Privacy Policy

Weekfull is the data controller for the personal data described in this notice. You can reach our data protection contact at privacy@weekfull.co.uk. Our registered company name and address are shown on our contact page and on any invoice we issue.

We are not currently required to appoint a Data Protection Officer, but the contact above is monitored for all privacy requests.

• Account data — email address, password (stored only as a salted hash by our authentication provider), sign-in timestamps and device type.
• Household preferences — number of adults and children, weekly budget, cuisines you like and dislike, cooking effort and equipment.
• Dietary and allergy information — allergies, intolerances and dietary choices you enter for yourself or family members. Allergy data can reveal information about health, so we treat it as special category data (see the legal basis below).
• Kitchen data — pantry, fridge and freezer items, and photos you take in the Kitchen IQ scanner along with the items our AI identifies in them.
• Activity data — plans generated, meals cooked, shopping lists completed, ratings and swaps. This powers your Weekfull Story and helps us fix bugs.
• Payment data — subscription status, plan and renewal dates. Card details are handled entirely by Stripe; we never see or store your card number.
• Technical data — IP address, browser and device information, and error reports, used for security and reliability.

• To provide the service (building plans, shopping lists, pantry matching, syncing across your devices) — performance of a contract.
• To handle allergies and dietary needs — special category data is processed only on your explicit consent, given when you enter it. You can withdraw that consent at any time by deleting the entry, and we will stop filtering meals on that basis.
• To take payment and prevent fraud — contract and legal obligation (we must keep transaction records for tax purposes).
• To keep the service secure, debug faults and improve recipes — legitimate interests, balanced so that we use aggregated or minimal data wherever it will do the job.
• To send you service emails (password resets, receipts, plan reminders you enable) — contract. Marketing emails are sent only with your consent and every one has an unsubscribe link.

Weekfull accounts are for adults aged 18 or over. You may add children as family members so portions and allergies are right. Please give us the minimum needed — a first name or nickname, an age band and any allergy. Do not add a child's contact details, school or photograph. You are responsible for having the authority to provide that information.

When you scan a shelf, the photo is sent to our AI vision provider to identify products. The photo is processed to return a list of items and is not used to train third-party models. Please avoid capturing faces, documents or anything personal in the background. You can delete any scan and its photo from the Kitchen IQ screen at any time.

We do not sell your personal data and we never share your shopping habits with supermarkets for advertising. We use a small set of processors who act only on our instructions:

• Our cloud database, authentication and hosting provider (data stored in the EU/UK).
• Stripe, for payments and subscription billing.
• Our email delivery provider, for transactional email.
• Our AI provider, for recipe generation and Kitchen IQ photo recognition.
• Professional advisers, or a purchaser of the business, and law enforcement or regulators where we are legally required to disclose.

Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses, with appropriate technical safeguards.

• Account and household data — for as long as your account is open.
• Kitchen IQ photos — 90 days, then automatically deleted; recognised items remain.
• Plans, shopping lists and activity events — 24 months rolling.
• Billing and tax records — 6 years, as required by HMRC.
• After you close your account we delete or irreversibly anonymise everything else within 30 days.

• Encryption in transit (TLS) and at rest on our database.
• Row-level security so your rows can only ever be read by your own signed-in session — one customer cannot reach another's data even by crafting their own API calls.
• Roles and admin access held in a separate table with no customer-writable path.
• Passwords stored only as hashes; we cannot see them.
• Least-privilege access for staff, and audit logging of administrative actions.

If a breach is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you without undue delay.

Under UK GDPR you can ask us to:

• give you a copy of your data (access and portability);
• correct anything inaccurate;
• erase your data (the "right to be forgotten");
• restrict or object to processing based on legitimate interests;
• withdraw consent, including for allergy data or marketing, at any time.

Signed-in users can do the first and third of these instantly from Privacy & Data in your account — download a full copy of your data, or delete your account permanently.

Otherwise email privacy@weekfull.co.uk and we will respond within one month. There is no charge unless a request is manifestly excessive. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

We use strictly necessary storage to keep you signed in and to remember your last plan on your device. If you enable "Remember me", that session is stored persistently until you sign out. Referral links from partners set a short-lived cookie so the correct partner is credited. We do not use advertising cookies.

If we make a material change we will tell you by email or in the app before it takes effect. The date at the top of this page always shows the current version.