Privacy policy

Effective: 1 September 2026 | Contact: privacy@homebite.org.uk

Homebite ("we", "us") operates an online marketplace connecting customers with local food vendors. This policy explains what personal data we collect, why, how long we keep it, and your rights under UK GDPR and PECR.

1. Data controller

Homebite is the data controller for personal data processed through this platform. Contact: privacy@homebite.org.uk.

2. What data we collect

Category	Examples	Legal basis
Account data	Email, name, phone	Contract (Art. 6(1)(b))
Order data	Items, amounts, delivery/collection choice, order notes	Contract (Art. 6(1)(b))
Payment data	Processed by Stripe — we never store card numbers	Contract (Art. 6(1)(b))
Consent records	Age, terms acceptance, marketing opt-in, research-use acknowledgement	Consent / Legal obligation (Art. 6(1)(a)/(c))
Session data	IP address, user-agent, login timestamps	Legitimate interest — security (Art. 6(1)(f))
Communication	Email logs (transactional: order confirmations, password resets)	Contract (Art. 6(1)(b))
Analytics	Page views, visitor ID, UTM parameters — anonymised where possible	Consent (Art. 6(1)(a))

3. What we do NOT collect

We never store full card numbers — payments are processed by Stripe (PCI DSS Level 1)
We do not sell your data to third parties
We do not use your data for automated decision-making or profiling

4. Third parties we share data with

Processor	Purpose	Data shared
Stripe Payments UK	Card payment processing	Order amount, payment method token
Supabase (AWS eu-west-2)	Database hosting	All platform data
Cloudflare	CDN, proxy, DNS	Request metadata, IP
Brevo	Transactional email	Email address, name
Render	Application hosting	Request logs

5. How long we keep your data

Data type	Retention
Order records (anonymised)	2 years (financial records kept longer per UK tax law)
Notification queue	30 days
Email bodies	12 months
Checkout sessions	90 days
Audit logs	5 years (archived, not deleted)

6. Your rights

Access — download all your data via Account → Export, or email us
Erasure — request deletion via Account → Erasure, or email us. We anonymise your data; financial records are retained as required by law
Rectification — edit your profile in Account, or email us
Portability — export your data in JSON format
Objection — email us to object to processing
Complain — you have the right to complain to the ICO

7. Cookies

We use: essential cookies (session, CSRF — required for the site to function), analytics cookies (only with your consent via the cookie banner), and no advertising cookies. See our Cookie Policy for details.

8. Security

All traffic encrypted via TLS (HTTPS)
Passwords hashed with Argon2id
TOTP two-factor authentication available for all accounts
Session tokens are HttpOnly, SameSite cookies
API access uses short-lived JWTs with refresh rotation and reuse detection

9. Changes

We will notify you of material changes via email to your registered address.