Effective 13 October 2026

Privacy notice

What we collect, why we collect it, who else sees it, and how long we keep it. Written to be read rather than to be survived.

1. Who we are

Aben To Go is a marketplace connecting home cooks, small kitchens and restaurants with people looking for home-cooked food of any kind. We operate in North London — Tottenham, Seven Sisters and the surrounding areas.

The service is operated by ABEN TO GO LTD, a company registered in England and Wales (number 17465071), whose registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. For the purposes of UK data protection law, ABEN TO GO LTD is the data controller for your personal information, registered with the Information Commissioner's Office under reference ZC270863.

We are not the controller for what a kitchen does with your details after an order reaches them. A kitchen sees what it needs to cook and hand over your food; how they run their own business is theirs.

2. What we collect

Only what the app needs to work. There is no advertising on Aben To Go, no tracking pixels, and we do not sell anything about you to anyone.

Everyone with an account

Account details	Your email address, a phone number if you give one, and your password — stored only as a bcrypt hash, never in a form anyone can read.
Profile	The display name you choose, and a photo and short bio if you add them.
Addresses	Any delivery address you save: street, city, postcode, and its approximate coordinates so we can work out which kitchens deliver to you.
Orders	What you ordered, from which kitchen, when, for how much, and what happened to it — including who changed its status and when.
Payments	The amount, the outcome, and Stripe's reference for it. We never see or store your card number — that goes straight to Stripe and never touches our servers.
Reviews and reports	Any rating, comment or video you leave for a kitchen, and anything you report to us.
Notifications	A device token if you allow notifications, and the messages we have sent you in the app.

If you run a kitchen

Your storefront	Business name, description, cuisine, photos and any kitchen tour video, your pickup address, delivery radius and fees, and your menu.
Verification documents	Photo ID, your council food business registration, and your food hygiene certificate. These are the most sensitive thing we hold. They are stored outside the public web root, are never served to anyone but you and an administrator, and every time one is opened it is recorded against the account that opened it.
Payout details	Your Stripe account identifier and whether it is able to receive money. Your bank details are held by Stripe, not by us.

If you ask us to tell you when we reach your area

Waitlist	Your email address and the first half of your postcode only — N17, not N17 6AA. The rest is thrown away before anything is written down, so it tells us which towns to open next and nothing about your street. You can be on this list without having an account.

Finding kitchens near you

When you search for kitchens near you, the app sends the point you are searching from to our server so it can work out which kitchens are close. That point is used for that one answer and is not written down, is not attached to your account, and does not appear in our logs. The distances we show you are rounded to the nearest half kilometre, deliberately: an exact distance measured from several places would give away where a cook lives.

What we do not collect

We do not use advertising identifiers, we do not track you across other apps or websites, and we do not build a profile of you for marketing. We do not collect your location in the background — only the addresses you choose to save.

3. Why, and our legal basis

To run your account and your orders	Performance of our contract with you. Without this there is no way to take an order or get food to you.
To take payment and pay kitchens	Performance of our contract, and our legal obligation to keep proper financial records.
To verify kitchens	Legal obligation and legitimate interests. Food sold to the public has to come from a registered, inspected kitchen, and customers are entitled to expect we checked.
To keep the platform safe	Legitimate interests — investigating reports, preventing fraud, and recording what administrators do.
To tell you when we open in your area	Consent. You asked us to, you can ask us to stop at any time, and the email we send does one job.
To send order updates	Performance of our contract. These are about an order you placed, not marketing, and you can turn them off in the app.

4. Who we share it with

The kitchen you ordered from	Your name, your order, and your delivery address if it is a delivery. Not your email or your phone number.
Stripe	Payments and payouts. Stripe is the controller for your card details and holds them under its own privacy policy — we never receive them.
Resend	Transactional email — password resets, account notices and the one email telling you a kitchen has opened near you. They receive your email address and the contents of that message.
Expo and Google	Push notification delivery, if you have allowed notifications, and distribution of the app itself.
Our hosting provider	Hostinger, who run the servers the platform sits on.

We may also disclose information where the law requires it — a court order, or a request from a food safety or tax authority we are obliged to answer.

We do not sell your personal information, and we never will.

5. Where it is stored

Our database and uploaded files sit on our own servers in the United Kingdom. Transactional email is sent through Resend's Ireland (EU) region. Stripe and Google operate globally and may process data outside the UK under the safeguards set out in their own policies.

6. How long we keep it

Your account and profile	Until you delete it.
Orders, payments and payouts	Approximately six years, because HMRC requires business records to be kept for that long. These survive account deletion — see below — but stop being connected to a named person.
Verification documents	While the kitchen is on the platform. They are destroyed — the records and the files — when the account is deleted.
Password reset links	Thirty minutes, and one use.
Waitlist entries	Until we have written to tell you a kitchen has opened near you, or until you ask us to remove you — whichever comes first. If we have not reached your area within two years we delete the entry rather than keep it waiting.
Administrator audit records	Kept indefinitely. A log of who did what, which can be edited or erased on request, is not a log.

7. Deleting your account

You can delete your account from the app: Account → Settings → Delete your account. There is also a web page explaining how, including what to do if you cannot sign in.

8. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal information we hold about you;
• have anything inaccurate corrected;
• have your information erased — subject to the records above, which we are obliged to keep;
• restrict or object to how we use it;
• receive it in a portable form;
• withdraw consent where we relied on consent, such as notifications.

Write to privacy@abentogo.co.uk and we will respond within one month.

9. Age

Aben To Go is for people aged 18 and over. We do not knowingly collect information about children. If you believe a child has an account, tell us and we will remove it.

10. Changes

If we change how we handle your information we will update this page and change the date at the top. Where a change is significant we will tell you in the app rather than relying on you to notice.

11. Contact and complaints

Privacy questions and requests: privacy@abentogo.co.uk
Anything else: hello@abentogo.co.uk

ABEN TO GO LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
ICO registration ZC270863.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would rather you came to us first, but it is your right either way.