Privacy Policy

• Account details — your name, email, phone number and password. Passwords are stored as secure hashes; staff cannot read your password.
• Order information — delivery address, items ordered, notes, order history and totals.
• Payment — card payments are handled by Stripe. We do not store your full card number. We retain payment references, amounts and payment or refund status for your order.
• Account credit & loyalty — your credit balance and rewards progress.
• Communication preferences — whether you’ve opted in to deals, and (if you allow it) your device’s notification token for order updates.
• Basic technical data — standard information your browser sends (e.g. device type) to keep the site secure and working.

• To take, prepare and deliver your orders.
• To run your account and show your order history.
• To send you order updates (e.g. “on its way”, “ready to collect”).
• To manage account credit and loyalty rewards.
• To send marketing about offers — only if you opt in, and you can stop anytime.
• To prevent fraud and meet our legal and accounting duties.

Data-protection law says we need a reason (a “lawful basis”) to use your information. Ours are:

• Taking your orders, running your account, delivery, order emails and login codes — to provide the service you asked us for (contract).
• Offers and deals — only after you choose to receive the relevant channel. Email and promotional push choices are separate, optional and recorded with the date, source and wording version. You can withdraw either choice in your account. Email unsubscribe links stop marketing emails, without stopping necessary order messages (consent).
• Fraud prevention, security and keeping the site working — our legitimate interests in running a safe, reliable service.
• Tax and accounting records — a legal obligation we have to meet.

We never sell your data. We share it only with the trusted services that run our ordering system, and only as needed:

• Stripe — to process card payments securely.
• Supabase — to host our database and account records.
• Cloudflare — to serve our images and till updates.
• Vercel — to host and serve the website/app and check for automated spam using browser and request information.
• Postie and its email-delivery providers — to send emails, with Resend used for transactional failover. Promotional messages are not sent through that failover.
• Apple and browser push services — to deliver push notifications to your device.
• Google Maps — if you choose to open a delivery-address map, the address in that link is sent to Google. Checkout does not load an embedded map automatically.

Our website and suppliers can process information in the UK, EEA and other countries, including the USA. A UK hosting region does not mean every support or delivery operation stays in the UK. Restricted transfers require an applicable adequacy arrangement or contractual safeguards, such as the UK International Data Transfer Addendum to standard contractual clauses, with any required transfer assessment. Contact us for details of the arrangement applicable to your data or a copy of the relevant safeguards.

We use essential cookies and local storage to keep you signed in, remember your basket and save your preferences. We don’t use them for third-party advertising.

Optional Vercel usage and performance measurements are off until you allow them below. They help us understand visits and page speed. We exclude private account, checkout and staff pages, strip query strings from measurements, and do not use measurements for advertising. You can change this choice here at any time.

If you opt in, we may email or notify you about deals and offers. Marketing emails include an unsubscribe link. Email offers and push offers have separate controls in your account. Turning offers off does not turn off necessary order updates. Device settings can disable all notifications. Where we target an offer by delivery street or previous purchases, we use the address or order history already associated with your account; you can object to direct marketing at any time.

We keep your account and order records for as long as you have an account and as long as we’re legally required to (e.g. for tax). You can ask us to delete your account at any time. We remove unnecessary personal details while retaining financial records needed for tax, accounting or legal claims. Stored sent order-confirmation and missed-order email copies are removed after 30 days once sent and are removed for your orders when an account deletion completes. Consent choices are recorded with their channel, exact wording, source, timestamp and wording version; later choices add a new event rather than rewriting the history. Ordinary local recovery backups retain the latest five distinct backup days. Historic technical archives need separate review and may be retained only for a justified recovery, accounting or legal purpose with restricted access. Restoring a backup must reapply applicable deletion requests before the data is used.

You can ask for access to your personal data, correction, erasure, restriction of processing, or a machine-readable copy where portability applies. You can object to direct marketing at any time and, in applicable circumstances, object to processing based on legitimate interests. You can withdraw consent without affecting processing that was lawful before withdrawal. These rights have conditions; information required for legal obligations or claims may be retained.

Contact the shop using the details below. Requests can be verbal or written; you do not need a particular form or an account login to make one. We may check your identity proportionately. We normally respond to data-rights requests within one calendar month, subject to applicable lawful extensions. You can also complain to the Information Commissioner’s Office at ico.org.uk.

To raise a privacy complaint with us, explain what happened and how we can reply. We must acknowledge it within 30 days, investigate appropriately, keep you informed and explain the outcome without undue delay.

We limit access to customer information to authorised staff and the services needed to operate the shop. Kitchen and delivery notes are used to fulfil your order. Please telephone us about allergies before ordering and avoid putting medical or other sensitive personal information in general notes. A food preference such as “no onions” is enough where you are not reporting an allergy. Payment and fraud checks help protect orders; contact the shop if you need a decision reviewed.

Our service is intended for adults placing food orders and isn’t directed at children.

We may update this policy from time to time. Any changes will appear on this page with a new “last updated” date.

Read this policy alongside our terms of service. You can manage email and push preferences in your account.