Privacy law in your country
How we handle your data also depends on the privacy law of the country where you use Meal2U. Choose your country to see which law applies and which authority you can complain to. Where the law of your country gives you more rights than this policy, you have those rights too.
Last updated: 31 October 2026. This policy applies to the Meal2U app on iPhone, iPad and Android, and to this website.
1. Who we are
Meal2U (also called “Meal2You”, “we” or “us”) is developed and operated by Alphaverse Consultant Private Limited, a company registered in the United Kingdom with company number 15921104 and its registered office at 6 Gurnos Road, Merthyr Tydfil, CF47 9NH, United Kingdom. We are the data controller for the personal data described in this policy. You can contact us about privacy at accounts@meal2you.com. Our ICO registration number is [ICO registration number].
Meal2U is a marketplace that connects customers with independent cooks (home cooks, restaurants and cloud kitchens) and independent delivery partners. Meal2U admin staff run the service.
2. Summary
We do not sell your personal data, and we do not use it for advertising or to track you across other apps and websites. The Meal2U app contains no advertising or analytics software. Your data is encrypted when it travels between your device and our servers. You can ask us to delete your data at any time (see Delete your Meal2U account). We never see your card details, because you enter them on Stripe’s secure payment page.
3. Data we collect
Everyone with an account. We collect your name, email address and mobile number, so we can run your account and contact you. We also keep your language, your notification choices and your country of registration, which the app needs to work. If you allow notifications, we store a push-notification token for your device. You can choose to add a profile photo.
Customers. We collect your delivery addresses and their position on the map, so we can deliver your orders, along with your order history, favourites, and any reviews and ratings you write.
Cooks. We collect your kitchen address (to list your kitchen and work out delivery distances), your business name, cuisines, opening hours and business contact details, your menus and dish details including allergens, and kitchen and dish photos. You can add food-business details such as your food hygiene rating and registration numbers; some of these are optional in the app. We also collect your government ID so that staff can check your identity.
Delivery partners. We collect your base address, delivery areas, vehicle type and registration, and insurance provider and expiry date. We also collect the documents you upload for identity and safety checks: your government ID, your driving licence when your vehicle needs one, and optionally proof of right to work and insurance. While you have an active delivery, we collect your precise location so the customer can follow their order.
Payments. We keep records of orders, payments, refunds and payouts, which we need for accounting and to resolve disputes. For cooks and delivery partners, we keep the status of your Stripe payout account. Card details are handled only by Stripe.
Support and records. We keep messages you send to support. Your password is stored only as a secure hash by our sign-in provider, and we never see it. We record staff checks of identity documents (that a document was checked, by whom and when) and staff actions such as approvals, refunds and account changes, together with the staff member who made them.
4. App permissions
Location is used only by delivery partners, and only while they have an active delivery, including when the app is in the background or the screen is off, so the customer can follow their order. A notification on Android and the location indicator on iOS show when it is in use, and it stops when the delivery ends. Customers and cooks are never tracked. Location records are deleted automatically after about 3 hours.
Camera and photos are used only when you choose to add a profile, kitchen or dish photo, or to upload a document. Notifications are used for order updates and messages, and you can turn them off in the app or in your device settings.
You can refuse or withdraw any permission in your device settings, although some features, such as delivering orders, need the permission to work.
5. Why we use your data
We use your data to provide the service you signed up for, which includes your account, orders, deliveries, payments and payouts. We also use it to meet our legal obligations, such as keeping tax and accounting records and checking food-business and right-to-work requirements where they apply. We rely on our legitimate interests to prevent fraud, keep the service secure and resolve complaints. We ask for your consent for promotional messages, push notifications and device permissions, and you can withdraw that consent at any time. Reading this policy, or opening it in the app, is not consent to any processing.
6. Who sees your data
Other users see your data only as far as an order needs it. The cook sees the customer’s name, order and delivery address. The delivery partner sees the pick-up and delivery details. The customer sees the kitchen and, during their delivery, the delivery partner’s live position. Meal2U admin staff can see data according to their role and the countries they are responsible for.
We use service providers who process data for us under contract. Supabase provides our database, sign-in and file storage (on servers in [region of the production project]). Stripe processes payments and payouts. Google Firebase Cloud Messaging sends push notifications. Resend sends emails, and Twilio verifies mobile numbers. OpenStreetMap tile servers provide the map pictures and receive your device’s IP address. GoDaddy hosts this website.
We share data with authorities only when the law requires it. We do not sell personal data or share it for advertising. Where data is processed outside the United Kingdom, we use the safeguards required by UK law [details to be confirmed].
Cooks and delivery partners are independent businesses. When they receive a customer’s name, address or order details, they must use them only to prepare and deliver that order, keep them secure, not keep them longer than needed, and comply with the data protection and privacy law of their own country. Meal2U’s admins and superadmins may see personal data only as far as their job needs, must keep it confidential, and must follow the same laws.
7. How long we keep it
Delivery partners’ live locations are kept for about 3 hours. Records of orders, payments, refunds, payouts and payment or bank references are kept for 10 years after an account is deleted; during that time only Meal2U admin staff can see them, and they are then deleted automatically. Documents and uploaded photos are kept until the account is deleted. Other account data is kept while your account is open and then deleted as described in Delete your Meal2U account.
8. Your rights
Under UK data-protection law you have the right to ask for a copy of your data, to have it corrected or deleted, to restrict how it is used, to receive it in a form you can take elsewhere, and to object to some processing. To use any of these rights, email accounts@meal2you.com. To delete your account, use Profile → Account and Data Deletion in the app, or see Delete your Meal2U account.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. If you live outside the United Kingdom, you can contact your own data-protection authority.
We follow UK data protection law, which is the UK GDPR and the Data Protection Act 2018. Where you use Meal2U in another country, we also follow the data protection and privacy law of that country where it applies to us, such as the EU GDPR in the European Union, and recognised international standards for handling personal data. If the law of your country gives you more rights than this policy describes, you have those rights too, and we will respect them.
9. Security
Data is sent over encrypted connections. Our database checks every request against your role and, for staff, the countries they manage. Sign-in sessions are kept in your device’s secure storage, and profile photos and partner documents are stored as private files.
10. Children
Meal2U is not for children. You must be [age] or over to use Meal2U, and cooks and delivery partners must be [age] or over. We do not knowingly collect data from children.
11. This website
This website (www.meal2you.com) does not need an account. It uses only the cookies it needs to work [to be confirmed before publishing].
12. Changes
If we change this policy, we will post the new version on this page and update the date at the top. We will also announce important changes in the app.
13. Contact
Alphaverse Consultant Private Limited, 6 Gurnos Road, Merthyr Tydfil, CF47 9NH, United Kingdom. Company number 15921104. Email: accounts@meal2you.com.
Related
See also our Terms and policies, the Help Centre and Contact and support.