Pantry
Legal

Privacy Policy

Last updated: 1 November 2026

Pantry is operated by Just Pantry Limited (“we”, “us”, or “our”), a company registered in England and Wales (company number 14135727) whose registered office is Suites 10 - 12 The Hive, Bell Lane, Stevenage, Herts, United Kingdom, SG1 3HW. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our meal planning service at justpantry.app.

Just Pantry Limited is the data controller for the purposes of UK GDPR and the Data Protection Act 2018. If you have questions about this policy, contact us at privacy@justpantry.app.

1. Information We Collect

We collect information in the following ways:

Information You Provide Directly

  • Account Information: Name, email address, and password when you create an account.
  • Profile Information: Dietary preferences, food allergens to avoid, household size (how many adults and children, by age band, and, if you tell us a child is with you only part of the week, which meals they are home for), cooking time preferences, and nutritional targets.
  • Health Data: The only health-related information we collect is the food allergens you ask us to exclude. We need it to keep the food we suggest safe for you, and we use it for nothing else. We do not ask for or store medical conditions or diagnoses.
    We only store your allergens if you explicitly agree to it (this is “special category” data, so your consent is our legal basis for holding it). It is entirely optional — meal planning works without it, you just won't get those ingredients excluded. You can withdraw at any time from your profile, which deletes the allergen information immediately.
  • Payment Information: Processed securely via our payment provider. We do not store your card details.
  • Communications: Messages you send to our support team.

Information Collected Automatically

  • Usage Data: Pages visited, features used, time spent, and interaction data.
  • Device Information: Browser type, operating system, device identifiers, and IP address.
  • Cookies & Tracking: See our Cookie Policy for details.

2. How We Use Your Information

We use your information to:

  • Provide, operate, and improve the Pantry service
  • Generate personalised meal plans and shopping lists
  • Process payments and manage your subscription
  • Send transactional emails (account confirmation, password resets)
  • Send service updates and, where you have consented, marketing emails
  • Measure our marketing emails: when you click a link in one of our marketing emails, we record that click against your account, and whether you subscribed within 30 days, so we can see which emails are useful. If you unsubscribe, we record which email you unsubscribed from. We do not track whether you open our emails.
  • Credit you for referrals: if you share your referral link, we count the visits it brings and the sign-ups and subscriptions that follow, so we can credit you. We record nothing about the people who visit through it.
  • Analyse usage patterns to improve our algorithms and user experience
  • Detect and prevent fraud, abuse, and security incidents
  • Comply with legal obligations

3. Legal Bases for Processing (UK GDPR)

We process your personal data under the following legal bases:

  • Contract: Processing necessary to deliver the service you have subscribed to.
  • Legitimate Interests: Improving our service, seeing which of our marketing emails are useful, preventing fraud, and ensuring security — where these interests are not overridden by your rights.
  • Consent: Marketing communications and optional analytics. You may withdraw consent at any time.
  • Legal Obligation: Where we are required by law to process your data.

4. Sharing Your Information

We do not sell your personal data. We may share your information with:

  • Service Providers: companies that handle data for us, on our instructions, under data processing terms:
    • Supabase — our database and sign-in
    • Amazon Web Services — hosts the website and the app, stores our backups and sends our emails
    • GitHub — runs the job that makes our nightly backup
    • Stripe — takes payments (Stripe is also responsible in its own right for some payment and fraud-prevention data)
    • Google — Google Analytics, only if you accept analytics cookies; our company email; and Google sign-in, if you choose to sign in with Google
  • Legal Requirements: When required by law, court order, or to protect our rights, property, or the safety of our users.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you cancel your subscription without deleting your account, we keep your data in case you return — we do not delete it automatically.

You may delete your account at any time from your account settings. Doing so anonymises your personal information (your name, email, and any allergen/health data are removed, and sign-in is permanently blocked) but retains anonymised usage data, which cannot be linked back to you, for analytical purposes. If you would like that anonymised data permanently deleted as well, contact us at privacy@justpantry.app and we will remove it.

Deleting your account also removes you from our marketing email list. It does not remove: your payment records, which Stripe keeps for 7 years as HMRC requires; your email address on our suppression list, if an email to you bounced or you reported one as spam, so that we never email you again; emails you have sent us; or our backups, until they expire.

Backups keep data for up to 30 days; a backup that has been replaced is kept for 7 days more.

Financial transaction records are retained for 7 years to comply with HMRC requirements.

Emails you send us are kept for 2 years after the last message in the conversation, or 3 years for a privacy request or a complaint. The record of your cookie choice is kept for 2 years. If you join our waitlist, we keep your email address until we launch and tell you.

6. International Transfers

Some of our service providers process data outside the UK, including in the United States. Where they do, we rely on the UK’s adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework, or on the UK Addendum to the EU Standard Contractual Clauses, to ensure appropriate safeguards are in place.

7. Your Rights

Under UK GDPR, you have the following rights:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your data (“right to be forgotten”) — see Section 5 for what account deletion does by default, and how to request complete removal.
  • Restriction: Request that we restrict processing of your data.
  • Portability: Receive your data in a structured, machine-readable format.
  • Objection: Object to processing based on legitimate interests or for direct marketing.
  • Withdraw Consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email privacy@justpantry.app. We will respond within one calendar month. If you are unhappy with how we handle your request, see section 8.

8. Complaints

If you are unhappy with how we have used your personal data, please tell us, so we can put it right. Email privacy@justpantry.app, or write to Just Pantry Limited, Suites 10 - 12 The Hive, Bell Lane, Stevenage, Herts, United Kingdom, SG1 3HW. Tell us what happened and, if you can, the email address of your Pantry account.

When we receive your complaint, we will:

  • acknowledge it within 30 days of receiving it, and usually much sooner;
  • look into it without undue delay, and keep you informed of what we are doing;
  • tell you the outcome, and what we have done about it.

If you are not happy with our response, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You can complain to the ICO at any time, although it will usually ask whether you have raised the matter with us first.

9. Security

We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure. We encourage you to use a strong, unique password for your account.

10. Children’s Privacy

Pantry is for adults: you must be at least 18 to use it, and it is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

If you tell us about children you cook for, we hold only their age band (0–5, 6–12, or a full portion) and, for a child who is with you only part of the week, the meals they are home for, so that we can size your portions and your shopping. We never ask for a child’s name, age or date of birth.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or by displaying a prominent notice in the app. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related queries or to exercise your rights:

← Back to Pantry
Terms of ServiceCookie Policy