Privacy policy

Last updated: 9 September 2026

Delvd is a discovery and offers platform for independent food venues, starting in Sunderland, UK. It is operated by DELVD LTD("Delvd", "we", "us"), a company registered in England and Wales, company number 17363621, registered office 66 Paul Street, London EC2A 4NA. DELVD LTD is the data controller for the personal data described in this policy and is registered with the Information Commissioner's Office (registration ZC208046). This policy explains what personal data we collect through the Delvd app, the business dashboard at business.delvd.co.uk and our websites, why we collect it, and the choices you have. Questions any time: hello@delvd.co.uk.

What we collect

• Account details. Email address, username, display name (optional), date of birth and city. Your date of birth is used only to check you are 13 or over and, where an offer contains alcohol, 18 or over. It is never shown publicly.
• Content you create. Check-ins, reviews, photos, posts, comments, likes, saves and follows. Most of this is public by design. A private account limits who sees your check-ins, photos and posts.
• Reviews are always public. A review is a public statement about a business, so it is shown with your username, display name and profile picture, and a private account does not change that. Reviews also appear on that venue's public page on our website, which search engines can index, so a review may be findable outside the app. If you would rather not be identified alongside your opinion of a venue, do not post a review. Deleting your account deletes your reviews, though search engines may hold a cached copy until they next crawl the page.
• Orders. When you reserve a Raid, buy a Steal or place a food order we record the order, its collection code and its status so the venue can hand it over. Venues see your username against your order, never your email or date of birth.
• Payments. When you pay in the app your card payment is handled by Stripe, a regulated payment provider. Stripe receives the payment amount and a short order description (the order type, its code and the venue); your card number goes straight to Stripe and never touches our servers. We keep a record that an order was paid, and its amount, so the venue is paid correctly and for our tax records.
• Stamp cards. If a venue runs a loyalty stamp card, we record the stamps you earn there and any credit a full card earns, so it can be applied to a future order at that venue. This is visible to you and to that venue, never to other venues.
• Allergies. When you add an allergy note to a food order it is shown to the venue at the top of their kitchen ticket and kept with that order. You can also choose to save your allergies to your profile so every checkout starts with them filled in. That is health information, so we store it only because you ask us to: saving it is your explicit consent, it is never shown publicly or used for anything except your order tickets, and you can remove it in Settings at any time, which deletes it from your profile immediately. Notes already on past orders stay with those orders.
• Usage data. How the app is used: screens viewed, searches, offers viewed, and general device information (model, operating system, app version, screen size, language and timezone). We use this to fix problems, improve recommendations and show venues aggregate statistics such as how many people viewed their profile. Venue owners only ever see aggregates, never a named individual's activity.
• Reports. If you report content or block someone we keep a record so our moderators can act on it.
• Content screening. Everything posted publicly, meaning reviews, comments, check-ins and posts, is checked automatically against a list of banned words before it goes live. Almost everything passes and appears straight away. If something is flagged it is held back from other people until one of our moderators looks at it, and we keep a record of it: your account, the word that was matched, a short extract of what you wrote, and the reason if it was rejected. You can still see your own held-back content while it is waiting.

What we do not collect

• No precise GPS location without asking you first for a specific feature.
• No payment card details. Card payments are handled by Stripe, a regulated payment provider, and card numbers never touch our servers.
• No advertising trackers, and we do not sell personal data to anyone.

Cookies and local storage

We do not use advertising or third-party analytics cookies. To keep you signed in, the Delvd app and the business dashboard store your authentication tokens (issued by Supabase, our hosting provider) on your device; in a browser this uses local storage. These tokens are essential for sign-in and are not used to track you across other sites. Our website at delvd.co.uk loads its fonts from Google Fonts, which means your browser requests the font files from Google's servers and Google receives your IP address as part of that request; the business dashboard serves its fonts itself and makes no such request.

Why we process it (legal bases)

• To run the service (contract): accounts, orders, payments (through Stripe), stamp cards, content you post, venue tools.
• To keep it safe and improve it (legitimate interests): moderation, fraud prevention, analytics and recommendations.
• Age checks (legal obligation): 13+ accounts, 18+ alcohol offers.
• Allergy information (explicit consent): both the allergy note you add to an order and any allergies you save to your profile are health information, processed only on the strength of your choice to provide them, used for nothing but your order tickets, and removable in Settings at any time.

Where it lives and how long

Data, including the photos and videos you upload, is stored with Supabase in the EU (eu-west-1, Ireland). Payment processing is carried out by Stripe, which handles your card details under its own terms and may process them outside the EU under safeguards approved for that purpose. Raw usage events are kept for up to 24 months, then reduced to aggregate statistics. Account data is kept while your account exists. Screening records, described above, are kept for as long as your account exists and are deleted with it, because they are what lets us tell a one-off from a pattern; deleting your account removes them. A saved allergy note is kept until you remove it or delete your account, whichever comes first.

Your rights

You can access, correct or delete your data. Deleting your account (Settings, Delete account) permanently removes your account, content and orders. You also have the right to restrict our processing of your data, to object to processing, to data portability, and to complain to the ICO (ico.org.uk). Email hello@delvd.co.uk for any request and we will respond within one month.

Venues and business accounts

For business accounts we additionally hold the venue's public profile, offers and the contact details given when claiming a listing. Venue listings themselves are built from public sources (including the Food Standards Agency register) and from what venue owners add.

Children

Delvd is for people aged 13 and over. We do not knowingly hold accounts for anyone younger; if you believe a child under 13 has an account, email us and we will remove it.

Changes

If this policy changes materially we will tell you in the app before the change takes effect.