Privacy Policy

• Account data: name, email, phone number, authentication ID and login provider.
• Delivery data: address, postcode, delivery area and safe-place/delivery notes.
• Order data: meals, quantities, portion size, totals, delivery dates, discounts and order history.
• Payment data: Stripe customer and payment method references, payment status and payment history. We do not store full card numbers.
• Dietary and allergy data: dietary notes, allergies or food preferences you choose to give us.
• Communications: emails, support messages, WhatsApp messages and delivery notifications.
• Technical data: IP address, device/browser information, URLs requested, timestamps, security logs and cookie consent records.
• Analytics data: Google Analytics usage data only if you consent to analytics cookies.

• Contract: to create your account, take orders, deliver meals, manage subscriptions and process payments.
• Legitimate interests: to operate, secure and improve the service, prevent fraud, respond to support requests, and send necessary service messages.
• Consent: for analytics cookies, optional WhatsApp marketing/broadcasts, and where we rely on consent for special category dietary/allergy information.
• Legal obligation: for accounting, tax, consumer law and regulatory record keeping.

Dietary notes may reveal health information, religious belief, or other special category data. We use this information only to understand your order, reduce food-safety risk, and respond to your instructions. Where needed, we rely on your explicit consent by you choosing to provide the information. You can ask us to delete or amend these notes at any time.

We use trusted suppliers to run the service:

• Supabase: authentication and database hosting.
• Stripe: payment processing and saved card management.
• Resend: transactional email delivery.
• Vercel: website hosting and serverless compute.
• Google: Google sign-in if you choose it, and Google Analytics only if you accept analytics cookies.
• Twilio/WhatsApp: WhatsApp delivery notifications and broadcasts where you opt in.
• Professional advisers and authorities: where required for legal, tax, accounting or regulatory reasons.

We do not sell your personal data or share it with third-party advertisers.

Some suppliers may process data outside the UK. Where this happens, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement, approved addenda to standard contractual clauses, or equivalent contractual protections.

• Account and delivery details: while your account is active, then deleted or anonymised when you delete your account unless retention is required.
• Order, payment, tax and accounting records: up to 7 years.
• Support and complaint records: normally up to 3 years after the matter closes.
• Cookie consent records: until you change your preference or clear site data.
• WhatsApp/contact records: while you are opted in or as needed for service, audit and opt-out records.

Under UK data protection law, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent;
• complain to the Information Commissioner's Office.

To exercise your rights, email hello@yallakitchen.co.uk. We will normally respond within one month.

You can complain to the ICO at ico.org.uk.

Strictly necessary cookies keep the service working. Analytics cookies are optional and are only set if you accept them. See our Cookie Policy to change your preference.

We do not currently use AI systems to make decisions about orders, payments, allergies, pricing or customer eligibility. If this changes, we will update this policy before using AI in a way that materially affects customers.

We use HTTPS, role-based access controls, managed payment processing, and database security controls. No online service is perfectly secure; contact us immediately if you believe your account or data has been compromised.

If we make material changes, we will update the date above and notify customers where appropriate.