What we hold, and why.

To deliver an order: your name, delivery address, email address, phone number, what you bought, and the delivery notes you write for the driver.

To take payment: our payment processor handles the card. Card numbers are never sent to our servers and we never store them. We keep the last four digits and the card brand so you can recognise the charge.

To find your address: when you type an address at checkout we send that text to a mapping service to turn it into coordinates, so we can tell whether you are inside our own delivery radius.

To keep the site working: a small number of strictly necessary cookies for your basket and your signed-in session. No advertising cookies, no third-party analytics profile, no social media pixels.

Because we need it to perform the contract you entered into when you ordered, because we have a legitimate interest in preventing fraud and in running the business safely, and because food safety law requires us to be able to trace what we sold and to whom in the event of a recall.

Our payment processor, the mapping service that resolves your address, the email provider that sends your confirmation, and our hosting and database providers. Where a delivery is outside our own radius, the courier who carries the box sees your name, address and phone number, because otherwise they cannot deliver it.

Each of these acts on our instructions and may not use your information for their own purposes. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Order records for seven years, because tax and food-traceability rules require it. Your account and address book until you ask us to delete them. Delivery notes and driver messages for ninety days. Server logs for thirty days.

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or ask us to stop emailing you. Write to the address on our contact page and we will reply within thirty days. We will not charge you and we will not treat you differently for asking.

Deleting your account does not delete the order records we are legally required to keep, but it does remove your address book, your saved preferences and your marketing contact details.

Under the California Consumer Privacy Act you have the right to opt out of the sale or sharing of your personal information, and the right to limit the use of sensitive personal information.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is nothing here for you to opt out of. We are stating that plainly rather than presenting a switch that does nothing, which is what a link like this usually leads to.

If that ever changes, this page changes first and the opt-out control appears here. To exercise any of your other California rights, or to have an authorised agent do it for you, write to the address on our contact page. We honour Global Privacy Control signals sent by your browser.

This shop is for adults. We do not knowingly collect information from anyone under 13, and if we learn that we have, we delete it.

When this policy changes we update the date at the top of this page, and we email account holders if the change is material. Questions go to the address on our contact page or to the address on our contact page.