Privacy Policy

1. Who is the data controller?

Metros Franchise, Metros Epsom, 100 Chessington Road, Epsom KT19 9UR, United Kingdom. For any privacy question or to exercise your rights below, email Saiyeshaa4@gmail.com.

2. What personal data we collect

• Account data: your name, email, phone number and password (stored as a one-way hash — we never see your password).
• Order data: your order history, items, notes, delivery/collection choice and receipt.
• Delivery data: the delivery address you enter and its geocoded coordinates so our driver can reach you.
• Driver location (drivers only): approximate GPS location while a driver is on shift, used to route deliveries and show live ETAs to customers.
• Chat messages: messages exchanged between customer, driver and shop about an order.
• Technical data: device type, app version, session tokens (stored securely in your device keychain) and error logs used to keep the App running.

We do not collect or store card numbers or bank details. All payments are taken on delivery/collection.

3. Why we collect it (lawful bases)

• Contract (Art. 6(1)(b) UK GDPR): to accept and fulfil your order, dispatch drivers and provide customer service.
• Legitimate interest (Art. 6(1)(f)): to keep the App secure, prevent abuse and improve service quality.
• Legal obligation (Art. 6(1)(c)): to keep the accounting records required by HMRC and food safety authorities.
• Consent (Art. 6(1)(a)): for optional push notifications and location access on your device — you can revoke consent any time in your device settings.

4. Third parties who process data on our behalf

• OpenStreetMap Nominatim: to geocode delivery addresses (postcode → latitude/longitude).
• Resend: to send transactional email (order receipts, password resets).
• Emergent (hosting): to host the App's servers and databases within the EU/UK region.

We never sell your data. We do not send marketing emails without your explicit opt-in.

5. How long we keep your data

• Account data: for as long as your account is active. On deletion, we anonymise your record within 30 days.
• Order records: 6 years, as required by UK tax law.
• Driver GPS pings: 30 days maximum, then aggregated and anonymised.
• Chat messages: for the lifetime of the associated order.

6. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your account and data ("right to be forgotten") — subject to legal record-keeping obligations.
• Restrict or object to processing.
• Data portability — receive your data in a common machine-readable format.
• Withdraw consent at any time for anything you consented to.

Email Saiyeshaa4@gmail.com to exercise any of these rights. We will respond within one calendar month. If you are unsatisfied, you may complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

7. Data security

Passwords are hashed with bcrypt. Session tokens are stored in the operating-system keychain. All traffic between the App and our servers is encrypted with TLS. Access to production databases is restricted to authorised personnel only.

8. Children

The App is not directed at children under 13. We do not knowingly collect data from children. Please contact us if you believe we have.

9. International transfers

Data is stored on servers located within the UK or European Economic Area. Where a processor operates outside these regions (e.g. some email provider infrastructure), we rely on the UK International Data Transfer Agreement and Standard Contractual Clauses.

10. Changes to this policy

We may update this policy from time to time. When we do, the "Last updated" date at the top of this page will change. Substantial changes will be highlighted in-app the next time you sign in.

11. Contact us

Metros Franchise

Metros Epsom, 100 Chessington Road, Epsom KT19 9UR, United Kingdom

Email: Saiyeshaa4@gmail.com