Privacy policy

Who we are

My Streats is a platform that helps people discover street-food vendors, earn loyalty rewards, and enquire about private-event catering. This policy explains what personal data we collect, why, how we use and share it, and the rights you have over it under UK data-protection law (the UK GDPR and the Data Protection Act 2018).

The data controller is MY STREATS LTD, a private limited company registered in England & Wales (company number 14546310), with its registered office at Flat 3, 57 High Street, Alton, England, GU34 1AB. You can contact us about privacy at hello@mystreats.co.uk.

The data we collect

We collect different data depending on how you use My Streats:

• Account data — when you create an account we record your name and email address, received from your chosen sign-in method (Google, Apple, or an email sign-in code). We do not receive or store your Google or Apple password.
• Loyalty data— when you join a vendor's loyalty programme we create a loyalty pass identified by an opaque reference, and record your points balance and the scans and rewards on that pass. You can join loyalty programmes without an account, in which case the pass is not linked to any name or email until you choose to create one.
• Wallet passes — if you add a pass to Apple Wallet or Google Wallet, we store the technical identifiers needed to keep that pass up to date on your device (including a device push token issued by Apple or Google).
• Scan data — when a vendor scans your pass to award a point, we record the event and, where available and permitted, an approximate location used to verify the scan.
• Vendor data — if you operate as a vendor, we collect your business details, contact email, trading locations, menus, photos, schedule, and (where you provide it) your VAT number. Vendor payment details for subscriptions are handled by our payment processor (see below); we do not store your card number.
• Private-event enquiries — if you make an enquiry, we collect the contact and event details you provide (such as name, email, guest numbers, dates, dietary needs, and any messages), together with the brochures, quotes, and comments exchanged with the vendor.
• Technical and usage data— device and browser information, IP address, and how you interact with the site, collected through cookies and similar technologies and our analytics provider (see “Cookies” below).
• Location data — with your permission, your approximate location, used to show vendors near you on the map. You can decline this and still use the map.

Why we use it, and our lawful basis

Under the UK GDPR we must have a lawful basis for each use of your data. Ours are:

• To provide the service you ask for — running your account, loyalty passes and points, connecting customers with vendors, and handling event enquiries and quotes. Lawful basis: performance of a contract.
• To run and improve the platform — keeping it secure, preventing fraud and abuse of loyalty, understanding how it is used, and improving it. Lawful basis: our legitimate interests in operating a safe, working service.
• To process vendor subscriptions — billing and managing paid vendor plans through our payment processor. Lawful basis: performance of a contract.
• Analytics and any optional cookies — where the law requires it, we rely on your consent, which you can withdraw at any time. Lawful basis: consent.
• To meet legal obligations — for example accounting, tax, and responding to lawful requests. Lawful basis: legal obligation.

Who we share it with

We do not sell your personal data. We share it only as needed to run the service:

• Vendors — a vendor whose loyalty programme you join can see the loyalty activity on their own programme. A vendor you make an event enquiry to receives the enquiry details you submit.
• Service providers who process data on our behalf — our hosting and database provider, our application host, our payment processor, the Apple and Google wallet services, our email provider, our maps provider, our analytics provider, and the service we use to help read menus from images. Each acts under our instructions.
• Authorities and advisers — where we are required to by law, or to establish, exercise, or defend legal claims.

A current list of the specific providers we use is available on request.

International transfers

Some of our providers process data outside the United Kingdom. Where they do, we rely on a UK adequacy decision for the destination country, or on the ICO's International Data Transfer Agreement (or the Addendum to the EU Standard Contractual Clauses), so that your data keeps an equivalent level of protection.

How long we keep it

We keep personal data only for as long as we need it for the purposes above. When you delete your account, or ask a vendor's pass to “forget you”, we anonymise your record: your name and email are removed and your loyalty balance is voided. An opaque, non-identifying record of loyalty activity may be retained so vendors keep accurate aggregate statistics, but it can no longer be linked back to you. We keep information we are legally required to (such as transaction records) for the periods the law sets.

Your rights

Under UK data-protection law you have the right to:

• Be informed about how we use your data (this policy).
• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased (the “right to be forgotten”).
• Restrict or object to certain processing.
• Data portability — receive your data in a portable form.
• Withdraw consent at any time, where we rely on consent.

You can remove a loyalty pass and anonymise its record at any time from the back of the pass, and delete your account from your account settings. For any other request, contact us at hello@mystreats.co.uk. You also have the right to complain to the ICO (ico.org.uk), though we'd appreciate the chance to help first.

Cookies

We use cookies and similar technologies that are strictly necessary to run the site — for example to keep you signed in. With your consent we also use analytics cookies to understand how the site is used so we can improve it. You can accept or decline non-essential cookies, and change your mind later.

How we protect your data

We protect data in transit with encryption, restrict who can access it, and enforce per-account data separation at the database level so one account cannot read another's data. No system is perfectly secure, but we take reasonable steps to keep your data safe and will tell you and the ICO about a personal-data breach where the law requires.

Children

My Streats is not directed at children, and we do not knowingly collect data from anyone under the age at which they can consent to online services in the UK. If you believe a child has given us their data, contact us and we will remove it.

Changes to this policy

We may update this policy as the service changes or the law requires. We'll update the date at the top, and where a change materially affects how we use your data, we'll bring it to your attention before it takes effect.