Privacy policy

Brisket & Bun is run by baba love.london Ltd, 28–30 Church Road, Worcester Park KT4 7RA. We decide how your details are used. For anything about your data, email info@brisketnbun.com or call 07905 843784.

• Your order: your name, phone number, email address, what you order, any notes and your pickup time. We use them to make your order, hand it to the right person and contact you if something changes. We need these to fulfil your order.
• Order emails: from info@brisketnbun.com we send a confirmation, a message when your order is ready, and one email after you collect it asking for a Google review. The first two are part of your order. The review request is in our legitimate interests, goes to every customer the same way, and comes with no reward. If you leave a review, Google handles it under its own terms.
• Payment: Square takes your payment. Your card details go to Square, never to us. If you save a card to your account, Square stores it. Square also handles payments under its own privacy notice.
• Your account (only if you create one): your first and last name, mobile number, email address and password (stored securely by our provider, never readable by us), and your past orders. We use them so you can sign in, reorder faster with saved details and cards, and get your welcome discount.
• Your location (only if you tap “Share my location”): your position while the order page is open, so we can see how far away you are and have your order ready as you arrive. Only our team sees it. It stops when you arrive or tap “Stop sharing” (which also wipes it), and it's deleted within two days either way. This is based on your consent, which you can withdraw at any time.
• Keeping the site safe: to stop people guessing passwords or abusing checkout, we count attempts from each internet connection. We store a scrambled code instead of your IP address, and delete the counts within a day.
• Visits to the site: we use Umami to count visits and clicks (for example, how many people tap “Order online”). It doesn't use cookies or record who you are. To be left out entirely, open any page with ?notrack at the end of the address.

Orders through Uber Eats or Deliveroo are covered by their privacy policies. They don't give us your contact details.

• Square: orders, payments, saved cards, receipts.
• Supabase: accounts, and the details for today's pickups (stored in London).
• Netlify: runs the website.
• Namecheap Private Email: our email, which sends the order emails.
• Umami: visit counts.

They only use your details to provide their service to us. Some of them process data outside the UK, including in the US. Where they do, they use the safeguards UK law requires, such as the UK–US data bridge or approved contract terms.

• Location and pickup tracking: deleted within two days.
• Security counts: deleted within a day.
• Orders and payments: six years, because tax law requires it.
• Your account: until you ask us to delete it.

We only use what the site needs to work: a cookie that keeps you signed in, and two notes stored on your device (one so location sharing can carry on if you reopen your order page, one if you've opted out of visit counts). No advertising or tracking cookies, so there's no cookie banner.

You can ask us for a copy of your details, to correct them, to delete them (including your account), or to stop using them for something. Email info@brisketnbun.com and we'll reply within a month. We may need to keep order records for tax.

If you're unhappy with how we've handled your details, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

If we change how we use your details, we'll update this page and the date at the top.