Privacy Policy
Last updated: 17 August 2026
This policy explains what the Flitwick Peri Peri ordering app does with your personal information.
It is deliberately short, because the app collects very little.
Who is responsible
Mahmudul Hoque is the data controller for the app: I decide what it collects and why, and I am responsible for looking after it.
Write to me at m.hoque@gmail.com. That is the address for any question about this policy, and for any of the rights set out below. If you need a postal address for a formal request, ask by email and I will give you one.
The restaurant is responsible for its own copy. Flitwick Peri Peri, 3 Vicarage Hill, Flitwick, Bedford, MK45 1HZ, 01525 643688, receives your order so it can make your food, reads it on a screen in the shop, and keeps it in its own sales records. For that copy the restaurant decides what happens, not me. If you want it dealt with, ask them as well as me, and tell me so I can pass the request on.
What the app collects
When you first open the app:
- An anonymous account identifier, created automatically so the app can show you your own orders and nobody else's. It is not linked to an email address, a social account, or your identity outside this app.
When you place an order:
- Your name and phone number. You type these at checkout. The restaurant needs them to call you if something is wrong with your order, and they appear on the order as the kitchen sees it. If the shop adds a ticket printer, they will be printed on the ticket too.
- What you ordered, the price and the time.
- A device notification token, if you allow notifications.
The app does not collect your location, your contacts, your photos, or anything about how you use other apps. There is no analytics, no advertising, no tracking, and no profiling of any kind.
The app is collection only. If delivery is offered later it will also collect the delivery address you give it.
Why, and on what legal basis
Taking your order, telling you what is happening to it, and letting you cancel it: Article 6(1)(b) UK GDPR, processing necessary to perform a contract you asked for.
Keeping the order afterwards is the restaurant's legal obligation as a business keeping records of its sales: Article 6(1)(c). That basis applies to the restaurant as controller of its own copy rather than to me.
Notifications go only to your own orders. Your phone asks separately before any are sent and you can withdraw that at any time in your device settings. The app never sends marketing.
Who else sees it
| Who | What for | Where |
|---|---|---|
| Supabase | Stores the database and runs the ordering service | London, United Kingdom (eu-west-2) |
| Google (Firebase Cloud Messaging) | Passes notifications towards your phone | Google's infrastructure |
| Apple (APNs) | Delivers notifications on iPhones | Apple's infrastructure |
| Flitwick Peri Peri | Makes your food; keeps its own sales records | The shop |
Your order information is stored in the United Kingdom. Supabase is a US company, so support and administrative access can happen from outside the UK. Notifications pass through Google and Apple. Those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; write to me for a copy of the safeguards.
A notification contains your order number, its status, the time the kitchen has given, and, if the shop refuses or cancels the order, the reason they give. It also carries the order's identifier. It never contains your name or your phone number, because it may appear on a lock screen where anyone can read it.
Apple or Google may also hold information about your app download, under their own policies, which I do not control.
Your information is never sold, rented, or shared for anyone's marketing.
How long it is kept
Orders are kept for at least six years. That is how long a business keeps records of its sales, and the orders are the restaurant's records. "At least", because of the paragraph below: nothing deletes them at the six-year mark.
Your account, your notification token and your saved details are kept while you use the app, and are deleted when you ask me to erase them.
Deleting the app does not delete your account. The app signs you in anonymously, so a reinstall or a new phone starts a new account and leaves the old one behind, with its notification token, until you ask for it to be erased. To ask about an account you can no longer reach, quote the phone number you ordered with and an order number, which is what lets me find it.
There is no automatic deletion yet. Nothing currently removes old records on a schedule; erasure happens when you ask. I would rather say that than imply a tidiness the software does not have.
Erasing your information
If you ask, I will:
- delete your account and your notification tokens outright, so the app stops recognising you and stops sending you anything;
- replace your name with a marker, and delete any notes, on your past orders;
- replace your phone number with an irreversible keyed code.
The orders themselves survive, because they are the restaurant's sales records.
Being honest about that last point: the keyed code is not deletion. It lets the shop see that two old orders came from the same person without being able to work out who. Under UK GDPR it is still personal data, and the technical word is pseudonymisation. It is done that way deliberately so the shop keeps usable sales history. If you would rather it were not there at all, say so and we will talk about what is possible.
If you are also a member of the restaurant's staff, the erasure is refused and I will need to remove your staff access first. Otherwise erasing your account would silently cost you your job's access.
Your rights
Under UK GDPR you can ask me to give you a copy of what is held, correct anything wrong, erase it (subject to the above), restrict or object to what is done with it, or transfer it to you or someone else.
Write to the contact address above and I will respond within one month.
If you are unhappy with how I have handled your information, complain to the Information Commissioner's Office, ico.org.uk, 0303 123 1113. You can go to them without asking me first.
Cookies
The app is a native app. It uses no cookies or similar tracking technology.
Children
The app is not aimed at children. If you are under 13, ask a parent or guardian before using it.
Changes
If this policy changes I will update the date at the top. The version in force is the one published at the address you are reading this from.