Privacy notice
This notice explains how BrokeBite handles personal data when you browse the map, submit or check a bite, report a problem, or contact us.
Version 2026-09-13
Who is responsible
The data controller is Ellie. Contact [email protected].
What we use and why
| Data | Purpose and lawful basis | Retention |
|---|---|---|
| Venue, dish, price, location, timing, notes, source links, and sanitised evidence photos | Run and moderate the cheap-food map; perform the contribution you ask us to review; and pursue our legitimate interest in accurate, useful listings. | Accepted listing facts are kept while useful and accurate. Sanitised evidence photos are scheduled for deletion within 90 days. |
| Request IP address and user agent | Prevent spam, duplicate anonymous actions, and abuse under our legitimate interests. The application converts these values into separate keyed identifiers for each purpose before database storage. | Attempt records: 24 hours. Anonymous confirmation and verdict identifiers: 90 days. Hosting providers may keep security logs under their own documented schedules. |
| Community verdicts, confirmations, reports, and moderation records | Check claims, respond to problems, and maintain an accountable moderation history under our legitimate interests. | Purpose-specific anonymous identifiers follow the limits above. Aggregated decisions and tamper-resistant moderation records may be retained while the related listing is operated and where needed to establish or defend claims. |
| Contributor permission choice and terms version | Record the licence and safety promises that allow us to process and display submitted evidence, and protect contributors and affected people. | Kept while the evidence is used and where reasonably needed to demonstrate the permission granted. |
| Correction or removal request email and details | Investigate and respond to your request, comply with legal obligations, and protect legal rights. | Open while being handled; request details are scheduled for deletion 180 days after resolution. A minimal audit outcome may remain where legally necessary. |
| Administrator account identity and actions | Secure restricted tools and keep an accountable moderation ledger under our legitimate interests. | Kept while necessary for service security, accountability, and legal claims. |
Location
If you press Near me, your browser asks for permission and uses your coordinates to centre and rank the map. BrokeBite does not send or store those coordinates in its database. Your browser and device provider control their own location services.
Photos and public information
Submitted files are decoded and re-encoded to remove embedded metadata before storage. Originals are not retained. Do not upload faces, payment details, receipt identifiers, private addresses, or images you do not have permission to share. Approved venue facts and eligible sanitised evidence may become public.
Who receives data
- Supabase provides database, private file storage, and administrator authentication.
- Vercel is the intended web host and may process network and security logs.
- OpenFreeMap receives ordinary browser request data when map tiles load.
- The Food Standards Agency service is queried by our server when venue suggestions are requested.
- Google receives information only when you choose a Google Maps directions link.
We do not sell personal data and currently use no advertising or behavioural analytics cookies.
International processing
Some providers may process data outside the UK. Before launch, the operator must confirm provider regions and contracts and ensure any restricted transfer uses an applicable UK adequacy regulation or appropriate safeguards. You can request information about the safeguard used by contacting us.
Your rights
Depending on the circumstances, UK data protection law may give you rights to access, correct, erase, restrict, or receive your personal data. You may object to processing based on legitimate interests. Where processing depends on consent, you may withdraw it without affecting earlier lawful processing.
Use the correction and removal form. We may need proportionate information to verify that a request belongs to you. You may also complain to the UK Information Commissioner's Office.
Automated decisions and children
BrokeBite does not make solely automated decisions that produce legal or similarly significant effects. The service is intended for a general London audience, not specifically for children, and contributions must not identify children or other people.
Changes
Material changes will receive a new version date. Older permission records keep the exact terms version accepted at the time.