Privacy policy

Last updated: 12 October 2026

Delvd is a discovery and offers platform for independent food venues, starting in Sunderland, UK. It is operated by DELVD LTD ("Delvd", "we", "us"), a company registered in England and Wales, company number 17363621, registered office 66 Paul Street, London EC2A 4NA. DELVD LTD is the data controller for the personal data described in this policy and is registered with the Information Commissioner's Office (registration ZC208046). This policy explains what personal data we collect through the Delvd app, the business dashboard at business.delvd.co.uk and our websites, why we collect it, and the choices you have. Questions any time: hello@delvd.co.uk.

What we collect

• Account details. Email address, username, display name, date of birth (optional) and city. You choose a username and a display name when you sign up, and both are shown on your profile. If you give your date of birth, it is used only to check you are 13 or over and, where an offer contains alcohol, 18 or over. It is never shown publicly.
• Content you create. Check-ins, reviews, photos, posts, comments, likes, saves and follows. Most of this is public by design. A private account limits who sees your check-ins, photos and posts.
• Reviews are always public. A review is a public statement about a business, so it is shown with your username, display name and profile picture, and a private account does not change that. Reviews also appear on that venue's public page on our website, which search engines can index, so a review may be findable outside the app. If you would rather not be identified alongside your opinion of a venue, do not post a review. The page fetches its reviews from Delvd each time someone opens it, so a review you delete, or one our moderators remove, disappears from it straight away, and deleting your account removes all of your reviews from it the same way, though search engines may hold a cached copy until they next crawl the page. The page itself keeps only the number of reviews and their average star rating, which name nobody.
• Orders. When you reserve a Raid, buy a Steal or place a food order we record the order, its collection code and its status so the venue can hand it over. Venues see your username against your order, never your email or date of birth. Any note you add to a food order for the venue is shown on its ticket and kept with that order. If you order delivery from a venue that delivers its own orders, we also record the delivery address you enter (the first line and postcode), a phone number and, if you give one, a name for the door, and show them to that venue so its driver can bring your food and call you if they cannot find you. The address is kept with the order; the phone number and the name are deleted 30 days after the order ends. When a venue accepts your food order we email you a confirmation of it: the venue, what you ordered, the price and any allergy note you sent.
• Payments. When you pay in the app, by card or straight from your bank account, the payment is handled by Stripe, a regulated payment provider. Stripe receives the payment amount and a short order description (the order type, its code and the venue); your card or bank details go straight to Stripe and never touch our servers. We keep a record that an order was paid, and its amount, so the venue is paid correctly and for our tax records.
• Stamp cards. If a venue runs a loyalty stamp card, we record the stamps you earn there and any credit a full card earns, so it can be applied to a future order at that venue. This is visible to you and to that venue, never to other venues.
• Allergies. When you add an allergy note to a food order it is shown to the venue at the top of their kitchen ticket and kept with that order. You can also choose to save your allergies to your profile so every checkout starts with them filled in. That is health information, so we store it only because you ask us to: saving it is your explicit consent, it is never shown publicly or used for anything except your order tickets, and you can remove it in Settings at any time, which deletes it from your profile immediately. Notes already on past orders stay with those orders.
• Usage data. How the app is used: screens viewed, searches, offers viewed, and general device information (make and model, operating system and version, app version, screen size, language, timezone and network type, such as wifi or mobile data). We use this to fix problems, improve recommendations and show venues aggregate statistics such as how many people viewed their profile. Venue owners only ever see aggregates, never a named individual's activity.
• Notifications. If you allow notifications on your phone, we store the push token that lets us send alerts to the Delvd app on that phone, a random id the app creates for that install so that two phones on one account stay separate, and whether your Raid alerts and order updates are switched on. We also keep a record of which drop alerts, reminders and order updates we have sent you, so you are never sent the same one twice. Turning Raid alerts and order updates off in Settings, or signing out, stops notifications to that phone, and deleting your account deletes all of this from our systems.
• The launch list. If you leave your email at delvd.co.uk/notify, we keep that address, where you signed up, when, and which version of the sign-up wording you agreed to, so we can email you the day Delvd launches in your city and now and then with news about it, and never send you more than the wording you agreed to covers. Every one of those emails has an unsubscribe link. If you later create a Delvd account with the same email, we note that you did, so we can count how many people on the list went on to join and so we do not send launch reminders to people who already have.
• Creator applications. If you apply to become a Delvd creator at delvd.co.uk/creators, we collect what you put in the form: your name, email address, your TikTok, Instagram and any other handles or links, your follower counts, your area if you give it, anything you tell us about why you want to join, and your confirmation that you are 18 or over. We use this only to review your application and to reply to you, and we rely on taking steps at your request before a contract (reviewing you as a creator), or where that does not apply, on our legitimate interest in running the programme. Your application is saved in our database (Supabase) and emailed to the Delvd team at hello@delvd.co.uk through Resend, our email provider, acting as our processor. Only the Delvd team sees it. We delete applications 12 months after they arrive, except approved ones, which we keep for as long as you are a Delvd creator. You can ask us to delete your application at any time by emailing hello@delvd.co.uk.
• Reports. If you report content or block someone we keep a record so our moderators can act on it.
• Content screening. Everything posted publicly, meaning reviews, comments, check-ins and posts, is checked automatically against a list of banned words before it goes live. Almost everything passes and appears straight away. If something is flagged it is held back from other people until one of our moderators looks at it, and we keep a record of it: your account, the word that was matched, a short extract of what you wrote, and the reason if it was rejected. You can still see your own held-back content while it is waiting.

What we do not collect

• No precise GPS location without asking you first for a specific feature.
• No payment card details. Card payments are handled by Stripe, a regulated payment provider, and card numbers never touch our servers.
• No advertising trackers, and we do not sell personal data to anyone.

Cookies and local storage

We do not use advertising or third-party analytics cookies. To keep you signed in, the Delvd app and the business dashboard store your authentication tokens (issued by Supabase, our hosting provider) on your device; in a browser this uses local storage. These tokens are essential for sign-in and are not used to track you across other sites. If you allow notifications, the app also keeps the per-install id described above on your phone. Our website at delvd.co.uk loads its fonts from Google Fonts, which means your browser requests the font files from Google's servers and Google receives your IP address as part of that request; the business dashboard serves its fonts itself and makes no such request. To count visits without cookies, these pages keep a random visit id in your browser's session storage: the delvd.co.uk home page, every venue page and the venue directory at delvd.co.uk/v, and the business.delvd.co.uk home page and its sign-up page, business.delvd.co.uk/join. There is one id per browser tab on each of the two sites, and it is deleted when you close the tab. Each page view sends that id with the page address (never anything after a question mark in it), the name of the site that linked you there, whether you are on a phone, tablet or computer, and a yes or no for whether your browser looks like an automated robot, such as a search engine's. That check is made in your browser from its user agent, the short description of the browser and device that every browser gives the sites it visits, and the user agent itself is never sent. Because the id stays the same for as long as the tab is open, it links the pages viewed in that tab, for example which venue pages were looked at one after another. It is not linked to you or to any Delvd account, and a new tab starts a new id.

Why we process it (legal bases)

• To run the service (contract): accounts, orders, payments (through Stripe), stamp cards, content you post, the notifications you allow, venue tools.
• To keep it safe and improve it (legitimate interests): moderation, fraud prevention, analytics and recommendations.
• The launch list (consent): you give it when you leave your email, and you withdraw it at any time with the unsubscribe link in any of our emails. Noting whether you went on to create an account is in our legitimate interests, so we know whether the list works and stop reminding people who have already joined. So is keeping a record that you unsubscribed, described below, so that your address is not added back to the list.
• Age checks (legal obligation): 13+ accounts, 18+ alcohol offers.
• Allergy information (explicit consent): both the allergy note you add to an order and any allergies you save to your profile are health information, processed only on the strength of your choice to provide them, used for nothing but your order tickets, and removable in Settings at any time.

Where it lives and how long

Data, including the photos and videos you upload, is stored with Supabase in the EU (eu-west-1, Ireland). Payment processing is carried out by Stripe, which handles your card details under its own terms and may process them outside the EU under safeguards approved for that purpose. A few other providers act as our processors, each handling your data only for the job it does for us. Resend sends our emails (sign-up codes, password resets, food order confirmations and launch list emails), so it receives your email address and, for an order confirmation, the details of that order. Expo's push service delivers notifications, passing each one to Google's Firebase Cloud Messaging for Android phones or Apple's Push Notification service for iPhones, so Expo, Google and Apple receive the push token for your phone and the content of each notification. Netlify hosts our websites and the business dashboard and runs the server code that takes payments, so it receives your IP address when you visit, and your signed-in session and the order when you pay in the app. Where any of them processes your data outside the UK and EU, it does so under safeguards approved for that purpose, which give your data the same level of protection it has here. Raw usage events are kept for up to 24 months, then reduced to aggregate statistics. Account data is kept while your account exists. Screening records, described above, are kept for as long as your account exists and are deleted with it, because they are what lets us tell a one-off from a pattern; deleting your account removes them. A saved allergy note is kept until you remove it or delete your account, whichever comes first. A launch list address is deleted 90 days after the launch email goes to it, or 12 months after you left it if the launch email never reached it, or sooner if you ask. If you unsubscribe, we stop emailing you straight away and delete your address within 30 days; all we keep is a one-way code made from it, from which the address cannot be read back, so that nobody can put you back on the list while we are still sending launch emails. Those codes are deleted when we stop sending launch list emails. If an unusual number of sign-ups arrives at once, addresses beyond the first 60 in an hour are held back and not emailed, and are deleted after 30 days unless we check them and add them to the list.

Your rights

You can access, correct or delete your data. How to delete your account, and what deleting it keeps, is set out under Deleting your account below. You also have the right to restrict our processing of your data, to object to processing, to data portability, and to complain to the ICO (ico.org.uk). Email hello@delvd.co.uk for any request and we will respond within one month.

Deleting your account

You can delete your Delvd account at any time, in either of two ways:

• In the Delvd app. Go to You, then Settings, then Delete account, and confirm. Your account is deleted straight away, unless one of the reasons below means it has to wait.
• Without the app. Email hello@delvd.co.uk from the email address on your account and ask us to delete it. Because anyone can put any address on an email, we first check the request is yours: we either ask you to delete it yourself in the app, if you can still sign in, or send a code to the email address on your account for you to reply with, and we delete nothing until one of those is done. We will delete it and confirm within one month of that check.

When deletion has to wait. By either route, we hold off deleting an account while it has a food order that is still being paid for, waiting for the venue to accept it, being made or ready to collect (one due more than 24 hours ago no longer counts), or a Raid or Steal it has paid for, or is paying for, that is not yet used or expired, because deleting it would lose the collection code; while it runs a venue's Delvd dashboard, so the venue is never left with nobody in charge; while it has admin rights; or while photos or videos it uploaded are still shown on a venue's page, menu, offers or posts, or on a Delvd post. A Raid or Steal you reserved but have not paid for does not hold anything up: deleting your account cancels it and gives it back to the venue. We tell you which of these applies, in the app or in our reply, and what to do. Once an order is finished you can delete straight away. For the others, email hello@delvd.co.uk and we will hand the venue over or close it, remove the admin rights or move the photos, then delete your account for you.

What is deleted. Your account and profile; your check-ins, reviews, posts, comments, likes, saves and follows; any allergies saved to your profile; your stamp cards and any unspent credit on them; your notification tokens and settings; and the screening records described above. Photos and videos you uploaded are removed from Delvd straight away and can no longer be seen by anyone.

What is kept.

• Past orders, without your name or account attached, as the venue's sales record and for our tax records. Any note, allergy note or delivery address you added to an order stays with that order.
• Usage data, without your account attached, until it reaches 24 months old and is reduced to aggregate statistics. The device details recorded with your app sessions are wiped when you delete.
• Reports you made about other people's content, without your account attached, so that the moderation decisions they led to still stand.
• If your account was banned when you deleted it, your email address and a record of the ban, kept so that the address cannot be used to open a new account.

Venues and business accounts

For business accounts we additionally hold the venue's public profile, offers and the contact details given when claiming a listing. Venue listings themselves are built from public sources (including the Food Standards Agency register) and from what venue owners add.

Children

Delvd is for people aged 13 and over. We do not knowingly hold accounts for anyone younger; if you believe a child under 13 has an account, email us and we will remove it.

Changes

If this policy changes materially we will tell you in the app before the change takes effect.