Privacy Policy

1. Who this applies to

• Guests — you can browse shops and menus without an account. We don’t create a profile for you and collect no account data until you sign up.
• Customers — people who browse shops, place orders and collect points.
• Shop owners — people who register a business to sell on the platform.

We note below where something applies only to one group.

2. What we collect

Account & identity (all users)

• Name, email address, password (managed by our authentication provider, Clerk — we never see or store your raw password).
• Profile photo or avatar, if you add one.

We do not ask customers for a phone number.

Social logins (all users)

• You can choose to sign in with Apple, Google or X. The sign-in is handled by our authentication provider, Clerk — we never receive your password for those accounts.
• When you do, the provider sends us the profile information you agree to share, which is normally your name, email address, and profile picture where the provider supplies one. We use it only to create and sign you into your marchmello account, and we handle it exactly as described in this policy.
• If you use Sign in with Apple and choose Hide My Email, we receive a private relay address instead of your real one. That works normally — it's simply the address we use to contact you.
• We do not post anything to those accounts. How the provider itself handles your data is governed by their own privacy policy, which we'd encourage you to read.

Information other people can see

• When you review a Shop after an order, your rating, your written comment and the name on your profile are shown publicly on that Shop's page to anyone using the app. Please keep that in mind when writing one. Your email address, phone number, delivery address and order history are never shown.
• Your profile name and photo are visible to people you connect with as friends, and are shown alongside friend requests and point transfers.
• If you give your MELLO code at a Shop’s till, its staff see your first name and last initial, your profile photo, your points balance at that Shop and your vouchers there.

Customer data

• Delivery details. If you order delivery, the address, postcode and phone number you type in at checkout, and any instructions for the driver. They are stored with that order only — never saved to your profile, so you enter them each time — and are deleted from the order 30 days after you place it.
• Reviews you leave after an order: a star rating, a food rating, a happiness rating and an optional written comment.
• Order history: items, amounts, dining choice or delivery, order notes.
• Loyalty points balances, point transfers to friends, vouchers, any reward cards you have bought with points, and your progress on Shops' stamp cards (stamps collected and free items earned).
• Till orders and your till PIN. Orders a Shop rings up on its till with your MELLO code are part of your order history. Your 4-digit till PIN is worked out from your account and the time whenever it’s needed and is never stored; we keep only a count of recent wrong PINs, to stop guessing, and a record that your last PIN was used, so it can’t be used again.
• Refunds of orders you paid at the counter. If a Shop refunds one, at its till or in its app, we record how much, when, where it was done, the reason its staff picked and any note they added, and the points, vouchers and stamps the refund moved. The Shop sees all of that; you see the refund and the points it took back on your order.
• Age checks. If your order contains alcohol, the Shop confirms in person that you are 18 or over. We record only that the check was made — the time and which member of the Shop’s staff made it. We do not ask for, see or store your date of birth, your ID document, or an image of it.
• Friends list and friend requests (via a shareable friend code or QR code).
• Student verification: a university (.ac.uk) email, if you take the Student plan, used solely to confirm student status.
• Email preferences. Whether you’ve asked for marketing emails, and when and how you last said yes or no — when you signed up, in the app, or from one of our emails. Your account also has a random code that makes the unsubscribe link in our emails work without signing in.

Shop-owner data

• A contact mobile number for the business, shown to customers on your Shop page.
• Business details: business type, Companies House registration number or UTR, food business registration number, FSA Food Hygiene Rating (FHRS) ID.
• Verification documents you upload (ID, food registration, food hygiene certificate, public liability insurance). Stored privately; only our review team can access them. An encrypted backup copy is kept in separate storage so they can’t be lost.
• Payout and bank details — collected and held by Stripe (see section 4); we do not store your bank account or card numbers.
• Till managers. The name you give each manager, a secure one-way hash of their 5-digit code (never the code itself), when it was last used, and a log of which manager changed which menu item.

Payment data (all users)

• Card payments are processed by Stripe. Your full card details are entered into Stripe's secure fields and are never stored on our servers. We keep a payment reference, amount, and status for each order and subscription. Our marchmello+ receipts show your card’s type and last four digits, which we read from Stripe when we send each receipt; we don’t store them in our own database.
• If you pay at the counter, at a Shop’s till or in cash on delivery, no payment is taken by us at all. You pay the Shop directly and we hold only the order itself.
• marchmello+ subscriptions bought on iOS are processed by Apple as In-App Purchases. Apple handles the payment and we never see your card or Apple ID details — we receive only your subscription status, product and renewal date, via RevenueCat (see section 4).

Device & technical data

• Push-notification token (to send order and account notifications).
• Approximate or precise location — only with your permission, and used for three things: finding shops near you, helping you enter your address, and confirming you’ve arrived at a shop when you press “I’ve arrived” (your device checks it is within about 250 metres of the shop and sends us that result, not a continuous location trail). We never track your location in the background.
• Camera and photo access — only when you scan a friend QR code, or add a product photo or allergen chart. Images are used only for that purpose.
• Crash and error diagnostics via Sentry (technical data to fix bugs).

3. Why we use it (legal bases under UK GDPR)

Checks on counter sales. Points earned on orders paid at the counter — at a Shop’s till, or when you pay on collection — have no card payment behind them. So every hour we check that activity for signs of abuse: for example points earned at the counter and then converted or sent elsewhere, unusually heavy earning, large orders served the moment they’re placed, groups of new accounts that only ever earn at one Shop, or a customer whose email address matches the Shop owner’s. Anything unusual is reviewed by a member of our team, who looks at the orders behind it. The check itself blocks nothing and makes no decision about you.

4. Who we share it with

We do not sell your personal data.

The Shop you order from sees your name and your order so it can prepare it. For a delivery, it also sees the address, postcode, phone number and driver instructions you gave, because the Shop delivers the order with its own drivers. Shops are independent businesses and are responsible for how they handle this information; under our terms they may use it only to deliver that order — not for marketing or anything else. At a Shop’s till, staff see only what’s described under “Information other people can see” in section 2.

Otherwise we share it only with service providers who process it on our behalf, under contract:

• Clerk — authentication (email, name, password).
• Supabase — our database and file storage (profiles, orders, points, shop documents).
• Cloudflare — encrypted backup storage for shop verification documents, held in the EU.
• Stripe — payments, subscriptions and shop payouts (card and bank details go directly to Stripe).
• Apple — processing of marchmello+ subscriptions bought on iOS (In-App Purchase).
• RevenueCat — managing iOS subscription status. We send them your account identifier so an Apple purchase can be matched to your marchmello account; they return your subscription status and renewal date.
• Sentry — crash and error diagnostics.
• Expo — delivery of push notifications.
• OpenStreetMap / Nominatim and Google Places — address lookup and autocomplete.
• postcodes.io — for a delivery, we send the postcode alone (never your address or name) to find roughly where it is and check it’s within the Shop’s delivery area.
• Resend — sending our emails: verification and account-deletion codes, order receipts, refund confirmations when a Shop cancels, a welcome email when you join, emails about your marchmello+ membership (confirmations when you join, change your plan and cancel; payment receipts; renewal notes), marketing emails if you’ve asked for them, and internal alerts to our team (for example about unusual counter sales).
• Companies House and the Food Standards Agency (FHRS) — shop verification lookups.

Some providers may process data outside the UK; where they do, appropriate safeguards (e.g. UK/EU Standard Contractual Clauses or an adequacy decision) are in place.

We may also disclose data where required by law, or to protect our rights, users, or the public.

Google API Services. Our use of information received from Google APIs — the Google Places API for address lookup, and Google sign-in if you choose it — adheres to the Google API Services User Data Policy, including its Limited Use requirements.

5. How long we keep it

We keep personal data for as long as your account is active and as needed to provide the Service, then only as long as required for legal, accounting, tax or fraud-prevention purposes. Order and payment records are typically retained for 6 years to meet UK financial record-keeping requirements. When you delete your account (see section 7) we remove your profile and personal data, except records we are legally required to keep.

Delivery details — the address, postcode, phone number and driver instructions on a delivery order — are deleted automatically 30 days after the order is placed. The order itself stays in your history, without them.

Membership emails — we keep a record that each email about your marchmello+ membership was sent (not the email itself or your address) for about 13 months, or until you delete your account if that’s sooner.

Shop verification documents (ID, food registration, food hygiene and insurance certificates) are kept for as long as the shop is on marchmello. If the shop or its owner account is deleted, we keep them securely for up to 12 months, to help prevent fraud (for example, a shop removed for misuse signing up again) and to deal with any legal claims. After that they are permanently deleted, including the backup copy. During that time only our review team can access them.

6. Security

We use Clerk-verified access controls, database row-level security, encrypted transport (HTTPS), and store sensitive documents in private storage, with an encrypted backup copy held separately. Payment and bank details are handled by Stripe, a PCI-DSS Level 1 provider. No system is perfectly secure, but we take reasonable measures to protect your data.

7. Your rights

Under UK GDPR you can:

• Access the personal data we hold about you.
• Correct inaccurate data (edit your profile in the app, or contact us).
• Delete your account and data — use Profile → Delete account in the app, or our delete account page (both verify you by an emailed code), or contact us. A shop’s verification documents are kept for up to 12 months first (see section 5).
• Restrict or object to certain processing.
• Port your data to another service.
• Withdraw consent (e.g. turn off location, camera or notifications in device settings). To stop marketing emails, use the unsubscribe link in any of them, or turn them off in the app under Profile → Emails.

To exercise any right, email contact@marchmello.co.uk or use our contact form. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO) — ico.org.uk.

8. Children

The Service is not intended for children under 18 (it involves payment card transactions). We do not knowingly collect data from children under this age.

9. Changes

We may update this policy. We'll change the “Last updated” date above and, for significant changes, notify you in the app or by email.

10. Contact

Questions or requests: contact@marchmello.co.uk, or our contact form.
MARCHMELLO LTD (Company No. 17317814), 66 Paul Street, London, England, EC2A 4NA, United Kingdom.

See also our Terms of Service and Refund & Cancellation Policy.