Privacy Policy
This Privacy Policy explains how CookSocket Ltd uses personal information when people browse CookSocket, create an account, place or fulfil an order, operate a Listing, communicate, or use payment and payout services.
Last updated:
On this page
1. Who this policy applies to
This policy applies to visitors, customers and Hosts who use the CookSocket website, app, marketplace, support channels or related services. Hosts are independent businesses and may have their own legal duties when they receive customer information to fulfil an order.
2. Account and authentication information
We may process your Firebase user identifier, sign-in provider, name, email address, phone number, profile image, date of birth where supplied, account role, locale, currency, account status and legal-acceptance timestamps. Social sign-in providers may supply identity information according to the permissions you grant them. We use this information to authenticate you, operate your account, provide customer or Host features, secure the service and communicate with you.
3. Addresses and location
We may process saved addresses, postcode, contact details attached to an address, address type, default status and coordinates supplied by an address record. If you explicitly choose current location, your browser or device may provide coordinates used for nearby discovery and search. You can decline precise location and use the available fallback experience. Listing addresses and coordinates may be shown where needed for collection, dine-in, mapping or fulfilment.
4. Baskets and orders
We process basket contents, quantities, item notes, selected Listing, service type, service date, time slot, address reference, dine-in details, payment choice, promotion code and backend-calculated price information. Orders may contain customer and Host snapshots, contact and address information, ordered items, fulfilment details, status history, cancellation information, prices, payment status and references needed to provide, support and account for the transaction.
5. Messages and support communications
CookSocket may process message-thread identifiers, participant identifiers, Listing and order context, display names, message text, timestamps, message summaries and read state. We also process support requests, feedback and emails you send to us. These records support fulfilment, customer service, safety, dispute handling and platform operations.
6. Reviews and ratings
When you submit or report a review, we may process the associated customer, order, Listing and item identifiers, display name, anonymous-display choice, ratings, comments, moderation status, reports and any Host response. We use this information to publish genuine feedback, calculate review summaries, investigate reports and enforce our policies.
7. Host, Listing and product information
For Hosts, we may process business and Listing names, descriptions, Listing type, address and contact details, services, facilities, opening hours, blocked dates, operating settings, menu or product information, prices, inventory, availability, discounts, dietary and allergen information, certificate and hygiene information, and identifiers linking the Listing to its Host. Much of this information is intended for publication to customers.
8. Uploaded images and media
We may process profile, Listing, Menu, product, certificate or other permitted images together with storage paths, URLs and related metadata. Images may be stored using Firebase Storage or another currently configured media service. Hosts and users must only upload content they are entitled to provide.
9. Payments and Stripe identifiers
Stripe handles sensitive card entry. CookSocket does not receive or store your raw card number or card security code. CookSocket may receive or store Stripe Customer, PaymentIntent, SetupIntent, payment-method and Connected Account identifiers; payment amount and currency; authorisation, capture, payment, refund or dispute status; and references used to reconcile an order.
10. Saved payment-method information
Where saved payment methods are enabled, Stripe stores the underlying payment credentials. CookSocket may receive safe display information including payment-method identifier, card brand, last four digits, expiry month and year, and whether a method is the default. We use this information to show and manage the payment methods connected to your CookSocket account.
11. Host payout information
Stripe Connect handles Host onboarding and full payout credentials. CookSocket does not receive or store full bank-account credentials. CookSocket may receive or store the Stripe Connected Account identifier, onboarding and verification status, charges and payouts availability, outstanding requirements, external-account type, bank name and bank-account last four digits where Stripe provides them.
12. Push notifications and device information
If you enable browser or app notifications, we may process a Firebase Cloud Messaging token, device identifier, platform, current customer or Host routing role, permission state and update timestamp. We use this information to deliver and route relevant order and message notifications. You can change notification permission using your browser or device settings.
13. Technical and usage information
Our systems and service providers may process technical information such as IP address, device or browser type, operating system, app version, request timing, pages or screens used, error information and security events. Current Web code does not include an advertising pixel or an active Web analytics SDK. The iOS source contains analytics integrations whose production collection settings must be kept under review.
15. How we use information
We use personal information to authenticate accounts; provide nearby discovery, search and mapping; create and manage Listings; operate baskets, orders, payments and payouts; support delivery, takeaway and dine-in; enable messaging, reviews and notifications; provide support; prevent fraud and misuse; secure and troubleshoot the service; meet legal and accounting duties; and improve CookSocket.
16. Legal bases
Where UK data-protection law applies, our legal basis depends on the processing. We may rely on contract to provide an account, order or Host service; legal obligation for tax, accounting, safety or regulatory records; legitimate interests to secure and operate the marketplace, prevent misuse, support users and improve reliability; and consent for optional permissions or non-essential technologies where consent is required. Contact privacy@cooksocket.com if you would like more information about the basis used for a particular activity.
18. Service providers and recipients
Current integrations include Google Firebase for authentication, storage, messaging, push notifications and Remote Config; Stripe for payments, saved payment methods and Connect payouts; Google, Apple and Meta/Facebook for supported social sign-in; and Google Maps or native mapping services for location display and directions. We also use database, hosting and email infrastructure to operate and support the service.
19. Legal and safety disclosures
We may disclose information where required by law or a valid legal process, to protect users or the public, to investigate fraud or misuse, to enforce our agreements, or in connection with professional advice or a business reorganisation. We do not sell personal information.
20. International transfers
Some providers may process information outside the United Kingdom. Where required, CookSocket Ltd uses an appropriate transfer mechanism and safeguards. Contact privacy@cooksocket.com for more information about safeguards relevant to a particular provider or transfer.
21. Retention
We keep information only for as long as reasonably needed for the purpose for which it was collected and for applicable legal, accounting, tax, safety, fraud-prevention, payment and dispute requirements. Different records require different retention periods, and transaction records may need to remain after account access ends. No single deletion period applies to every category.
22. Your rights
Depending on the circumstances, you may have rights to be informed, access your information, correct inaccurate information, request erasure, restrict processing, object to processing, receive portable information where applicable, and withdraw consent where processing relies on consent. You may also complain to the UK Information Commissioner’s Office. Some rights are not absolute, and lawful retention obligations may continue to apply. Contact privacy@cooksocket.com to make a privacy request.
23. Account deletion
Authenticated users can submit a deletion request through the available account controls. The current process restricts account access and archives or schedules processing of certain records. Some transaction, legal, safety or business records may need to be retained, and not every data category is necessarily removed immediately. See the Data deletion page for the current process and contact support@cooksocket.com if you cannot access your account.
24. Age
Public Listings may be browsed without an account. You must be at least 18 years old to create or use a CookSocket account, place an order, operate a Listing, or use payment or payout services. CookSocket does not currently claim to provide technical age-verification for every sign-in method, and users must provide truthful eligibility information.
25. Security, changes and contact
We use technical and organisational measures intended to protect personal information, but no online service can guarantee absolute security. We may update this policy as the service, providers or legal requirements change and will provide appropriate notice for material changes. Questions can be sent to privacy@cooksocket.com, and current company information is available on the Company information page.