Local Eats — Kilkeel Eats, Newcastle Eats & Downpatrick Eats

1Who We Are

Local Eats operates the Platform under the brands Kilkeel Eats, Newcastle Eats, and Downpatrick Eats. We are the data controller for personal data collected through the Platform.

Contact: hello@yourlocaleats.app

2What Data We Collect

Account DataYour full name, email address, and phone number when you register.
Order DataDelivery address, delivery area, order contents, prices, and payment status.
Device DataFirebase Cloud Messaging (FCM) device tokens for push notifications, stored against your account.
Location DataIf you grant permission, your approximate location to calculate delivery fees and show nearby restaurants. We do not continuously track your location.
Usage DataStandard server logs (IP address, browser type, pages visited) for security and debugging.
Payment DataPayment is processed by Stripe. We store only the Stripe payment intent ID — never card numbers or CVVs.

3How We Use Your Data

To process and deliver your orders.
To send order status notifications via push notification (FCM), WhatsApp (Twilio), and email (SendGrid).
To allow you to review your order history.
To facilitate account management and support.
To detect and prevent fraud.
To comply with legal and financial record-keeping requirements.

4Legal Basis for Processing (UK GDPR)

Contract performanceProcessing your order, managing your account, and arranging delivery.
Legitimate interestsFraud prevention, platform security, and service improvement.
ConsentPush notifications — you may withdraw consent at any time in your device settings.
Legal obligationRetaining financial transaction records as required by HMRC regulations.

5Who We Share Your Data With

RestaurantsYour name, phone number, delivery address, and order details with the restaurant fulfilling your order.
Shipday (Delivery Management)Order and address details shared to dispatch drivers.
StripePayment processing under their own Privacy Policy.
Firebase (Google)Device tokens for push notifications, processed by Google.
TwilioYour phone number, only to send WhatsApp order notifications.
SendGrid (Twilio)Your email address, only to send order confirmation emails.
SupabaseYour account credentials stored for authentication.

We do not sell your personal data to third parties.

6Data Retention

We keep personal data only as long as necessary for the purposes it was collected for:

Account dataRetained for as long as your account is active. Deleted within 30 days of a verified account deletion request.
Order and payment recordsRetained for 6 years to meet HMRC financial record-keeping requirements, even after account deletion.
Device tokensRemoved automatically once a token becomes invalid or your account is deleted.
Server logsRetained for up to 90 days for security and debugging, then automatically purged.

7Your Rights Under UK GDPR

You have the right to:

AccessRequest a copy of the personal data we hold about you.
RectificationAsk us to correct inaccurate or incomplete data.
ErasureRequest deletion of your account and personal data, subject to our legal retention obligations (see Section 6).
Restriction & objectionAsk us to limit how we use your data, or object to processing based on legitimate interests.
Data portabilityReceive your data in a structured, machine-readable format.
Withdraw consentWhere we rely on consent (e.g. push notifications), withdraw it at any time without affecting past processing.
ComplainLodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.

To exercise any of these rights, contact us using the details in Section 13. We will respond within one month as required by UK GDPR.

8Cookies and Tracking

We use strictly necessary cookies for authentication (Supabase session cookies). We do not use advertising or third-party tracking cookies. No cookie consent banner is required for strictly necessary cookies under UK PECR.

9Data Security

We protect your data using: TLS/HTTPS encryption in transit, Supabase row-level security (RLS) on the database, and JWT-based authentication. Passwords are hashed and never stored in plaintext.

10International Data Transfers

Some of our service providers (Stripe, Firebase/Google, Twilio, SendGrid) may process data outside the UK, including in the United States. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider's own UK/EU adequacy certifications to ensure your data remains protected to UK GDPR standards.

11Children's Privacy

The Platform is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us using the details in Section 13 and we will remove it.

12Changes to This Policy

We may update this Privacy Policy and will notify you of material changes by email. The latest version will always be available on the Platform.

13Contact

For privacy questions or to exercise your rights: hello@yourlocaleats.app