Privacy notice
Last updated 25 October 2026
This notice explains what personal data mamaPut collects, why, who it goes to, how long we keep it and what you can ask us to do with it. It covers this website, the mamaPut app for ordering food, the mamaPut Kitchen app for the kitchens that cook it, and the applications and waitlist on this site. It is written for UK data protection law: the UK GDPR and the Data Protection Act 2018.
The short version
- We collect what it takes to sign you in, get your food from the kitchen to you, take payment, and help when something goes wrong.
- The kitchen you order from sees your first name, your order, your notes, your delivery address and your phone number if you give one, because it needs them to cook and deliver.
- Card details go to Stripe, our payment provider. We never see your full card number.
- We do not sell your data, we use no advertising trackers and no analytics software, and we do not build profiles of you for advertising.
- Offers by email or notification come only if you turn them on, and you can turn them off at any time.
- You can download everything we hold about you, and delete your account, from the app.
Who is responsible for your data
The data controller is MAMAPUT LTD, a company registered in England and Wales, company number 17432221, registered office Belmont House, St. Faiths Street, Maidstone, England, ME14 1LH. Our ICO registration number will be added here as soon as registration completes.
For anything to do with your data, email info@mamaput.app. We aim to reply within five working days and answer formal requests within one month.
The kitchens on mamaPut are independent businesses. When a kitchen receives your order details, it is responsible for how it uses them, and our terms say it may use them only for that order, not to keep them or to market to you.
What we collect from customers, and why
| What | Why | Lawful basis |
|---|---|---|
| Your account Email address, your name, your mobile number if you add one, and whether you signed in with an email code, Google or Apple. | To create and run your account, sign you in, and contact you about your orders. | Contract: we need it to provide the service you signed up for. |
| Where you want food Delivery addresses and their position on the map, and the area you browse. If you tap Use my location, your phone shares its position once, with your permission, and we keep only the place you choose. | To show kitchens that cook near you, work out whether they deliver to you and what it costs, and tell the kitchen where to bring the food. | Contract. Location access is your choice in your phone's settings; you can type a postcode instead. |
| Your orders What you ordered, from which kitchen, when, the price, any offer, tip or note, and whether you collected it or had it delivered. If you send a meal as a gift: the recipient's name, their phone number and your message. | To pass your order to the kitchen, take payment, send receipts, deal with refunds and keep the accounting records the law requires. | Contract; legal obligation for the accounting records. For a gift recipient: our legitimate interest in delivering the meal you sent them. |
| Allergies and dietary needs Anything you tell a kitchen in an order note or an event request, which can reveal health or religious information. | Only so the kitchen cooking for you can take it into account. | Your explicit consent, which you give by writing it. You can leave it out, but the kitchen then cannot allow for it. |
| Payments Stripe's reference for you as a customer; the brand, last four digits and expiry of cards you save, which Stripe gives us to show your saved cards; and, for an order with a first-order offer, the fingerprint Stripe gives the card, which is the same for the same card on any account but is not the card number. | To take payment for orders, let you pay with a saved card, and keep first-order offers to one per person. | Contract; legitimate interests in stopping the same card from taking a first-order offer twice. |
| Reviews Your rating, what you write and the boxes you tick about an order. | To help other customers choose and kitchens improve. Reviews are public on the kitchen's page with your first name. | Legitimate interests: honest reviews are what make a marketplace trustworthy. You choose whether to write one. |
| Help with an order What you tell us about a problem, messages with our team, and photos you add. | To put the problem right, decide refunds, and spot kitchens that need help or should not be on mamaPut. | Contract; legitimate interests in keeping food safe and the service fair. |
| Offers, invites, stamp cards, group orders and events Offers and codes you used; your invite code and who joined with it; stamps and rewards at each kitchen; the group orders you join; event requests with the date, number of guests, address, budget and notes. | To give you the money off you are owed, thank you for invites, run the stamp cards kitchens offer, let friends order together, and get you a kitchen's quote for an event. | Contract. |
| Notifications A token for your phone that lets us send it notifications, and a record of what we sent and whether it arrived. | To tell you about your order as it happens, and to stop sending to a phone that no longer has the app. | Contract for order updates. Notifications are your choice in your phone's settings. |
| Offers and news, if you turn them on Your choice, and when you made it. If you saved a kitchen, we may tell you when it starts an offer, at most once a week for each kitchen. | To send you offers and news by email or notification. | Consent. Turn it off at any time in the app under Your details; order updates still come. |
| Searches and favourites What you searched for, the first half of your postcode, what came back and whether it led to an order; the kitchens and dishes you save; alerts you ask for when a dish or kitchen is back. | To improve search, find dishes customers want that no kitchen offers yet, and keep your favourites and alerts. | Legitimate interests for searches; contract for favourites and alerts. |
What we collect from kitchens, and why
| What | Why | Lawful basis |
|---|---|---|
| The kitchen and its owner Your name, email and phone; the kitchen's name, address and position, photos, story, menu, hours and delivery area. | To list the kitchen, show customers where it cooks and what it sells, and pass it orders. | Contract. |
| Legal details The legal name, trading name and legal structure; address; company number and VAT number where there are any; date of birth for a sole trader or partner; food business registration; hygiene certificate and insurance. | To check the kitchen can sell food legally, to remind it when insurance or a certificate runs out, to show customers who they are buying from, and to report sellers' income to HMRC as the law requires of platforms. | Legal obligation (HMRC's reporting rules for digital platforms, food and consumer law); contract. |
| Food hygiene rating The kitchen's rating and its link on the Food Standards Agency's public register. | To show customers the rating and check it every 30 days. | Legitimate interests: customers expect to see it, and it is public. |
| Payouts Stripe's reference for the kitchen's connected account and whether payouts are enabled. Stripe collects and checks identity and bank details itself. | To pay the kitchen for each order, less our fee. | Contract; Stripe's own legal obligations for identity checks. |
| Sales and reviews The kitchen's orders, earnings, ratings, replies to reviews, complaints and messages with our team. | To pay the kitchen, show it how it is doing, and deal with problems. | Contract; legitimate interests in a fair, safe service. |
Applications and the waitlist on this website
If you apply to cook on mamaPut, we keep what you send (business name, your name, email, phone, city, cuisine and your answers about how you take orders today) to assess the application and contact you about it, on the basis of our legitimate interests: you approached us about a business relationship. If you join the waitlist, we keep your email address, city and the dish you miss most if you tell us, to email you when we launch near you, on the basis of your consent; withdraw it at any time and we delete your entry.
Technical data
Our servers see your IP address, browser or app version and the time of each request, which our hosting provider keeps in logs for a short time, to keep the service running and to block abuse. If an app or our servers crash, an error report goes to Sentry with your account number but not your IP address, your name or your email. This is on the basis of our legitimate interests in a service that works and is secure.
Who else sees your data
People
- The kitchen you order from: your first name, what you ordered, your notes, your delivery address and your mobile number if you gave one. For an event, what you put in the request.
- Other customers: your reviews, with your first name. In a group order, the others in the group see your first name and what you chose.
- Someone you send a meal to: your first name, your message, the kitchen and how the order is getting on, through the link that comes with it.
- A friend who joins with your invite gets money off; you are told when their first order arrives, so we can thank you.
Providers who work for us
Each of these handles data only on our instructions, under a data processing agreement.
- Supabase: our database, sign-in and file storage, in London (AWS eu-west-2).
- Cloudflare: runs our servers and this website on its network, and the bot check on our forms (Turnstile).
- Stripe: takes card payments and pays kitchens. Stripe is also responsible for its own checks under financial law.
- Expo, with Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): deliver notifications to your phone.
- Brevo: sends our emails, such as sign-in codes and receipts, from servers in the EU.
- Sentry: receives crash reports, stored in the EU.
- OpenFreeMap: supplies the map images in the app. Your phone fetches them directly, so OpenFreeMap sees its IP address, not who you are.
- Google and Apple, if you sign in with them: they tell us your email address and name. Their app stores also deliver the apps.
- postcodes.io: turns a postcode into a place on the map. We send it the postcode only.
Authorities
We report kitchens’ sales to HMRC once a year as the reporting rules for digital platforms require, and we share data with the police, a court or a regulator where the law requires it or to protect someone from harm.
Outside the UK
Some of these providers are based in, or have parent companies in, the United States or the European Union. Where your data leaves the UK, it goes to a country the UK recognises as protecting it adequately (including US companies certified under the UK extension to the EU-US Data Privacy Framework) or under the UK’s International Data Transfer Addendum.
What we do not do
We do not sell or rent your data, we use no advertising trackers and no analytics software, and we do not build profiles of you for advertising. The order in which dishes appear follows the rules in our terms: what you searched for, how near the kitchen is and the price, or the order you choose. No decision with legal or similarly significant effects on you is made by a computer alone.
How long we keep it
- Your account: while it is open. When you delete it, it closes at once, saved cards and your record at Stripe are deleted at once, and your name, email, phone, addresses, notes, gift details, review text and notification records are erased 30 days later.
- Orders: the record of each order (what was sold, by whom, for how much) is kept for six years after the end of the financial year it was in, because tax and company law require it; after your account is erased, it is kept without your personal details.
- Kitchens: while the kitchen is on mamaPut, and its sales records and legal details for six years after, for tax and HMRC reporting.
- Applications: while we consider or work with you, and two years after our last contact if nothing comes of it. The waitlist: until you leave it, or twelve months after we launch near you.
- Logs and crash reports: logs for days rather than months; crash reports for up to 90 days.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, or to object to our using it, and to have it in a format another service can use. Where we rely on your consent, you can withdraw it at any time. Exercising these rights is free, and we will not treat you differently for it.
In the app, Your data under Account lets you download everything we hold about you and delete your account; Your details lets you correct your name and number and turn offers on or off. Notifications and location access are in your phone’s settings. For anything else, email info@mamaput.app. We may ask you to confirm who you are first, so we do not hand your data to someone else.
Deleting your account
In the mamaPut app, open Account, then Your data, then Delete my account. In the mamaPut Kitchen app, open Settings, then Delete your account, which closes the kitchen for good first; it cannot while an order is open or an event is booked. If you cannot use the app, email info@mamaput.app from the address on your account and ask us to delete it; we do it within one month and tell you when it is done.
Your account closes at once and you are signed out everywhere. Saved cards and your record at Stripe are deleted at once, and your name, email, phone, addresses, notes, gift details, review text and notification records are erased 30 days later. A deleted account cannot be signed into again. The record of your orders is kept without your details for six years for tax, and a closed kitchen’s sales and legal details likewise, as set out above.
Cookies and what is stored on your device
This website sets no cookies of its own and has no analytics. The bot check on our forms (Cloudflare Turnstile) may keep a short-lived value in your browser so you are not asked again; it does not track you across websites. The apps keep your sign-in in your phone’s secure storage, and your basket and choices on the phone, so the app works as you left it. Our team’s admin site uses a sign-in cookie, which only staff ever have.
Children
mamaPut is for adults. We do not knowingly collect data from children under 13; if you think a child has given us their details, tell us and we will delete them.
Complaints
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or by calling their helpline on 0303 123 1113.
Changes to this notice
We update this page when what we do with data changes, and the date at the top is always the current version. If a change matters to you and we have your email address, we tell you before it takes effect.