Skip to main content
bite.je

Privacy Policy

Last updated: 30 July 2026

1. Who we are

bite.je ("we", "us", "our") is a food delivery and collection platform operating in Jersey, Channel Islands. We are a data controller for the purposes of the Data Protection (Jersey) Law 2018 (DPJL 2018) and are subject to the oversight of the Jersey Office of the Information Commissioner (JOIC).

2. What data we collect

  • Account data: Name, email address, password (hashed by Supabase Auth)
  • Contact and location data: Phone number, delivery address, postcode, parish, delivery coordinates and optional what3words address
  • Order data: Order history, delivery preferences, instructions, refunds and payment status
  • Driver and partner data: Restaurant account details, menu content, driver identity, contact details, availability, assigned routes and location while delivery features are in use
  • Communications: Support messages and transactional email, SMS or WhatsApp delivery records
  • Technical data: IP address, browser and device information, security logs and diagnostic information
  • Payment data: Processed by Worldpay or Stripe, depending on the checkout route in use. We store operational identifiers, payment and refund status, amounts and fraud or failure outcomes needed to support and reconcile an order. We never see or store your full card number or card security code.
  • Consent records: Cookie consent, T&C acceptance, marketing opt-in timestamps

3. Lawful basis for processing

Under Schedule 2 of DPJL 2018:

  • Contract: Processing your orders, managing your account
  • Legitimate interest: Platform security, fraud prevention, service improvement and resolving disputes
  • Consent: Marketing communications (separate opt-in)
  • Legal obligation: Financial records retention, food safety compliance

4. Data processors

  • Supabase Inc. — database and authentication (AWS eu-west-1)
  • Worldpay and Stripe — payment processing, depending on the checkout route in use
  • Vercel Inc. — website hosting and delivery
  • Resend — transactional email
  • Twilio or Gupshup — SMS and WhatsApp notifications, where enabled
  • Google — maps, geocoding and route calculation, where those features are used
  • what3words — resolving an optional three-word delivery address
  • Anthropic — extracting menu data from restaurant uploads and, where configured, categorising and summarising dispute descriptions for staff review

Jersey has EU adequacy status, enabling data transfers to/from the EEA. For transfers to processors outside Jersey or the EEA, we use an adequacy basis or appropriate contractual and organizational safeguards, as applicable. Restaurant partners receive the customer details required to fulfil an order and act as independent controllers for their own legal and operational responsibilities.

5. Data retention

The periods below are working maximums subject to the approved retention schedule, legal holds and any shorter operational period that is sufficient. They must not be read as a claim that deletion is already automated for every system.

  • Account data: retained while the account is active, then deleted or anonymised unless required for legal claims or compliance
  • Order, refund and accounting records: generally retained for up to 7 years to meet tax, accounting, fraud and dispute obligations
  • Driver location and route data: retained only for as long as needed for delivery, safety, support and dispute handling
  • Security and diagnostic logs: retained for a proportionate period based on security and operational need
  • Payment records: retained by the payment provider under its applicable retention policy

6. Your rights

Under DPJL 2018, you have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request erasure of your data
  • Object to processing
  • Request restriction of processing
  • Data portability
  • Ask for human review of a solely automated decision that has a significant effect
  • Withdraw consent for marketing at any time

We will respond to data subject requests within 4 weeks as required by DPJL 2018. You can download a machine-readable copy of your account data or request account deletion from your account settings.

7. Cookies

We use essential cookies required for the platform to function. Analytics cookies will be used only if you choose "Accept all"; no advertising cookies are used. See our Cookie Policy for details.

8. Security & children

We use access controls, encryption in transit and other proportionate technical and organizational measures to protect personal data. No online service is completely secure. bite.je is not directed to children under 13. A person placing an order containing an age-restricted product must be at least 18.

9. Contact & complaints

For data protection enquiries, contact us at privacy@bite.je.

If you are unsatisfied with our response, you have the right to complain to the Jersey Office of the Information Commissioner at jerseyoic.org.