan ends (so you can still view and export them). Deleting your account deletes them.
• A site you remove: its records are deleted 90 days after you remove it (you can bring it back yourself in the first 30 days, and we email you 30 days before deleting it).
• An account that has never paid and has no plan: deleted a year after it was opened, with an email 30 days before.
• Account and order data: while you're a customer, then 6 years (UK tax and limitation rules).
• Enquiries that don't lead anywhere: 2 years.
• Emails to and from our hello@fivestardiary.co.uk mailbox: deleted from our mail server 2 years after they arrive.
• Our log of the emails we send you (address, subject and whether it was delivered): 1 year.
• Security logs on our servers: 14 days.
• Cookieless page-view and visitor counts: about 13 months (400 days).
• Backups: anything we delete stays in our nightly backups for up to 14 days, then it's gone.
• Live chat conversations: 180 days after the last message; details you send through the chat, with the recent part of the conversation, are kept like other enquiries.

Live chat

Our website has a chat assistant. It is an automated AI assistant, not a person: it answers questions using Five Star Diary's own web pages and information we've written for it, and it can make mistakes. If it can't help, it can take your details so our team can reply to you by email.

• What we keep - the messages you type, the assistant's replies, the page you started the chat on, when it happened, and a one-way hash of your IP address that changes every day (only to stop one connection using up the assistant - we don't use it to identify you). Please don't type card details or sensitive personal information into the chat; card numbers are removed automatically, from the chat and from details you send.
• AI processing - to write its replies, your messages and the relevant parts of our website are sent to Abacus.AI, Inc. in the United States, which acts as our processor under a contract that requires it to protect your data. The transfer is protected by UK adequacy regulations (including the UK–US data bridge), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
• Details you send us - if you choose to leave your details (for example your name, email address and phone number) they reach the Five Star Diary team in the same way as a message through our contact form, together with the recent part of your conversation (so the team has the context), we email you to confirm we've got them, and we reply by email. Nobody from the team joins the chat itself.
• Why (lawful basis) - legitimate interests (answering questions about our products), and steps you ask us to take before entering into a contract when you ask us to get back to you.
• How long - chat conversations are deleted 180 days after the last message. If you send your details, they and the recent part of the conversation that goes with them are kept like other enquiries (2 years).
• On your device - once you start a chat, your browser keeps the conversation (in local storage, not a cookie) so it stays open as you move between pages. It's cleared the next time you visit after 24 hours without using it, or straight away when you choose "Start a new chat" or clear this site's data. Once you've sent your details, your browser no longer keeps them.

If you work in a kitchen that uses Five Star Diary

Your employer uses Five Star Diary to keep its food safety records. For the details your employer keeps about you here - your name, whether you are a supervisor, the checks and readings you record and sign, and any training records your employer adds - your employer is the controller. We process them on its behalf, only to run the service, and never use them for anything else.

• Your PIN - we store only a scrambled (hashed) version, never the 4 digits themselves. On a kitchen's shared device the diary remembers who entered their PIN for up to 12 hours, unless the kitchen uses wall mode, which asks every time.
• Your entries - checks, temperatures, problems and sign-offs are saved with your name and the time, and can't be edited afterwards, because they are your employer's food safety record. They stay with your employer's records and are deleted if your employer deletes its account.

To see, correct or delete this information, ask your employer first. You can also email hello@fivestardiary.co.uk and we'll pass your request on and help your employer answer it.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. You can withdraw consent at any time. If you have an account you can delete it yourself from your account page. Email hello@fivestardiary.co.uk for anything else - we'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

Changes

If we make important changes we'll update the date above and, where appropriate, tell you by email.