Glütty Ltd, based in London, is the data controller for the information described here. We run the Glütty app at askglutty.com.

• Your account: email address, name, profile photo if you add one, and sign-in records.
• Your taste: the cuisines and rooms you pick, places you save and meals you plan.
• Your meals: who was at the table, dishes ordered, shared-dish splits, bill lines and amounts, ratings, recaps and any meal photos you upload.
• Your groups: group names, who is in them and invite links you create.
• Your membership: subscription status, renewal date and payment history. Your card details go straight to our payment provider — we never see or store them.
• Technical basics: device and browser information, and error reports when something breaks.

To run your account and dinners, take payment for membership, keep your history and taste read working, prevent abuse, and fix things that go wrong. Our legal grounds are performing our contract with you, our legitimate interest in running and protecting a safe service, and complying with tax and accounting law.

Sharing is the point of Glütty. If you join a meal, the other people at that table can see your name, what you ordered, dishes you share and your part of the bill. Anyone with an invite link can join that meal, so only share links with people you actually want at the table.

Photos you upload — of menus or of the food — may show other people or other diners' orders. Please don't upload photos of people who wouldn't want you to.

We use a small number of trusted providers, and only for what they're needed for:

• Stripe — payments, cards, receipts and tax. Stripe holds your card details, not us.
• Lovable Cloud — hosting, database and file storage for your account and dinners.
• AI providers, reached through Lovable's AI gateway — reading menus, explaining dishes and generating dish pictures. Menu text and photos you send are processed for that purpose.
• Perplexity and Firecrawl — looking up restaurants and reading public menu pages. We send restaurant names, addresses and website links, not your personal details.

We do not sell your data. We do not run advertising. We do not share your meals with restaurants or anyone else, unless the law requires it or we need it to defend a legal claim.

Some of our providers process data outside the UK. Where that happens, the transfer is covered by the UK's approved safeguards, such as standard contractual clauses.

• Account and dinner data: for as long as your account exists. If your membership lapses, we keep it so everything is there if you come back.
• If you ask us to delete your account: removed within 90 days, apart from anything we're legally required to hold.
• Payment and invoice records: 6 years, because UK tax law requires it.
• Error logs: up to 12 months.

Under UK data protection law you can ask us for a copy of your data, correct it, delete it, take it elsewhere, or object to how we use it. Email support@askglutty.com and we'll respond within one month. If you're unhappy with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk.

We use only what the app needs: keeping you signed in, remembering demo mode and holding your place in a meal. No advertising or tracking cookies.

Access to your data is restricted at the database level so only you, and the people at your table, can see what's yours. Payments run through a certified provider. We take this seriously, but no online service is perfectly secure, and we can't promise otherwise.

Glütty is for people aged 18 and over. We don't knowingly collect data from children.

If we change anything meaningful here, we'll update the date at the top and tell members in the app before it takes effect.