Privacy Policy

Save That Munch is a surplus-food marketplace that helps you discover and buy discounted food bags from local vendors for in-person pickup. The service is operated by [STM LEGAL ENTITY] ([registered office address]), the data controller responsible for your personal data. This policy explains what personal data we collect through our mobile app and this website, why we collect it, and the choices you have.

We handle your personal data in accordance with the UK GDPR and the Data Protection Act 2018. The terms that govern your use of the service are set out in our Terms & Conditions. If you have any questions, contact us at hello@savethatmunch.co.uk.

• Account details: your first name and email address, which you provide when you create an account. Your first name is shared with a vendor when you place an order, so they know who is collecting.
• Location: with your permission, your device's location is used on your device to show food bags near you and sort them by distance. Your location is not sent to or stored on our servers, and you can use the app without granting location access.
• Orders & payments: the bags you reserve, your order history, and pickup status. Card payments are processed by Stripe; we never receive or store your card details on our servers.
• Pickup photos: when you collect an order, the vendor photographs the bag at handover and that photo is attached to your order. You can see your own photo on your order in the app. We can see it too, so we can check that vendors are filling bags as described and look into any problem you report. Nobody else can: the photos are held in private storage and are never given a public web address. Because the photo is taken in the vendor's shop, it may show staff or other people in the background. We remove the location data that cameras normally embed in a photo before it is stored, so a pickup photo does not carry the vendor's coordinates.
• Waitlist: if you join our pre-launch waitlist on this website, we collect your email address (and whether you're a shopper or a vendor) so we can let you know when we go live.
• Support messages: any information you send us when you contact us for help.

We do not use third-party analytics, advertising, or cross-app tracking, and the app does not use remote push notifications (pickup reminders are generated on your device). We do not ask for or store your phone number.

Under the UK GDPR we rely on the following legal bases:

• To perform our contract with you: creating and managing your account, showing nearby bags, processing your orders and payments, issuing pickup codes, and handling refunds where applicable.
• Our legitimate interests: keeping the service secure and working, preventing fraud and misuse, checking that vendors hand over the bags they advertised (this is the basis for the pickup photo), providing customer support, and improving the app. We balance these against your rights.
• Your consent: where we ask for it, such as access to your device location or joining our waitlist. You can withdraw consent at any time.
• Legal obligation: keeping records we are required to retain, such as transaction records for tax and accounting.

We share personal data only with the vendors you order from and with service providers that help us run the service. These act as our processors under contract:

• Vendors: when you place an order, the vendor receives the details needed to prepare and hand over your bag (such as your first name, order and pickup code).
• Our software development & IT provider: the appointed developer that builds, runs, maintains and supports the app and its infrastructure on our behalf, and may access personal data solely for those purposes.
• Supabase: our database, authentication and storage provider, which stores your account and order data on our behalf.
• Stripe: our payment processor, which handles card payments and vendor payouts securely. Card and bank details are provided directly to Stripe and never reach our servers.
• Vercel & Expo: hosting for this website and build/delivery infrastructure for the mobile app.

We do not sell your personal data. We may disclose data if required by law or to protect our rights and the safety of our users.

Some of our providers may process data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data protection law (such as the UK International Data Transfer Agreement or adequacy regulations) to keep your data protected.

We keep your personal data only for as long as your account is active or as needed to provide the service. You can delete your account at any time from within the app (Profile → Manage account → Delete account). This removes your account and the personal data held in it. Records we are legally required to keep, such as order and payment records for tax and accounting, are retained but de-identified so they are no longer linked to you.

Pickup photos are the exception, and we want to be straight with you about it. Our policy is to keep a pickup photo for 30 days after collection, and for up to 150 days where a refund or a card payment dispute has been recorded against that order so we can look into it. That policy is not yet automated: the deletion job has not been built, so pickup photos taken today are kept until it is, and deleting your account does not currently remove them. We are treating this as a priority. In the meantime, if you want a pickup photo deleted, email us at hello@savethatmunch.co.uk and we will delete it for you.

Under the UK GDPR you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• data portability;
• withdraw consent where we rely on it.

To exercise any of these, email us at hello@savethatmunch.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data.

We use industry-standard measures, including encryption in transit (HTTPS/TLS), to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and review our practices regularly.

Save That Munch is not directed to children under 13, and we do not knowingly collect personal data from them.

We may update this policy from time to time as the service develops. We will revise the “Last updated” date above and, where appropriate, notify you in the app.

Questions about this policy or your data? Email us at hello@savethatmunch.co.uk.