Privacy policy
Last updated 30 October 2026
We only collect what we need to cook and deliver your meals, and we never sell your details.
Who we are
Chopchaw is responsible for your personal information (the "controller"). Chopchaw is a trading name of . Registered office: . Contact us about anything on this page at hello@chopchaw.co.uk.
What we collect
- When you order: your name, email address, mobile number, delivery address and postcode, where to leave your box, any note for the driver, and your password (stored securely by our login provider; we can't see it).
- Your box: the meals and add-ons you choose, your taste answers if you use Chef's choice, the weeks you skip or pause, and your order and payment history.
- Payments: Stripe handles your card. We only see the card type, the last 4 digits and the expiry date.
- The waiting list: your name, email and postcode.
- Emails: which emails you've agreed to get, and when you unsubscribed.
Please don't put health details, such as allergies, in the driver note. If you have an allergy, email us before you order.
Why we use it, and our legal basis
| What for | Legal basis |
|---|---|
| Taking your order, charging you, cooking, labelling and delivering your box, texting your delivery window, and service emails about your box and payments | Contract: we need it to provide what you ordered |
| Weekly menu and offer emails, and the Tuesday reminder | Consent for menu and offers (you tick the box); legitimate interests for the reminder about your own box. Every one of these emails has a one-click unsubscribe link, and you can turn them off in your account. |
| The waiting list: telling you when we deliver to your area | Your request (steps before a contract) |
| Keeping order and payment records | Legal obligation (tax and accounting law) |
| Keeping the site and your account secure, preventing fraud | Legitimate interests |
Who we share it with
Only with the services that help us run Chopchaw, under contracts that protect your data:
- Supabase: our database and logins, hosted in the UK (London region).
- Stripe: card payments.
- Hostinger: our website and email.
- postcodes.io: when you type a postcode, we send only the postcode to look up your area.
- Google Fonts: our pages load fonts from Google, which receives your IP address.
- Our kitchen and delivery team see your name, address, phone number, delivery note and box contents to prepare and deliver your order.
Some of these companies may process data outside the UK. When they do, they use the safeguards UK law requires, such as the UK's International Data Transfer Agreement or adequacy regulations.
How long we keep it
- Your account and box details: while you're a customer, and for 2 years after your last order so you can come back easily. Ask us and we'll delete them sooner.
- Order and payment records: 6 years, as tax law requires.
- The waiting list: until you unsubscribe, or 2 years after you join if we never reach your area.
Cookies and storage
We don't use advertising or tracking cookies, and we don't run analytics. Your browser stores two things, both needed for what you asked us to do:
chopbox-10k-v2: the box you're building, so it's still there if you leave and come back.chopchaw-account: keeps you logged in to your account on this device. Logging out removes it.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to send it to you in a portable format. Email hello@chopchaw.co.uk and we'll reply within one month. You can change your email choices in your account at any time.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
If we change this policy in a way that affects you, we'll email you. The date at the top shows when it last changed.