1. About this policy
1.1 This Privacy Policy explains how we collect, use, share, and protect your personal data when you use the PlantSwap mobile application (the "App"). Please read it carefully before using the App.
1.2 The App is operated by Sleeping Giant Media Limited, trading as Side Quest Digital, a company incorporated in England and Wales with company number 06705616 and registered office at Top Floor, Civic Centre, Castle Hill Avenue, Folkestone, Kent, CT20 2QY ("we", "us", "our"). We are the data controller in respect of your personal data.
1.3 We are registered with the Information Commissioner's Office ("ICO") under registration number ZA214557. You can verify our registration at ico.org.uk.
1.4 If you have any questions about this Policy or how we handle your data, please contact us at privacy@sidequestdigital.co.uk.
2. Data we collect
2.1 We collect personal data in three ways: data you give us directly, data we collect automatically when you use the App, and data we receive from third parties.
Data you give us directly
2.2.1 Preferences data: your favourite chefs, which you can add to your profile so the App can personalise recipe suggestions.
2.2.2 Health and dietary data: information about your dietary preferences, food allergies, intolerances, or other dietary requirements that you choose to provide so the App can generate safe and relevant suggestions. This is special category ("sensitive") personal data, see clause 4 below. We only collect this with your explicit, separate consent, given through a dedicated step in the App before this data is captured.
2.2.3 Support data: correspondence you send us, including emails, in-app messages, or feedback.
Data we collect automatically
2.3.1 Usage data: information about how you interact with the App, including events such as "scan completed" and "recipe saved", and navigation paths.
2.3.2 Funnel and conversion data: events such as sign-up started, account created, and purchase completed, used to understand how users progress through the App.
2.3.3 Device and technical data: your device type, operating system, unique device identifiers, IP address, and App version.
2.3.4 Image data: when you use the scanning feature, photos you take or select from your gallery are transmitted to our AI service provider for processing, to identify ingredients and generate plant-based recipe suggestions. Images are not stored on our servers and are not retained by us following processing, unless you choose to save the resulting recipe, in which case the image is stored as part of that saved recipe until you delete it.
2.3.5 Guest usage data: if you use the App without signing in, we store a scan counter on your device only, using local storage. This is never sent to our servers.
Data we receive from third parties
2.4.1 Registration data: if you create an account using Sign in with Apple or Google Sign-In, we receive your name and email address from that provider. We use this to identify your account and sync your data across devices.
2.4.2 Subscription data: where you take out a Pro subscription, RevenueCat provides us with confirmation of your subscription status and purchase events following a transaction made through the Apple App Store or Google Play Store.
2.4.3 We may receive analytics data from our analytics provider, PostHog, about aggregated usage patterns. See clause 6 for further detail on international transfers.
2.5 We do not knowingly collect payment card data directly. Payments for Pro subscriptions are processed by the Apple App Store or Google Play Store, with subscription status managed via RevenueCat. We do not store full payment card details.
3. How and why we use your data
3.1 We use your personal data for the following purposes, relying on the legal bases set out below. Where we rely on legitimate interests, you have the right to object, see clause 8 for details.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account | Registration data | Performance of a contract with you (Art. 6(1)(b) UK GDPR) |
| Providing the App's core functionality, including generating plant-based recipe suggestions from scanned or searched ingredients | Registration data, health and dietary data, preferences data, image data | Performance of a contract with you (Art. 6(1)(b)); explicit consent for health and dietary data (Art. 6(1)(a) & 9(2)(a)), see clause 4 |
| Sending service communications (confirmations, security alerts, updates to this Policy) | Registration data | Performance of a contract with you (Art. 6(1)(b)) |
| Improving the App through usage analytics and funnel tracking | Usage data, funnel and conversion data, device and technical data | Our legitimate interests in developing and improving our product (Art. 6(1)(f)) |
| Security, fraud prevention, and maintaining the integrity of the App | Device and technical data, usage data | Our legitimate interests in protecting users and the App (Art. 6(1)(f)) |
| Processing subscriptions and maintaining transaction records | Registration data, subscription and purchase confirmation data | Performance of a contract with you (Art. 6(1)(b)); legal obligation to maintain accounting records (Art. 6(1)(c)) |
| Responding to support requests and resolving complaints | Support data, registration data | Our legitimate interests in providing customer support (Art. 6(1)(f)) |
| Complying with our legal and regulatory obligations | Any data necessary to comply with applicable law | Legal obligation (Art. 6(1)(c)) |
4. Automated processing
4.1 The App uses AI, provided by our AI service provider and accessed via OpenRouter, to analyse images or ingredient information you provide and generate plant-based recipe suggestions. This processing is automated in the sense that it is carried out by software rather than a person reviewing your data manually.
4.2 This automated processing does not constitute solely automated decision-making with legal or similarly significant effects within the meaning of Article 22 UK GDPR. The suggestions generated are recommendations only, you remain in full control of the decisions you make based on them.
4.3 The App does not create individual profiles for the purpose of targeting advertising or making decisions about your access to services.
5. How we share your data
5.1 We do not sell your personal data to any third party.
5.2 We share personal data with the following categories of recipient, each of whom processes data only as necessary for the stated purpose and under obligations of confidentiality and data protection compliance:
- Cloud hosting: Supabase, database, authentication, and file storage. Your data is stored on servers located in the EU. Privacy policy
- AI service providers: OpenAI, accessed via OpenRouter, processes scanned images and generates recipe suggestions. Privacy policy
- Analytics providers: PostHog (EU servers), usage and conversion data, processed in aggregated or pseudonymised form where possible. Privacy policy
- Subscription management: RevenueCat, manages Pro subscription entitlements. Privacy policy
- Payment processors: Apple App Store / Google Play Store, process payment for subscriptions. We do not receive or store your full payment details.
- Authentication providers: Google Sign-In (privacy policy) and Apple Sign In (privacy policy).
- Professional advisers: our lawyers, accountants, and insurers, where necessary.
5.3 We may disclose personal data to law enforcement or regulatory authorities where required to do so by law, or where disclosure is necessary to protect our legal rights or the safety of our users.
5.4 If we sell or transfer all or part of our business, personal data may be transferred to the acquirer as part of that transaction. We will notify you in advance of any such transfer where we are required to do so by law.
6. International transfers
6.1 Some of our service providers are based outside the UK, including in the United States, notably our AI service provider (via OpenRouter) and RevenueCat. Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place to protect your data, as required by UK GDPR.
6.2 Transfers to the United States are made in reliance on the UK-US Data Bridge, where the relevant recipient is certified under it, or otherwise on the basis of the International Data Transfer Agreement ("IDTA") or standard contractual clauses approved by the ICO.
6.3 If you would like further information about the safeguards applicable to a specific transfer, please contact us at privacy@sidequestdigital.co.uk.
7. How long we keep your data
7.1 We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our retention periods are as follows:
- Account and registration data: for the duration of your account and for 2 years following account closure or last activity, unless you request earlier deletion.
- Health and dietary data: for the duration of your consent, or until you withdraw consent or delete your dietary profile. This data is deleted promptly following withdrawal of consent.
- Scan results and saved recipes: retained while your account is active, until you delete them or close your account.
- Image data: not retained beyond the immediate processing session, unless saved as part of a recipe (see above).
- Usage and analytics data: 13 months from the date of collection.
- Transaction and subscription records: 7 years from the date of the transaction, as required for tax and accounting purposes.
- Support and complaint records: 2 years from the date of resolution.
- Guest scan counter: stored locally on your device only; retained until you clear the App's local storage.
7.2 When data is no longer required, we delete or anonymise it securely.
8. Your rights
8.1 Under UK GDPR, you have the following rights in relation to your personal data. You can exercise any of these rights by contacting us at privacy@sidequestdigital.co.uk. We will respond within one month, though we may extend this period by a further two months for complex or numerous requests.
- Right of access, obtain confirmation of whether we process your personal data and, if so, a copy of that data and information about how it is processed.
- Right to rectification, have inaccurate personal data corrected and incomplete data completed.
- Right to erasure ("right to be forgotten"), request deletion of your personal data where it is no longer necessary for the purposes it was collected for, where you have withdrawn consent (and there is no other legal basis), or where you have objected and we have no overriding legitimate grounds.
- Right to restriction, request that we restrict processing in certain circumstances, for example while we verify the accuracy of data you have disputed.
- Right to data portability, where we process your data on the basis of contract or consent by automated means, receive your data in a structured, commonly used, machine-readable format, and request we transmit it to another controller where technically feasible.
- Right to object, object at any time to processing based on our legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, or processing is necessary for legal claims.
- Right to withdraw consent, where we process your data on the basis of consent, including explicit consent for health and dietary data, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
8.2 To delete your account and all associated data, go to Settings → Sign out in the App and then email us. We will delete your account within 7 days.
8.3 Right to complain: if you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would, however, welcome the opportunity to address your concerns directly before you approach the ICO, and ask that you contact us in the first instance.
9. Tracking technologies
9.1 The App uses analytics and tracking technologies to understand how users interact with it, including analytics SDKs that log usage events and conversion data, and device identifiers used to distinguish unique users for analytics purposes.
9.2 We do not use cookies in the traditional browser sense, as the App is a native mobile application. Similar tracking technologies are used as described above.
9.3 You can limit certain types of tracking by adjusting your device settings (for example, resetting your advertising identifier or limiting ad tracking on iOS or Android). Disabling tracking does not affect the App's core functionality.
9.4 At present, the App carries out basic funnel and conversion tracking only. If we introduce additional forms of tracking in future, we will update this Policy and notify you of material changes.
10. Children
10.1 The App is not intended for use by children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at privacy@sidequestdigital.co.uk and we will delete it promptly.
10.2 If you are aged 13 to 17, we encourage you to read this Policy with a parent or guardian. Features involving the collection of health and dietary data require your explicit consent. If you are under 18, we recommend that a parent or guardian reviews this Policy before you provide any health or dietary information.
11. Security
11.1 We take appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These include encryption of data in transit and at rest, row-level security so your data in Supabase is only accessible to you, access controls, and regular security reviews.
11.2 No method of transmission over the internet or electronic storage is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.
11.3 In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.
12. Changes to this policy
12.1 We may update this Policy from time to time to reflect changes in our data processing practices or applicable law. We will notify you of material changes by posting a notice within the App or, where practicable, by emailing the address associated with your account, before the changes take effect.
12.2 The "Last updated" date at the top of this Policy indicates when it was most recently revised. Continued use of the App following notification of changes constitutes acceptance of the updated Policy. If you do not accept the updated Policy, you must stop using the App.
13. How to contact us
13.1 If you have any questions, concerns, or requests regarding this Policy or how we process your personal data, please contact us:
Sleeping Giant Media Limited (trading as Side Quest Digital)Top Floor, Civic Centre, Castle Hill Avenue, Folkestone, Kent, CT20 2QY
Email: privacy@sidequestdigital.co.uk
13.2 You also have the right to contact the ICO at any time. The ICO's contact details are available at ico.org.uk.