Legal · Last updated 29 October 2026

Privacy Policy

What personal information PrepHub collects, why, who it's shared with, and your rights.

1. Who's responsible for your data

Build Orbit Ltd (“PrepHub”), registered in Scotland (number SC905496), 18 Sauchie Crescent, Kinglassie, Lochgelly, Scotland, KY5 0YZ, is the controller of the personal data in your PrepHub account. Questions or requests: privacy@prephubuk.co.uk.

When you order from a kitchen, that kitchen also receives the details it needs to prepare and hand over your order, and is responsible for how it uses them in running its business.

2. What we collect

• Account details: your name, email address, password (stored only as a secure hash), and optionally your phone number and date of birth.
• Allergy and dietary information: any allergens, notes and dietary preference you choose to record. Allergy information is health data, so we only hold it with your explicit consent (see section 4).
• Orders: what you ordered, from which kitchen, collection or delivery choices, delivery addresses, and order history.
• Payments: payment amounts, status and method. Card details are taken and held by Stripe, not by PrepHub.
• Messages and reviews: messages between you and kitchens (including replies you send by email), contact-form messages, and reviews you leave.
• Security information: sign-in records and, if you turn it on, two-factor sign-in settings (stored encrypted).
• Email records: which emails we've sent you and whether they were delivered.
• Usage information: the pages you visit on PrepHub, the site that sent you here, whether you're on a phone or a computer, how long you spend on each page, which buttons, tabs, pop-ups and form fields you use (by their label, never what you type), signs you got stuck (a button clicked repeatedly, a click that did nothing, or a page error just after a click), and key actions such as signing in, starting a basket or starting checkout. If you sign in during a visit, that day's visit is linked to your account, including pages you viewed just before signing in. It's counted without cookies: if you're not signed in, you're counted with a code made from your connection that changes every day, can't be turned back into your IP address, and can't follow you from one day to the next.
• Enhanced analytics, only if you agree: a cookie that recognises your device on later visits, and session recordings of how you use pages (clicks, scrolling and what changes on screen, never what you type; on account and kitchen admin pages all text is hidden too).
• Technical information: your IP address and browser details, used briefly to keep the site secure (for example, to limit repeated sign-in attempts).

3. Why we use it, and our legal basis

4. Allergy information

Recording allergies is optional. If you do, you give your explicit consent for us to store it and share it with the kitchens you order from, so they can take it into account. You can change or delete it at any time in your account, which withdraws your consent from then on.

5. Who we share it with

• The kitchens you order from, for your orders and messages. A kitchen also sees visitor numbers for its own storefront and, for its own customers who are signed in, when they visited its storefront and which of its pages they viewed. Visitors who aren't signed in are shown to kitchens only as guests.
• Stripe (payments), Resend (sending and receiving email), Microsoft Azure (hosting the website), Akamai / Linode (database and file storage). These act only on our instructions.
• Address and map services: when you search for an address or view a map, your search or location is sent to postcodes.io, OpenStreetMap (Nominatim) and Esri map tiles to look it up or draw the map.
• Authorities, where the law requires it.

We don't sell your personal data, and we don't use advertising trackers.

6. Data outside the UK

Some of these providers process data outside the UK (for example, in the EU or the United States). Where they do, we rely on UK adequacy regulations or the UK's approved data transfer safeguards.

7. How long we keep it

• Account details: while your account is open.
• Order and payment records: 6 years after the order, for tax and accounting.
• Messages and email records: while your account is open, then deleted or anonymised with it.
• Usage information: page-by-page detail, clicks and pop-ups for 90 days, then only daily page totals with nothing that identifies anyone; key actions for 13 months.
• Session recordings: 30 days. The device cookie: 12 months, or until you withdraw consent.
• Security logs: no longer than needed to keep the service secure.

8. Your rights

You can turn usage statistics and enhanced analytics off at any time in cookie settings (linked at the foot of every kitchen's page), and we honour your browser's Global Privacy Control signal. You can ask to see, correct or delete your data, to restrict or object to how we use it, to take a copy of it, and to withdraw consent at any time. Email privacy@prephubuk.co.uk. We'll reply within one month.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113.

9. Cookies

See our Cookie Policy.

10. Changes

We'll update this policy when how we use data changes, and show the date it was last updated at the top.

PrepHub is run by Build Orbit Ltd, a company registered in Scotland (number SC905496). Registered office: 18 Sauchie Crescent, Kinglassie, Lochgelly, Scotland, KY5 0YZ.