Privacy notice | BiteDirect

Who we are

BITEDIRECT LTD is a company registered in England and Wales (company number 17575909). Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

We are the “controller” of the personal information described in this notice, which means that we decide how and why it is used. The takeaway you order from also becomes responsible for the details it receives about your order (see “Who we share your information with”).

You can contact us about your information at privacy@bitedirect.co.uk.

What BiteDirect is

BiteDirect lets you find independent takeaways near you, look at their menus and send them an order. The takeaway makes the food and delivers it, or hands it over. We do not take payments at the moment, so we hold no payment card details.

What we collect when you look for a takeaway

The postcode you type. We send it to postcodes.io, a public postcode lookup service, to find out where it is, so that we can show how far each takeaway is. We keep a list of the postcodes we have looked up and where they are, so that we do not have to ask again. That list is not linked to you.
If you press “Use my current location”, your browser sends your device’s position straight to postcodes.io to turn it into a postcode. BiteDirect does not receive your position, only the postcode that comes back.
If you search, a small file on your device (a cookie) remembers your last postcode for 90 days, so that the site can open on your area next time. See the Cookies page.
Like any website, our servers and our hosting providers receive technical information such as your network (IP) address, the type of browser you use and the pages you ask for. We use it to run and protect the site. It is kept in server logs for a limited time.

What we collect when you sign in

Your email address. You sign in with a one-time code that we email to you. (If we offer sign-in with Google or Apple, we receive your email address and, if you let them share it, your name.)
Your name, if you give it to us, or if Google shares it.
Your mobile number. We ask for a UK mobile number the first time you place an order. We text a six-digit code to it to check that it is yours, and we save the number on your account only once you have typed the code correctly. We keep a record of the codes we have sent, as a scrambled “hash” and not the code itself, with your number, so that we can check what you type and limit repeated requests.
A sign-in cookie that keeps you signed in on your device.

What we collect when you place an order

What you ordered, including your choices and any note you wrote for the takeaway; whether it is for collection or delivery; the delivery address, if you choose delivery; and the total.
Your name and mobile number as you gave them for the order.
When you placed the order and how it is getting on (for example, being prepared, or ready).
A “fingerprint” (a keyed hash) of the network address your order came from. We use it only to spot and limit misuse, such as many orders from one place in a short time. It cannot be turned back into your address.
A private web address for your order’s progress page. Anyone who has that exact address can see that one order: what you ordered, your name, your delivery address if there is one, and your mobile number with the middle hidden. Please do not share it.
Your basket, while you choose, is kept only on your device, in your browser’s storage, and is sent to us only when you place the order.

What we collect if you run a takeaway on BiteDirect

Your sign-in email address and name, and whether you are an owner or a member of staff of each takeaway.
The takeaway’s details: its name, address, phone number, delivery terms, menus, prices, opening times and settings.
When you ask to go live: the business name, an optional Companies House number and food hygiene rating link, and any note you write. A person at BiteDirect checks these against public registers.
Invitations you send to colleagues: the invited email address, the role and when the invitation runs out. The secret in the invitation link is stored only as a hash.
Pictures you upload, or have made for your dishes, logo or cover. They are scanned for viruses, rebuilt, and checked by an automatic tool and sometimes by a person (see “Who we share your information with”). No information about customers is ever sent for this.

Why we use your information

We must have a legal reason to use personal information. Ours are:

To provide the service you ask for (contract): creating and securing your account, showing you takeaways, taking your order and passing it to the takeaway, and checking your mobile number.
To keep the service safe and fair (legitimate interests): limiting repeated codes and orders, spotting misuse and fixing faults.
To run and improve the service and to answer you (contract, and legitimate interests).
To meet legal duties (legal obligation): for example keeping accounting records and answering lawful requests from authorities.
Where we ask for it, because you agreed (consent). You can take your consent back at any time.

We do not sell your information. We do not use it for advertising, and we do not send marketing messages at the moment. If that changes we will ask you first.

We do not make decisions about people by computer alone. We use AI only to create and check pictures for takeaways.

The takeaway you order from. When you order, the takeaway receives your name, your mobile number, your delivery address (for a delivery), your note and what you ordered, so that it can make and deliver your order and ring you if there is a problem. The takeaway is responsible for how it then uses those details. It may use them only for your order and as the law requires, and it should not use them to market to you unless you agree.

The companies that help us run BiteDirect. They may use the information only to provide their service to us:

Supabase: our database and sign-in service. Our data is stored in London.
Vercel: runs and hosts our website.
Resend: sends our emails, such as your sign-in code.
Telnyx: sends the text message that checks your mobile number. It stores its message records in Germany.
postcodes.io: turns postcodes into places.
Google: its Gemini service creates and checks pictures for takeaways (it receives the picture and the name of the dish or takeaway, never information about customers). If you choose to sign in with Google, Google also receives and shares what is needed to sign you in.
Microsoft: its Azure service scans the pictures that takeaways upload for viruses.

Others. Authorities and courts, if the law requires it or to protect people’s safety or our legal rights; our accountants and legal advisers, who are bound to keep it confidential; and, if the business is sold or merged, the new owner, who would have to respect this notice.

We do not let anyone else use your information for their own advertising.

Sending information outside the UK

Some of these companies are based in, or handle information in, other countries. For example Resend, Vercel, Google and Microsoft operate in the United States and elsewhere, and Telnyx stores its message records in Germany. Where information leaves the UK we rely on protections that UK law accepts, such as the UK’s approved contract terms (the UK addendum to the EU standard contractual clauses) or the UK–US data bridge for certified companies. Ask us if you would like more detail.

How long we keep your information

Your account (email address, name and mobile number): until you ask us to delete it. Deleting your account removes your sign-in and your profile, including the mobile number saved on it and the records of the codes we texted to you.
Orders: for 6 years after the order. The takeaway and we need these records for accounts and tax, and in case there is a dispute. If you delete your account your orders stay, so that the takeaway keeps its records, but they are no longer connected to your account. If you want your name, number or address taken off an older order and we do not need to keep it, ask us and we will remove it.
Information about a takeaway and its team: while the takeaway uses BiteDirect, and for up to 6 years afterwards for our business records.
The list of postcodes we have looked up: kept so that we do not have to look them up again. It is not linked to you.
Server logs: kept for a short time by our hosting providers, then deleted.
Your basket and your remembered postcode: on your own device only, for up to 24 hours and 90 days (see Cookies).

Your rights

You have the right to: be told how your information is used (this notice); see the information we hold about you; have wrong information corrected; have your information deleted in some situations; ask us to limit how we use it; ask for a copy of the information you gave us in a form that can be moved to another service; object to uses that rely on our legitimate interests; and take back your consent where we rely on it.

To use any of these rights, email privacy@bitedirect.co.uk. We will reply within one month. It costs nothing. We may ask you to prove who you are (we will never ask for more than we need), and if a request is very complicated we may need up to two more months, in which case we will tell you why.

Some rights have limits. For example, we may have to keep an order record for the reasons given above. For information held by the takeaway you ordered from, you can also ask the takeaway.

Keeping your information safe

Nobody can read or change our database directly from the internet. Every request goes through our server, which first checks who is asking and what they are allowed to do.
Information travels over encrypted connections (HTTPS).
A texted code stops working after ten minutes and can be tried only five times, and the emailed sign-in code is short-lived too. The texted codes are stored only as hashes.
A takeaway’s staff see only the orders and the menu of their own takeaway, and only what their role lets them.

No system is perfectly secure. If you think something is wrong, email privacy@bitedirect.co.uk. If there is a breach that puts people at risk, we will tell the people affected and the Information Commissioner’s Office, as the law requires.

Children

BiteDirect is for adults: our Terms of use say you must be 18 or over to have an account and place an order. We do not knowingly collect information about children. If you think a child has given us information, email privacy@bitedirect.co.uk and we will delete it.

Cookies and similar technologies

Our Cookies page lists what we put on your device, what each is for and how long it lasts.

Complaints

Please tell us first at privacy@bitedirect.co.uk, so that we can try to put things right. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Changes to this notice

If we change how we use your information we will change this notice, and the date at the top will show when. If a change matters to you, for example if we start to send marketing, we will tell you before it takes effect.

Contact us

BITEDIRECT LTD, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Email: privacy@bitedirect.co.uk.