Privacy Policy

1. Who We Are

Sugar Rush operates this marketplace at sugarrush.ie. We are the data controller for personal data collected through the platform under the General Data Protection Regulation (GDPR) and the Data Protection Acts 1988–2018 (Ireland).

Contact: hello@sugarrush.ie

2. What Data We Collect

• Account data: Name, email address, password (hashed), phone number (optional)
• Profile data: Town/city, county, delivery address (Buyers); bakery name, description, specialties (Sellers)
• Order data: Order details, fulfillment dates, delivery address, payment status
• Communication data: Messages exchanged on the platform between Buyers and Sellers
• Payment data (Stripe Direct Checkout Sellers): Stripe processes card details directly — Sugar Rush does not store card numbers. We store Stripe payment intent and transfer IDs for order tracking.
• Payment data (Revolut/Bank Transfer Sellers): a Seller who chooses this method provides us their own IBAN, account holder name, and Revolut handle so Buyers can pay them directly. We store this data ourselves, encrypted at rest, and it is never sent to Stripe. It is shown only to a Buyer who is placing an order with that specific Seller, so they can complete the direct payment — Sugar Rush is not a party to that payment and never receives, holds, or has access to the funds themselves.
• Usage data: Pages visited, browser type, IP address (via server logs)

3. How We Use Your Data

• To operate the marketplace and process orders
• To facilitate payment — held securely via Stripe (Sugar Rush does not act as an escrow agent), or sent directly to the Seller's Revolut/bank account, depending on the Seller's chosen payment method
• To send transactional emails (order confirmation, verification, payout notices)
• To verify your identity and comply with food safety compliance checks
• To detect and prevent fraud, disputes, and platform abuse
• To improve the platform (aggregate analytics only)

4. Legal Basis for Processing

• Contract: Processing necessary to fulfil your order or provide your seller account
• Legitimate interest: Fraud prevention, platform security
• Legal obligation: Compliance with Irish food law and financial regulations
• Consent: Marketing emails (opt-in only, can be withdrawn at any time)

5. Sharing Your Data

We share data only where necessary:

• Stripe: Payment processing and Stripe Connect for seller payouts
• Twilio: SMS verification (phone number only, if you use phone verification)
• Other platform users: Your first name and county are visible to the baker you order from; your bakery name, public profile and menu are visible to all visitors

We do not sell your personal data to third parties.

6. Data Retention

• Account and profile data: retained for the lifetime of your account plus 6 years (for legal compliance)
• Order records: 7 years (Irish Revenue requirements)
• Compliance documents (Sellers): retained for the period required by the relevant Irish authority
• Messages: 2 years after the conversation last had activity

7. Your Rights

Under GDPR you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate data
• Erasure ("right to be forgotten"), subject to legal retention obligations
• Restriction of processing in certain circumstances
• Data portability of data you have provided to us
• Object to processing based on legitimate interests
• Withdraw consent for marketing at any time

To exercise any of these rights, email hello@sugarrush.ie. We will respond within 30 days.

8. Cookies

Sugar Rush uses essential session cookies to keep you signed in. We do not currently load any third-party tracking or advertising cookies, and we do not currently run analytics. The "Analytics" and "Marketing" categories in our cookie consent banner exist so that, if we activate optional analytics or personalisation features in the future, you will already have explicit opt-in control over them rather than discovering them after the fact. Your choice is stored locally on your device and is never transmitted to us.

9. Security

We store data on encrypted servers. Passwords are hashed using bcrypt. Card payment data is processed exclusively by Stripe (PCI DSS Level 1 certified) and never touches our servers. A Revolut/bank-transfer Seller's own banking details (IBAN, account holder name, Revolut handle) are stored directly by Sugar Rush using encryption at rest, and are never shared with Stripe. We apply OWASP security standards throughout the application.

10. Complaints

If you believe we have mishandled your data, you have the right to lodge a complaint with the Data Protection Commission Ireland: www.dataprotection.ie

11. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified by email or a notice on the platform.