Privacy notice

Who we are and how to contact us

OneBigOrder ("we", "us", "our") is the data controller for personal data processed through our website, application and related services. Our contact address for anything about this notice or your personal data is privacy@onebigorder.com.

The personal data we collect

Identity and account data. Your name or chosen display name, username, email address, sign-in method (email and password or Google), profile country, avatar photo and language preference.

Group information. The groups you belong to, your roles, your hubs, your order lines, quantities and prices, invoices, payment records, balances, fee settings, delivery and collection details, and the round history of your groups.

Private contact details. Your full name, phone number, email address and home address are private by default. They are shown to the Captain team of a group you have joined only where that group needs them, for example for delivery or contact. Members of a group never see each other's phone number, email address or home address.

Order and payment records. What was ordered, the amounts charged, whether an order was marked paid, pay on delivery, confirmed or not received, and any payee or account details a group enters. Bank details a group enters are encrypted and shown only to that group's members. We never ask you for card numbers or bank log-ins, and we do not collect group money.

Messages. In-app conversations between members and Captain teams, including operational updates and private financial details of your group.

Reviews and quality records. Ratings of collected items, products, suppliers and deliveries, and supplier scorecards.

Supplier listing data. Business details, products, prices, offers and performance records for businesses listed on the supplier network.

Subscription data. Your plan, price and payment status. Subscription payments are processed by Stripe; we do not receive full card details.

Technical data. Sign-in history, device and browser information, IP address and user agent, used for security and to evidence your acceptance of legal documents.

Cookie choices. Your consent choices, recorded against a server-issued identifier rather than anything we ask your browser to store.

How we use your personal data

We use your personal data only where we have a lawful basis:

• To provide the service (performance of a contract). Creating and running your account, groups, order rounds, purchase orders, invoices, payment records, balances, messages and files.
• To send you service communications (performance of a contract; legitimate interests). Essential email such as order updates, payment requests and legal notices. We respect quiet hours for non-urgent notifications and combine repeated updates.
• To keep the service safe (legitimate interests). Audit logs of sensitive actions, abuse and fraud prevention, moderation of reports, and securing sign-ins.
• To take subscription payments (performance of a contract). Through Stripe as described below.
• To comply with the law and defend claims (legal obligation; legitimate interests). Retaining records where the law requires it and handling complaints or disputes.
• To market, only with your consent. Non-essential marketing email is sent only where you have opted in, and you can opt out at any time.
• To improve the service (legitimate interests). Aggregated statistics that do not identify you.

Who we share your personal data with

Other people in your groups. Members see each other's display names and group activity. Your private contact details are shown only to the Captain team of a group you have joined, and only where that group needs them. Public pages never show member names, flats, phone numbers, email addresses, individual order lines, balances or bank details.

Suppliers. For each purchase order, the products, quantities, prices and delivery information needed to fulfil it. Public ratings where a group has chosen to share them. Suppliers never see group member contact details.

Our processors. Supabase (database, hosting and authentication), Microsoft Azure (private file storage, and email delivery through Azure Communication Services) and Stripe (subscription payment processing). Each is bound by contract to process personal data only on our instructions.

Legal and business reasons. We may disclose personal data where the law requires it, to protect someone's vital interests, or to a buyer of our business if we ever sell or merge.

We never sell your personal data.

International transfers

Some of our providers may process personal data outside the United Kingdom. Where that happens we rely on the UK adequacy regulations, the International Data Transfer Addendum or other approved safeguards.

How long we keep your personal data

We keep personal data only as long as necessary:

• Account data is kept while your account is active. If you delete your account, deletion is reversible for 30 days, after which we erase your personal data.
• Invoices, payment records and audit events are kept for the period needed for the group's records and our legal duties, including tax and accounting rules.
• Shared group records a group needs, such as its invoice and payment history, are preserved even after a member leaves, with the member's personal details removed where possible.
• Legal acceptance records are kept as evidence of which document version you accepted and when.
• Cookie choices are kept until you change them or the record expires.

Your rights

Under data protection law you have the right to:

• be told how your data is used, through this notice;
• get a copy of your personal data;
• have inaccurate data corrected;
• have your data erased, subject to retention duties and shared records;
• restrict or object to some processing;
• get your data in a portable format where technically possible;
• withdraw consent where consent is our lawful basis, at any time.

To exercise any right, contact privacy@onebigorder.com. We respond within one month and may ask you to verify your identity. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies and similar technologies

By default we store only necessary items: keeping you signed in, protecting the service and remembering your cookie choice. Optional preference and analytics storage stays switched off until you consent. The consent banner gives Accept all, Reject all and Settings equal prominence, and you can change your choice at any time from the Cookie settings link in the footer. Our Cookie policy lists every item we store and how long it lasts.

Children

The service is not directed at children under 16 and we do not knowingly collect their data. If we learn an account belongs to someone under 16 we delete it.

How we protect your data

Personal data is encrypted in transit and sensitive fields are encrypted at rest. Access is controlled with strict permissions, every data table is scoped by row-level security, administrative actions are audited, and files are stored privately with purpose-scoped, short-lived access links.

Automated decision-making

We do not make decisions about you using automated processing that has a legal or similarly significant effect.

Changes to this notice

We may update this notice. Significant changes are announced in advance through the service and, where required, by email, and the effective date and version are shown on the published document. You may be asked to re-accept the notice where the change requires it.

Contact and complaints

Contact privacy@onebigorder.com for any question about your personal data. You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113.