Privacy policy

Who we are

Carverly runs an online marketplace where you can order from independent butchers and other food shops for collection. This policy explains what personal data we collect when you use carverly.co.uk, what we do with it, who we share it with and the rights you have over it.

Carverly is the data controller for your account and for how the marketplace works. Each shop you order from is the controller for the order data it needs to prepare and hand over your order. Carverly processes that data on the shop’s behalf under a data processing agreement, so the shop can only use it for your order.

If you have a question about this policy or your data, email privacy@carverly.co.uk.

What we collect

Account details: your name, email address, phone number and password (stored only as a secure hash). If you sign in with Google or Apple, we receive your name and email address from them, and nothing else.

Orders: what you ordered, from which shop, the collection time, any note you add, weighed weights and prices, and the order’s history (placed, accepted, ready, collected). Orders are kept with your account, along with the phone number you give for the shop to reach you. Orders placed as a guest before accounts were needed move onto your account once you confirm the same email address.

Payments: card details go straight to our payment provider and never touch our servers. We keep a record of each payment, hold, refund and top-up, the brand and last four digits of your card, and a code from our payment provider that identifies the card without revealing its number, so a voucher code limited to one per person can’t be used again on the same card.

Messages and reviews: messages you send to a shop about an order, problems you report, and reviews you write, along with the shop’s replies.

Preferences: your favourite shops, whether you’ve asked to hear when a shop or order book opens near you, your marketing choices, and your notification settings.

Location: if you share your location or enter a postcode, we use it to show shops near you. We keep it on your device for the session; we don’t store your location against your account.

Technical data: your IP address, browser and device type, and error reports when something goes wrong, which we use to keep the service secure and working.

How we use it, and why we’re allowed to

To take, prepare and charge for your orders, including holding and capturing the weighed price, and sending you the order emails, texts and notifications that go with them. We do this because it’s needed to perform our contract with you.

To run your account, let you see past orders, keep your favourites and let you review shops you’ve ordered from. This is also part of our contract with you.

To keep Carverly safe and working: preventing fraud and abuse, rate-limiting sign-in and checkout, investigating problems and handling disputes. We do this in our legitimate interest in running a secure, reliable service.

To keep financial and tax records, as the law requires.

To tell you about new shops and order books near you, only if you’ve said yes. We rely on your consent for this and you can withdraw it at any time.

We don’t sell your data, and we don’t use it for advertising or to build profiles of you.

Who we share it with

The shop you order from sees your name, phone number, email, order and collection details, and any messages or notes you send it. It uses them to prepare and hand over your order, and to contact you about it.

We use a small number of carefully chosen service providers who process data on our behalf and only on our instructions, for things like taking payments, sending emails and texts, hosting and storage, and diagnosing errors. Each is bound by a contract that requires them to keep your data secure. Google or Apple are involved only if you choose to sign in with them.

We may share data if the law requires it, to protect people from harm, or as part of a sale or restructuring of Carverly, in which case this policy would continue to apply.

Where it lives

Your data is stored on servers in the UK or EU. Some of our providers may process data outside the UK; where they do, it’s protected by UK adequacy regulations or standard contractual clauses. Backups are encrypted and kept for 30 days.

How long we keep it

Your account stays until you ask us to close it. When you do, we delete or anonymise your account details, favourites and preferences.

Order and payment records are kept for six years after the order, because we and the shops need them for accounting, tax and handling disputes. If you delete your account, the orders stay with your name and contact details taken off, and no longer linked to a login. The card code above stays with the order, to stop voucher codes being used twice.

Reviews stay up until you ask us to remove them or your account is closed. They show your first name and last initial only.

Error reports and logs are kept for up to 90 days. Deleted data can stay in encrypted backups for up to 30 days before it’s gone for good.

Marketing

We only send marketing with your consent, which we record along with when you gave it. Every marketing email has a one-click unsubscribe, and you can change your mind in your account at any time. Emails, texts and notifications about an order you’ve placed are service messages, not marketing, so you’ll still get them.

Keeping it secure

All traffic to Carverly is encrypted in transit. Passwords are hashed, shop owners can turn on two-factor sign-in, and access to our systems is limited to the people who need it. When our team signs in to a shop to help with support, that access is logged.

Your rights

You can ask us for a copy of your data, ask us to correct anything that’s wrong, ask us to delete it, object to how we use it, or ask us to restrict it while we look into a concern. You can also ask for your data in a portable format. To delete your account, use “Delete your account” at the bottom of your account page: it takes effect straight away. For anything else, email privacy@carverly.co.uk and we’ll reply within one month.

We may need to confirm it’s you before we act, and there are some things we have to keep, like order records the law requires, even after you ask us to delete them.

If you’re not happy with how we’ve handled your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

Children

Carverly isn’t meant for children. You need to be 18 or over to create an account or place an order.

Changes to this policy

If we change this policy in a way that matters, we’ll update the date at the top and, if you have an account, let you know by email before the change takes effect.