Privacy notice

Last updated 12 October 2026

Controller and contact

Grapes and Greens Ltd, company number 16808304, is responsible for personal information used to operate Grapes & Greens membership. Registered office: 2 Brookmead Cottages, Horsham Road, Cranleigh, United Kingdom, GU6 8DJ. For privacy questions or rights requests, email info@grapesandgreens.co.uk.

Information and purposes

We process your name, email address, password hash, verification status, account identifier and secure session records to create and protect your account and provide the service. We use subscription provider, product and transaction references, environment, status and access-end dates to verify membership, handle purchase restoration and restrict member benefits. These operations are necessary to perform our membership contract and take account-registration steps you request.

We record minimal registration, verification, membership and engagement events, such as benefit views, code reveals and partner clicks, and an optional campaign source. We use these to understand conversion, retention and service reliability. Our lawful basis is legitimate interests in operating, securing and improving the service, balanced against your privacy rights. We do not record private voucher codes in analytics or treat reveals as confirmed partner purchases.

Optional marketing consent is separate from registration. We record the choice, timestamp and wording version. Marketing emails are sent through our newsletter provider, beehiiv, only with your permission; you may withdraw consent at any time. Verification, password-reset and membership confirmation emails are essential service messages and do not require marketing consent.

Recipients

HostAfrica provides hosting and database infrastructure. Resend delivers service emails and receives the recipient address and message. beehiiv operates our newsletter and receives your email address only if you subscribe to it or consent to marketing. RevenueCat processes account identifiers and store-subscription information for verification. Apple or Google processes store purchases under its own privacy notice. Authorised staff access information needed for publishing and support. We do not automatically import competition entrants or subscribe app users to marketing.

Opening partner or media links takes you to the provider's service and privacy notice. We do not send your app profile to a partner merely because you reveal a shared code. We may disclose information where legally required or necessary to protect lawful rights.

Retention and deletion

Account details are kept while you maintain an account. Account deletion revokes sessions, removes email, name, marketing consent and action tokens, and disconnects engagement records from your profile. Limited internal identifiers and subscription/history records remain for reconciliation, financial obligations and resolving disputes; they are not a retained contact profile.

Verification tokens expire after 24 hours and password-reset tokens after one hour. Encrypted email payloads are cleared after successful delivery.

Activity records, such as benefit views, code reveals, partner clicks and technical event and failure logs, are deleted after 24 months. Subscription and payment-related records, including the record of a first paid membership, are kept for six years after the membership ends to meet financial and tax obligations. Support correspondence is kept for two years after the enquiry is closed. Access to all of these records is restricted to authorised staff.

Security and international processing

We use HTTPS, hashed passwords and session tokens, restricted staff access and encrypted queued email payloads. We do not store your payment-card details or put server credentials in the app.

Your information is processed outside the UK. HostAfrica stores the membership database on servers in South Africa, which is not covered by UK adequacy regulations. Resend, RevenueCat and beehiiv process information in the United States. Their data processing agreements include the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and Resend also participates in the UK Extension to the EU-U.S. Data Privacy Framework. Contact us for more information about the safeguards that apply to your information.

Your rights

Depending on the applicable law, you may ask for access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent without affecting prior lawful processing. Contact us to exercise your rights; we may need to verify your identity. You may complain to the UK Information Commissioner's Office or your local supervisory authority. We do not make automated decisions with legal or similarly significant effects about you.

Account deletion

Use Account → Delete account in the app or our public deletion-request route. Deletion does not cancel an Apple or Google subscription. Manage renewal in the store before deleting if you wish to stop future charges.