Privacy Policy

Last updated [DATE TO BE SET AT LAUNCH]

This policy explains what personal data Spice Street collects, why, and what rights you have over it. It applies to Owners (business accounts) and to Diners (people browsing offers, who do not need an account). The data controller is [INSERT REGISTERED COMPANY OR TRADING NAME], contactable at [INSERT SUPPORT EMAIL].

1. If you're just browsing offers (Diners)

You do not need an account to browse Spice Street, and we do not require you to hand over any personal information to view offers. We don't use advertising or tracking cookies. The site keeps a lightweight installable-app capability (via a service worker) purely so it can be added to your home screen — this does not collect or transmit personal data.

2. If you run a business on Spice Street (Owners)

We collect:

  • Account details — your email address, and your restaurant/shop's name, city, category, and phone number.
  • Offer content — the text, photos, and dates you submit for your listings.
  • Billing information — handled directly by Stripe. We store a Stripe customer reference and your subscription status, but we never see or store your card details.
  • Sign-in cookies — a session cookie that keeps you signed in after clicking your magic-link email. This is strictly necessary for the Service to function and isn't used for tracking.

3. How we use it

  • To operate your account and display your listings publicly.
  • To send magic-link sign-in emails and billing-related emails.
  • To send occasional operational or announcement emails from our team to Owners.
  • To detect abuse and enforce our Terms of Service.

4. Who we share it with

We use a small number of service providers ("processors") to run Spice Street. We don't sell your data.

  • Supabase — hosts our database, authentication, and any uploaded offer photos.
  • Stripe — processes subscription payments and stores your payment details on our behalf; we never handle card numbers directly.
  • Resend — delivers the transactional and announcement emails described above.
  • Vercel — hosts the application itself.

These providers may process data outside the UK/EEA as part of their infrastructure; where they do, they provide appropriate safeguards (such as Standard Contractual Clauses).

5. How long we keep it

We keep Owner account and offer data for as long as the account is active, and for a reasonable period afterwards in case of billing disputes or legal obligations. You can ask us to delete your account and associated data at any time (see below).

6. Your rights

Depending on where you're located, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these, contact [INSERT SUPPORT EMAIL]. If you're in the UK and unhappy with our response, you can complain to the Information Commissioner's Office (ICO).

7. Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with an updated date at the top of the page.