Privacy Policy

Last updated: May 2026

This policy explains what personal data we collect, why we collect it, who we share it with, and what your rights are. We take this seriously and we keep it as plain-English as we can.

1. Who we are

The data controller is Bon Health Nutrition, a sole trader operating in England and Wales, with registered office at [ADDRESS]. You can contact us about anything in this policy at hello@bonhealthnutrition.com.

2. What we collect

  
      What we collect
      Why we collect it
      How long we keep it
      Lawful basis (UK GDPR)
    
      Name, email address, phone number
      To create your account, send order confirmations, and contact you about deliveries.
      For as long as your account is active, plus 7 years after closure (HMRC requirement for tax records).
      Contract performance & legal obligation.
    
      Delivery address & postcode
      To deliver your meals to the right place and confirm we cover your area.
      For as long as your account is active, plus 7 years after closure.
      Contract performance.
    
      Dietary preferences, allergens, goals
      To recommend suitable meals, exclude allergens, and personalise your menu.
      For as long as your account is active. You can edit or clear these at any time in Profile.
      Consent. You can withdraw at any time.
    
      Payment details (card token only — full card numbers are never stored on our systems)
      To process your subscription via our payment provider, Stripe.
      Held by Stripe under their PCI-DSS Level 1 certification. We retain only the masked last-4 digits and Stripe customer ID.
      Contract performance & legal obligation.
    
      Order history & meal ratings
      To show you what you've ordered, allow re-ordering, and improve our menu.
      7 years after your account closes (HMRC requirement).
      Legal obligation & legitimate interest.
    
      Device, browser, and IP address
      For account security, fraud prevention, and to make the app work on your device.
      90 days for security logs; longer if we're investigating an incident.
      Legitimate interest.
    
      Email engagement (whether you open / click)
      To know which emails are useful and stop sending the ones that aren't.
      2 years from the email date.
      Legitimate interest. You can opt out of any email category in Notifications settings.

What we collect	Why we collect it	How long we keep it	Lawful basis (UK GDPR)
Name, email address, phone number	To create your account, send order confirmations, and contact you about deliveries.	For as long as your account is active, plus 7 years after closure (HMRC requirement for tax records).	Contract performance & legal obligation.
Delivery address & postcode	To deliver your meals to the right place and confirm we cover your area.	For as long as your account is active, plus 7 years after closure.	Contract performance.
Dietary preferences, allergens, goals	To recommend suitable meals, exclude allergens, and personalise your menu.	For as long as your account is active. You can edit or clear these at any time in Profile.	Consent. You can withdraw at any time.
Payment details (card token only — full card numbers are never stored on our systems)	To process your subscription via our payment provider, Stripe.	Held by Stripe under their PCI-DSS Level 1 certification. We retain only the masked last-4 digits and Stripe customer ID.	Contract performance & legal obligation.
Order history & meal ratings	To show you what you've ordered, allow re-ordering, and improve our menu.	7 years after your account closes (HMRC requirement).	Legal obligation & legitimate interest.
Device, browser, and IP address	For account security, fraud prevention, and to make the app work on your device.	90 days for security logs; longer if we're investigating an incident.	Legitimate interest.
Email engagement (whether you open / click)	To know which emails are useful and stop sending the ones that aren't.	2 years from the email date.	Legitimate interest. You can opt out of any email category in Notifications settings.

6. International transfers

Some of the services above are based outside the UK or the EEA (Stripe, Vercel, Resend, Google, Supabase regions vary). Where data is transferred, we rely on the UK's adequacy decisions or Standard Contractual Clauses to make sure your data is protected to the same standard as in the UK.

7. How long we keep it

Active customers: as long as you have an accountClosed accounts: 6 years after closure for tax and accounting purposes, then deletedMarketing list (if you've opted in): until you unsubscribeOrder data: 6 years (HMRC requirement)Delivery requests from out-of-area users: 12 months, then deleted

8. Your rights

Under UK GDPR you have the right to:Access the data we hold about youCorrect anything that's wrongDelete your data (subject to our legal obligation to keep some of it)Export your data in a portable formatObject to certain types of processingWithdraw consent at any timeComplain to the Information Commissioner's Office (ICO) at ico.org.ukTo exercise any of these, email hello@bonhealthnutrition.com. We aim to respond within 30 days.

9. Children

Bon Health Nutrition is for adults (18+). We don't knowingly collect data from anyone under 18. If you think a child has signed up, contact us and we will close the account.

10. Security

We take security seriously. Passwords are hashed (never stored as plain text). Payment data is handled by Stripe and never touches our servers. Data is encrypted in transit (HTTPS) and at rest (Supabase). We test our systems and patch them when issues are reported.That said, no system is invulnerable. If you spot a security issue, please tell us at hello@bonhealthnutrition.com and we'll act fast.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email and the "Last updated" date at the top of this page will change.

12. Contact

For anything privacy-related, email hello@bonhealthnutrition.com.