YumCycle Privacy Policy
This Privacy Policy describes how the YumCycle app and website (collectively, "YumCycle") collect, use, and protect your personal data. YumCycle is a surplus food marketplace operated by Grabnex Ecommerce Ltd, a company registered in England and Wales (Company Number 15288512). YumCycle helps home cooks, caterers, and restaurants in Leeds and Hull, United Kingdom, sell surplus food to local customers in real time, including via the LiveLit House TikTok LIVE integration. This policy explains how YumCycle handles your data and what your rights are under UK GDPR.
1. Who we are
YumCycle is operated by Grabnex Ecommerce Ltd, registered in England and Wales (Company Number: 15288512). Our registered address is in Leeds, United Kingdom.
You can contact YumCycle at hello@yumcycle.com.
2. What data YumCycle collects
YumCycle collects the following categories of personal data:
- Account data: name, email address, password (hashed), phone number, profile photo
- Location data: delivery addresses, postcode, city (Leeds or Hull)
- Order data: items ordered, quantities, order history, payment records
- Payment data: processed securely via Stripe. YumCycle does not store card numbers
- Dietary preferences: allergies and dietary requirements you choose to provide
- Carbon data: CO₂ savings calculated per order using WRAP UK 2024 emission factors
- TikTok data (LiveLit feature): If you connect your TikTok account to YumCycle as a seller, YumCycle collects your TikTok open_id, display name, profile picture (avatar_url) and username via TikTok Login Kit. Used solely to generate and populate your live order page at yumcycle.com/live/[username]. See section 4 for the field-by-field breakdown.
- Device data: IP address, device type, app version, push notification tokens
3. How YumCycle uses your data
- To process and fulfil food orders placed through the YumCycle app
- To calculate and display CO₂ savings per order
- To manage your carbon credit wallet
- To power the LiveLit House feature — linking your TikTok account to your YumCycle seller profile so viewers can order from your live stream
- To send order confirmation and delivery notifications
- To process payments via Stripe
- To improve the YumCycle platform and prevent fraud
- To comply with UK legal obligations including food safety and financial regulations
4. TikTok integration — data use within the YumCycle app
When you connect your TikTok account to YumCycle (available to sellers using the LiveLit House feature), YumCycle requests the following permissions via TikTok Login Kit. YumCycle lists exactly which field is read by which scope and how it is used inside the YumCycle app:
- user.info.basic
- open_id — saved on your YumCycle seller account as the stable identifier linking your TikTok and YumCycle accounts. Used only on the YumCycle backend to look up your seller record when a viewer opens your live order link.
- display_name — rendered as the heading on your public YumCycle live order page (yumcycle.com/live/[handle]), e.g. "Now cooking with [display_name]".
- avatar_url — rendered as your profile picture on the same YumCycle page so customers recognise who is cooking before ordering.
- user.info.profile
- username — used to construct your personalised live order URL yumcycle.com/live/[username] that you paste into your TikTok bio. Without this YumCycle cannot generate the link.
YumCycle does not request any other TikTok scopes. YumCycle does not access your videos, statistics, follower counts, messaging, or post on your behalf. Your TikTok data is never sold, shared with third parties, or used for advertising. You can disconnect your TikTok account at any time from your YumCycle seller profile settings, which deletes the open_id, username, display_name and avatar_url from the YumCycle database within 30 days.
5. Legal basis for processing
- Contract: processing your orders and payments
- Legitimate interests: improving the YumCycle platform, fraud prevention, carbon tracking
- Consent: dietary preferences, push notifications, TikTok account connection
- Legal obligation: food safety records, financial compliance
6. Who YumCycle shares data with
- Stripe: payment processing (Stripe Privacy Policy at stripe.com/privacy)
- MongoDB Atlas: database hosting (EU region)
- Render: server hosting (YumCycle backend)
- Resend: transactional email delivery
- Expo: push notification delivery
- TikTok: only data you share with YumCycle via TikTok Login Kit (see section 4)
YumCycle does not sell personal data to any third party. YumCycle does not use your data for behavioural advertising.
7. Data retention
YumCycle retains your account data for as long as your account is active. Order records are retained for 7 years to comply with HMRC financial record-keeping requirements. You may request deletion of your YumCycle account at any time (see section 9).
8. Your rights under UK GDPR
- Right to access your personal data
- Right to correct inaccurate data
- Right to erasure (right to be forgotten)
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent at any time
To exercise any of these rights, email hello@yumcycle.com. YumCycle will respond within 30 days.
9. Account deletion
You can delete your YumCycle account at any time from the app settings, or by emailing hello@yumcycle.com. On deletion, your personal data will be removed from YumCycle within 30 days, except where retention is required by law.
10. Cookies
The YumCycle website uses only essential cookies required for the platform to function. YumCycle does not use tracking or advertising cookies.
11. Security
All YumCycle data is transmitted over HTTPS. Passwords are hashed using bcrypt. Payment data is handled entirely by Stripe and never touches YumCycle servers. YumCycle conducts regular security reviews of its infrastructure.
12. Changes to this policy
YumCycle may update this Privacy Policy from time to time. You will be notified of significant changes by email or in-app notification. The date at the top of this page shows when it was last updated.
13. Contact and complaints
For any privacy questions about YumCycle, contact hello@yumcycle.com.
If you are unhappy with how YumCycle handles your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.