Bakersline is an order-management assistant for small bakery businesses. It connects a business's own Instagram and WhatsApp business accounts so that the business owner can read customer enquiries, prepare replies, and manage orders in one place. Every reply is reviewed and approved by a human before it is sent.
We do not sell personal data, use it for advertising, or share it with third parties except the service providers needed to run Bakersline (cloud hosting and AI drafting), who process it only on our instructions.
Bakersline serves bakeries in the United Kingdom and in India. Both are covered, and the roles work the same way under each:
In plain terms: your customers' messages and orders are yours. We hold them for you and act on your instructions, and we do not decide what happens to them.
Data is stored with Google Cloud (Cloud Firestore and Cloud Storage) in the europe-west2 (London) region — for every bakery, including those in India. The DPDP Act permits personal data to be processed outside India except in countries specifically restricted by the Government, and the United Kingdom is not among them. It is encrypted at rest by Google and in transit using TLS. Access is checked on every read against the requesting user's membership of that bakery's workspace, so no bakery can read another's data. Platform access tokens are held in a location that is unreadable by any client application, including the bakery's own, and are excluded from data exports.
These are the only third parties that process personal data on our behalf:
We will update this page before adding any new sub-processor.
Message and order data is kept for as long as the business account remains active. We are introducing an automatic limit on how long conversation history is retained; this page will state the period once it takes effect.
A business owner can act without contacting us:
You can also email support@bakersline.co.uk and we will action any request within 30 days. Backups are removed on Google Cloud's own rolling schedule after deletion.
Where Bakersline accesses data through Meta's Instagram or WhatsApp APIs, it does so only with the permissions granted by the business during connection, in accordance with the Meta Platform Terms and Developer Policies. Customers can also exercise their rights directly through Instagram or WhatsApp.
If you remove Bakersline from your Instagram account, Meta notifies us and we automatically delete the connection along with every message and draft it created, then show you a confirmation code. You can also request this directly by emailing us.
Wherever you are, you can ask us to give you a copy of your personal data, correct it, or delete it, and you can withdraw consent for processing. Under the UK GDPR you also have rights to restrict processing and to object; under the DPDP Act you have the right to nominate another person to exercise your rights, and the right to a grievance redressal process.
A bakery owner does not need to ask us for most of this — Settings → Account → Your data will download everything or delete the workspace permanently, immediately. For anything else, or if you are a customer of a bakery that uses Bakersline, write to support@bakersline.co.uk and we will respond within 30 days.
If a bakery's own customer contacts us directly, we will pass the request to that bakery, because they are the controller (or Data Fiduciary) of that data and the decision is theirs.
For any complaint about how personal data is handled, including a grievance under the DPDP Act, write to support@bakersline.co.uk, marked "Data grievance". A named person is responsible for these and will respond.
If you are not satisfied, you may complain to the Information Commissioner's Office (ico.org.uk) in the UK, or to the Data Protection Board of India.
If a personal data breach affects you, we will tell you what happened, what it means and what we are doing about it. We will notify the relevant regulator within 72 hours of becoming aware — the ICO in the UK, and the Data Protection Board of India where the DPDP Act applies — and we will notify affected individuals directly rather than relying on you to notice.
A plain-English account of what Bakersline can and cannot do with a connected account, where data is held and how to take it back is at bakersline.co.uk/security.
If this policy changes, the updated version will be posted at this address with a new "last updated" date.