Privacy policy
Last updated: 1 November 2026. This is a draft that has not yet been reviewed by a solicitor.
This explains what personal information farmtomouth collects, why, and your rights. The controller is Paul Freek, trading as Hilton Digital Media and farmtomouth. Contact: hello@farmtomouth.co.uk [TO CONFIRM: confirm contact email]. Address: [TO CONFIRM: trading and geographic address]. ICO registration number: [TO CONFIRM: ICO registration number and whether it covers this business (the owner holds ZCZ36167 for AiDren)].
What we collect and why
| Who | What | Why (lawful basis) |
|---|---|---|
| Everyone | Postcode you enter, basic technical data (IP address, browser) | To show farms and delivery options near you, and keep the site secure (legitimate interests) |
| Shoppers | Name, email, phone, delivery address, order and payment details | To take and deliver your order (contract) |
| Farmers | Name, email, phone, farm details and photos, food business registration, insurance documents, payout details held by Stripe | To check and run your farm account (contract), and checks we must make (legal obligation / legitimate interests) |
| Mailing list | Email and postcode | To tell you when we open near you (consent, which you can withdraw at any time) |
| Farmer listing tools | Photos, voice recordings and text you give us | To draft product listings for you (contract) |
We keep order and accounting records for 6 years, as tax and accounting rules require. Other data is kept only as long as needed, and mailing-list details until you unsubscribe. [TO CONFIRM: retention periods for account and support data]
Who sees your information
- The farm you order from sees your name, delivery address and what you ordered. They do not see your email or phone number.
- The courier gets your name, address and phone number so they can deliver.
- We never sell your data.
Companies that process data for us
- Cloudflare: hosts the website, file storage and security.
- Neon: our database.
- Stripe: card payments and farm payouts, including identity checks on farms. Stripe is also a controller of that data under its own privacy policy.
- Brevo: sends our emails (sign-in links, order messages, confirmations).
- Anthropic: its AI drafts product listings from photos, voice and text that farmers give us. We do not send shopper details for this.
- postcodes.io: turns a postcode into a location. Only the postcode is sent.
- A delivery courier [TO CONFIRM: name of courier (Gophr is the planned choice), plus any other courier used].
Some of these companies are based outside the UK, including in the United States. Where that happens we rely on UK-approved safeguards such as the UK adequacy rules, the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement. [TO CONFIRM: solicitor to check transfer mechanism for each provider]
Your rights
You can ask to see your data, correct it, delete it, restrict or object to its use, or have it moved to another service. You can withdraw consent at any time. You can object to marketing at any time. Email us and we will reply within one month. You can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
See our cookie policy.
If something goes wrong
If there is a personal data breach that puts people at risk, we will tell the ICO within 72 hours and tell you without delay where the risk to you is high.
Changes
We will update this page when anything changes and show the date at the top.