Privacy Policy

Last updated: 4 November 2026

This policy explains how HatchGrab Ltd ("we", "us", "our") collects and uses personal data across two connected services:

• HatchGrab (hatchgrab.com) — software used by food truck operators to take and manage orders.
• Village Foodie (villagefoodie.co.uk) — a public directory that helps people find food trucks trading near them.

It also covers the HatchGrab mobile and tablet apps for iOS and Android.

If you only came here because you ordered food from a truck, the section "If you ordered from a food truck" is the part that applies to you.

Some countries have extra rules. Where they apply to you, they're on our Country-specific terms page, which forms part of this policy.

1. Who we are

HatchGrab Ltd is a company registered in England and Wales.

• Company number: 17381557
• Registered address: Rosedale, Bury Road, Wickham Street, CB8 8PD, United Kingdom
• Contact for privacy questions: privacy@hatchgrab.com

We are the data controller for the personal data described in sections 3 and 5. For the data described in section 4, we act as a processor on behalf of the food truck you ordered from.

2. The two different roles we play

This distinction matters, so it is worth stating plainly.

When you are a food truck operator using HatchGrab, we are the controller of your account data. We decide what we collect and why, and you can exercise your rights directly against us.

When you are a customer ordering food from a truck, the truck is the controller of your order data. They decide what they collect and how they use it. We process that data on their behalf, under their instructions, as the provider of the software they use. If you want your order data deleted or corrected, the truck is the right first point of contact — though you can also contact us and we will help.

3. If you are a food truck operator

What we collect

• Account details: your name, email address, phone number, and the password you set (stored only as a cryptographic hash — we never see or store the password itself).
• Business details: trading name, business contact email and phone, business address, logo, menu, pricing, opening times and trading schedule.
• Usage data: which features you use, orders processed, and settings you change.
• Device data: for the mobile apps, a device identifier we generate, the device platform, and a push notification token if you enable notifications.
• Support correspondence: anything you send us by email or message.
• Payment and billing information, if and when paid subscriptions are activated. Card details are handled by our payment provider and are never stored on our systems.

Why we use it, and our lawful basis

Where we rely on legitimate interests, our interest is in operating and improving a reliable service. We have considered your rights and do not believe this processing overrides them. You can object at any time — see section 8.

Biometric unlock. If you turn on Face ID, Touch ID or fingerprint unlock in the app, the check happens entirely on your device and is handled by the operating system. We never receive, see or store biometric data. We only receive a yes-or-no result.

Compliance documents. If you keep your certificates, insurance and other compliance documents in HatchGrab, we store the files and the details you save with them. When you upload one, we send it to Google's Gemini service, the same one that reads menus, to fill in details such as who issued it and when it expires; you check them before anything is saved. Your documents are shared only with the people you choose to send them to, through links that expire, and we keep them until you delete them or close your account.

4. If you ordered from a food truck

When you place an order through a truck's ordering page, we collect and pass to that truck:

• Your name.
• Your email address, if you provide one, so the truck can send your confirmation and let you know your order is ready.
• Your phone number, if you provide one.
• Your order: the items, any notes or allergy information you add, the collection time, and the amount.

We do not sell this data, use it for our own marketing, or share it with other trucks. We use it only to deliver the ordering service to the truck you ordered from.

The truck decides how long to keep your details and how they contact you afterwards. Their own privacy practices apply to that. If you are not sure who the truck is, contact us at privacy@hatchgrab.com and we will point you to them.

Allergen information. Where a truck publishes allergen information, we display what the truck has confirmed. We do not verify it independently. Always tell the truck directly about a serious allergy.

5. If you visit our websites

We collect basic technical data automatically: IP address, browser type, device type, pages viewed, and the site you arrived from. We use this to keep the sites working and secure, and to understand which pages are useful.

Cookies and browser storage. We use cookies and your browser's local storage only where they are strictly necessary to make the sites work — signing you in, keeping your basket, remembering your preferences, such as your country and postcode, and, while you try the demo, which demo orders you placed. We do not use advertising or tracking cookies, and we do not track you across other websites.

Product analytics. We use PostHog to understand which pages and features are used: pages viewed and clicks, with basic browser and device details. It stores nothing in your browser — no cookies and no local storage — so it cannot recognise you from one visit to the next. It does not run on the operator dashboard, kitchen screen or management pages, or on truck pages shown on an operator's own website. It does run on the HatchGrab demo, which shows a sample kitchen screen.

You can block or delete cookies in your browser settings, though parts of the site may stop working if you block the necessary ones.

If you try the HatchGrab demo

When you build a demo from the HatchGrab website, we ask for your email address. We use it to send you a link to your demo and may contact you about setting up HatchGrab; we do this because it is in our legitimate interest to follow up on a demo you asked for. If you tick "Send me occasional tips and news from HatchGrab", we will also send you occasional tips and news, based on your consent; you can unsubscribe at any time, and not ticking it does not affect your demo.

We also keep the menu you upload (a photo, PDF or pasted text) and the menu we read from it. We send it to Google's Gemini service so it can read the dishes and prices, and we keep it so we can check how well that worked and help you if you go on to set up HatchGrab. It is stored privately; only HatchGrab staff can open it.

We delete your demo email, the menu file and the demo itself when the demo expires: 24 hours after you build it, or 14 days if you ask us to keep it. If you sign up, your menu moves into your account and your account's privacy terms apply from then on; we keep the demo record for up to 30 days so the menu can move across, then delete it.

We keep simple counts of how far demos get, such as "a demo was built" or "an order was placed". They contain no email address, and once your demo is deleted they can no longer be linked to you.

Demos we prepare for a food truck we have contacted are kept for up to 30 days and do not ask for an email.

If you use our contact form

If you send us a message through the contact form on the HatchGrab website, we handle it ourselves: we keep your message and the details you enter, and send them to our team by email through Brevo. We use them only to reply to you, and keep them for up to 24 months. To stop the form being misused, we also keep a scrambled version of your IP address with your message.

6. Who we share data with

We use a small number of service providers, each of which processes data only on our instructions:

We may also disclose data where we are required to by law, or to establish or defend legal claims.

We do not sell personal data, and we do not share it for advertising.

International transfers. Your account data and order data are stored and processed in the United Kingdom. Some things are handled outside it: menu extraction and WhatsApp automatic replies, which use a Google service in the United States; WhatsApp message delivery, which is handled by Meta in the United States; payments, which are handled by Stripe in the United States; and push notifications, which are delivered by Apple and Google in the United States. Where data leaves the UK, the transfer is covered by UK adequacy regulations or by the International Data Transfer Agreement or Addendum, which provide appropriate safeguards. You can ask us for details of the safeguards that apply.

As our service grows we may add providers, including an SMS provider. We will update this list before they begin processing your data.

7. How long we keep data

• Operator accounts: for as long as the account is active, and for 12 months after it closes.
• Order records containing customer details: 12 months, after which the customer's name, email and phone, and any notes on the order (including allergy or dietary notes), are removed and only anonymised order data remains.
• Unfinished online card orders (started but never placed): deleted within a day of expiring. If a card payment was still being held, they are deleted within a day of that hold being released.
• WhatsApp messages your customers send a truck, and our automatic replies: 12 months.
• Anonymised order and sales data: retained indefinitely, so trucks keep their trading history. This data cannot be linked back to an individual.
• Accounting records: six years from the end of the relevant financial year, as UK tax law requires.
• Support correspondence: 24 months.
• Technical and security logs: 90 days.
• Demo data: 24 hours, or 14 days if you ask us to keep your demo; up to 30 days if you sign up from it, or for demos we prepare for a food truck we have contacted (see section 5).

Our email provider keeps delivery logs for a limited time under its own retention policy.

We delete or anonymise data once these periods end.

8. Your rights

Under UK data protection law you have the right to:

• ask what personal data we hold about you, and get a copy;
• have inaccurate data corrected;
• have your data deleted, in certain circumstances;
• restrict how we use your data, in certain circumstances;
• receive your data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time, where we rely on consent.

To exercise any of these, email privacy@hatchgrab.com. We will respond within one month.

Deleting your account. Operators can request account deletion from within the app or by emailing privacy@hatchgrab.com. We will delete your account and personal data, except where we are required to retain records for accounting or legal reasons.

Complaints. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would appreciate the chance to address it first.

9. Security

We protect data with encryption in transit, access controls, hashed passwords, and restricted administrative access. No system is completely secure, but we take reasonable steps and review them as the service grows.

10. Children

Our services are not directed at children. We do not knowingly collect data from anyone under 13. If you believe a child has given us their data, contact us and we will delete it.

11. Changes to this policy

We will update this page when our practices change, and we will change the date at the top. If a change materially affects you, we will tell you directly.

12. Contact

HatchGrab Ltd, Rosedale, Bury Road, Wickham Street, CB8 8PD, United Kingdom privacy@hatchgrab.com