CullyExpress
Become a DriverPartner With Us
Legal

Privacy Policy

Version: 2026-07-30-privacy-final
Last updated: 30 July 2026

Privacy Policy for Cully Express. Version: 2026-07-30-privacy-final. Last updated: 30 July 2026.

Controller

  • A&S Signatures Ltd, company number 15693230, is the controller of the personal data described in this Privacy Policy. Cully Express is a trading name of A&S Signatures Ltd.
  • This Policy applies to customers, restaurant partners, drivers, administrators, and people who contact Cully Express through the app or associated support routes.
  • The registered office is The Collar Factory, St. Augustine Street, Taunton, Somerset, TA1 1QN, United Kingdom. Privacy questions and rights requests may be sent to support@cullyexpress.com.

Trading Name

  • Cully Express is a trading name of A&S Signatures Ltd.

How We Obtain Information

  • We obtain information directly when a person registers, verifies a phone number, completes a profile, places or fulfils an order, uploads a file, requests support or a refund, changes settings, or asks for account deletion.
  • We also receive information from restaurants, drivers, administrators, Stripe, Firebase and Google Cloud services, Apple or Google device services, card networks and issuers, and postcode or address lookup services where those sources participate in the service.
  • Some technical information is generated automatically when the app, Firebase SDKs, Cloud Functions, security controls, or notification services operate.

Data Collected

  • We collect information needed to create accounts, operate the platform, process orders, provide support, prevent fraud, meet legal obligations, and improve service reliability.
  • This includes names, email addresses, verified phone numbers, Firebase user identifiers, account roles and status, profile and business information, addresses and postcodes, order and delivery activity, payment references, support and refund information, uploaded files, notification tokens and preferences, device or installation identifiers, app usage, diagnostics, IP-address or request-security information, and audit records as described below.
  • Free-text support, order-note, safety, allergen, or refund reports may contain information chosen by the person submitting them. Users should not include personal or health information that is not relevant to the request.

Authentication and Account Security

  • Firebase Authentication processes email addresses, password-authentication credentials, phone numbers, SMS verification activity, linked authentication providers, Firebase user identifiers, sign-in status, password-reset activity, and authentication logs including IP addresses.
  • Customers use email and password authentication linked to a verified UK mobile number. Restaurant and driver accounts use email and password authentication. Cully Express does not receive or store a readable copy of a user’s Firebase password.
  • Phone availability checks use the requesting IP address as the identifier for a ten-minute rate-limit counter. The counter prevents automated checking of registered phone numbers. The current production database does not automatically delete the stored rate-limit document when that ten-minute window ends.
  • We process authentication and verification information to create and secure accounts, prevent account takeover and enumeration, provide password recovery, and confirm that the authenticated person is entitled to use the relevant role.

Account Information

  • Customer accounts may include first and last name, display name, email address, verified phone number, profile photograph, address, city, saved or recent postcodes, default delivery address, favourites, basket and checkout state, order history, support requests, notification preferences, and account or fraud-control status.
  • Restaurant accounts may include the owner’s Firebase identifier, business name, description, cuisine, email address, phone number, address, postcode, branding and menu images, menu and opening-hour information, delivery and collection settings, operating status, ownership and approval records, order history, support records, earnings, payout and liability records, and administrative audit history. Information presented as a restaurant business profile, menu, opening hours, branding, address, or service availability is visible to app users.
  • Driver accounts may include name, email address, phone number, address and postcode, profile photograph, vehicle details, driving-licence information, insurance and identity documents, review status, delivery zone and availability, assignment and delivery history, bank-account holder name, bank name, account number, sort code, earnings, payout, liability, support, and audit records.
  • Administrator records may include Firebase identifiers, email or role details, active status, and records of approvals, configuration changes, account actions, refund decisions, migration actions, financial actions, and other privileged activity.

Order Information

  • We process basket contents, item identifiers and quantities, restaurant selection, order notes, delivery address and postcode, contact details, prices, fees, promotions, scheduled time, delivery or collection choice, payment state, timestamps, acceptance and preparation state, driver assignment, delivery or collection events, cancellation reasons, support contacts, and order history.
  • We create order, contact, payment, notification, configuration, and administrative audit records to maintain an accurate lifecycle, investigate incidents, reconcile payments, and demonstrate authorised actions.
  • The relevant restaurant receives the information needed to assess, prepare, and hand over its order. For delivery, eligible or assigned drivers receive the order and delivery information needed to assess, collect, route, contact where necessary, and complete delivery. Administrators may access order information for support, safety, financial control, disputes, and platform administration.
  • Scheduled orders include the requested time, pricing and delivery snapshot, booking and preparation state, and task or audit information required to activate and fulfil the order.

Location Information

  • We use customer delivery addresses, saved or recent postcodes, and postcode-centroid coordinates to show relevant restaurants, validate UK postcodes, calculate straight-line delivery distance, apply distance bands and delivery fees, and determine delivery eligibility.
  • If a customer chooses Use Current Location, the app requests foreground location permission and reads a current device location at medium accuracy, with a last-known-location fallback. Those coordinates are sent to postcodes.io and may also be sent to OpenStreetMap Nominatim to obtain a postcode or address suggestion. The app then saves the selected postcode or address; it does not write the raw one-off GPS coordinates to the customer profile.
  • Current location is optional. A customer may enter a postcode instead. The app does not request continuous or background customer location and does not implement continuous background driver tracking.
  • Driver delivery-zone, service-zone, availability, online status, assignment, and recorded contact or delivery events are used for operational eligibility. Restaurant address, postcode, and postcode-centroid information is used for visibility, delivery settings, distance calculations, routing, compliance, and support.
  • Server-resolved postcode centroids are cached in Firestore. A cached entry is refreshed when it is more than 180 days old; the current code does not automatically delete the cache document.

Payment Information

  • Stripe processes card details through the Stripe software development kit and payment interface. Cully Express sends Stripe the authorised amount, currency, order and customer references, idempotency information, and limited promotion or order metadata needed to create and reconcile a PaymentIntent.
  • We receive and store payment and refund references, PaymentIntent and refund identifiers, payment method type, authorisation, capture, cancellation and refund status, amounts, currency, timestamps, failure or reconciliation state, and Stripe webhook or audit references.
  • The app may store a card’s last four digits, expiry month and year, and default-card preference locally on the device for display. The full number entered on that local card screen is reduced to its last four digits before saving.
  • Cully Express never stores full card numbers or CVV security codes in Firestore, Cloud Storage, Cloud Functions records, or its own server databases. Full payment credentials entered in Stripe PaymentSheet are handled by Stripe. Stripe is responsible for the payment-card environment it provides under its PCI obligations; Cully Express remains responsible for securely integrating and operating its own systems.
  • Stripe may place an authorisation when checkout is submitted, capture the authorised amount after restaurant acceptance or scheduled-order confirmation, release or cancel an uncaptured authorisation, and process approved full or partial refunds to the original payment method.
  • Driver bank and payout details are stored in the driver profile and used to administer earnings and payouts. Access is restricted to the driver and active administrators under the production security rules.

Refunds, Evidence and Support

  • Refund records may include the order and customer identifiers, reason, affected items and quantities, report and notes, photographs or evidence references, restaurant response, driver statement, risk indicators, requested and approved amounts, liability allocation, decisions, Stripe refund references, and audit history.
  • Customers and restaurant partners may upload relevant refund evidence. Customer profile photographs, driver photographs and documents, restaurant images, and refund evidence are stored in Firebase Cloud Storage under role-specific paths protected by Storage Rules.
  • Support submissions may include the sender’s role, account identifier, name, email address, message, status, and timestamps. Support and refund free text or files may reveal health, allergy, safety, or other sensitive circumstances when the sender chooses to include them.
  • Where health or allergen information is necessary to investigate safety, establish or exercise a legal claim, or defend a claim, we process it under Article 9(2)(f) UK GDPR. In a genuine emergency where the individual cannot consent, vital interests may apply. We do not use health information for advertising.
  • Restaurants, drivers, and administrators may access only the support, order, refund, or evidence information allowed for their role and involvement. Refund evidence is not made public.

Notifications

  • We process push-notification permission status, notification preferences, Firebase Cloud Messaging tokens, Firebase installation identifiers, an app-generated installation identifier, account role, device platform, notification event type, delivery status, and notification audit information.
  • Firebase Cloud Messaging routes notifications to Android devices and to Apple devices through Apple Push Notification Service. Apple and Google therefore receive device or installation and delivery information required to deliver enabled notifications.
  • Notifications are used for operational and transactional events such as order, delivery, refund, account, restaurant, driver, and administrative status updates. The production code does not implement marketing email campaigns, behavioural advertising, or promotional push campaigns.
  • Push permission is optional and may be withdrawn in device settings. A user may also disable push notifications in the available preferences. Tokens are removed on account switching or logout where cleanup succeeds, removed when invalid, and deleted from Cully Express records through completed account deletion.

Analytics and Crash Reporting

  • Firebase Analytics is enabled when Firebase starts. It automatically records app-instance identifiers, app version, screen class and screen views, sessions, basic app interactions, device and operating-system information, approximate location derived by Google, and related usage events. Cully Express uses this information to understand service use and improve reliability and user experience.
  • The current app does not set a Firebase Analytics user ID or send names, email addresses, full delivery addresses, card details, or free-text support messages as custom Analytics parameters.
  • Firebase Crashlytics records crashes and handled or unhandled errors in release use, including stack traces, app state, timestamps, app version, device model and operating-system information, memory or storage information, rooted or jailbroken state where supplied by the SDK, Firebase installation identifiers, Crashlytics installation identifiers, and the diagnostic reason supplied by the app.
  • The production app does not include Firebase Performance Monitoring. We do not claim to collect Performance Monitoring data.
  • We rely on legitimate interests to measure use, diagnose faults, maintain security, and improve the service. Our interests are providing a reliable service, identifying failures, and understanding aggregate usage. Analytics is not used by Cully Express for behavioural advertising or to make a solely automated legal or similarly significant decision.

App Check, Security and Fraud Prevention

  • Firebase App Check uses Apple App Attest with DeviceCheck fallback on Apple platforms and Google Play Integrity on Android. The device and provider process attestation material to assess whether a request comes from the authentic app and, where supported, an authentic or untampered device. Firebase issues a short-lived App Check token that is automatically attached to protected requests.
  • App Check is a security control and is not used by Cully Express to identify a person by name. The attestation providers may nevertheless process device, app-integrity, installation, IP-address, or request information under their own service terms.
  • Security and fraud processing also includes authentication logs, request IP addresses, rate-limit counters, Firebase and Cloud Functions request metadata, checkout-attempt identifiers, payment reconciliation, promotion redemption history, duplicate-order controls, notification delivery claims, administrator actions, audit records, account blocks, and refund history.
  • The refund system calculates a customer risk score and low, medium, or high indicator using order count, refund requests, refund rate, and refund requests in the previous 30 days. A non-low indicator alerts administrators and supports human review; it does not automatically approve or reject a refund.
  • Promotion eligibility, payment state, delivery eligibility, phone-rate limits, duplicate-checkout controls, and account or role status are checked automatically to operate and protect the service. Material account suspension, refund, restaurant, driver, or administrative decisions remain subject to human action or review.

Information Stored on the Device

  • The app uses device storage for operational preferences and state, which may include the active role and account identifier, theme, notification or email preference, basket contents, favourite order references, checkout-attempt state, saved or recent postcodes, contact-form drafts, locally displayed card last-four digits and expiry, and installation identifiers.
  • Device-stored information remains until the app removes or replaces it, the user clears app storage, or the app is uninstalled, subject to operating-system backups. Completing server-side account deletion does not itself guarantee deletion of every copy retained in device storage or a device backup.
  • The native app does not rely on browser cookies for its core operation. Where the Cully Express website uses cookies or similar storage and access technologies, the Cookie Policy and consent or objection choices presented on that website apply. The native SDK and device-storage uses are described in this Policy.

Purposes and Lawful Bases

  • Contract is used where processing is necessary to register an account at the user’s request, authenticate the account, show relevant services, create and fulfil orders, arrange collection or delivery, administer restaurant or driver participation, process authorisations and captured payments, provide operational notifications, handle support, refunds and payouts, or take requested pre-contract steps.
  • Legal obligation is used for accounting and tax records, consumer-law and refund obligations, lawful regulatory or authority requests, data-protection compliance, safety obligations, and records required to demonstrate compliance.
  • Legitimate interests are used for service security and availability, App Check, fraud and misuse prevention, rate limiting, audit logging, payment and order reconciliation, dispute and chargeback handling, business administration, role and approval management, analytics, diagnostics, service improvement, and the establishment, exercise, or defence of legal claims. Those interests are balanced against the individual’s rights and expectations.
  • Consent is used for optional foreground device-location access and operating-system push-notification permission. A user may refuse location and enter a postcode, or withdraw device permission later, without withdrawing consent affecting processing that occurred lawfully before withdrawal.
  • Vital interests are used only where processing is genuinely necessary to protect someone’s life and the person is incapable of giving consent. Cully Express does not perform public-task processing.

Data Sharing and Access

  • We share relevant order and contact information with the restaurant supplying the food and, for delivery, with eligible or assigned drivers. Restaurants and drivers use that information for their own contractual, safety, and legal responsibilities as well as to perform the order.
  • Active administrators and authorised personnel may access information required for approvals, support, safety, account management, refunds, payouts, financial control, disputes, fraud prevention, security, and audit. Access is role-based and should follow least-privilege requirements.
  • Google and Firebase process authentication, SMS verification, Firestore, Cloud Storage, Cloud Functions, App Check, Analytics, Crashlytics, Cloud Messaging, Hosting, security, and related service data. Apple processes APNs delivery and App Attest or DeviceCheck information. Google processes Play Integrity and Android notification delivery information.
  • Stripe processes card payments, authorisations, captures, refunds, chargebacks, payment security, and related transaction records. Card networks, banks, and card issuers receive the information required to process and dispute transactions.
  • postcodes.io receives postcode queries and, when Current Location is chosen, coordinates for reverse postcode lookup. OpenStreetMap Nominatim may receive postcode queries or one-off coordinates for address suggestions. If a user chooses an external directions action, Apple Maps or Google Maps receives the location or address query selected by that user.
  • We may disclose relevant information to professional advisers, insurers, auditors, law-enforcement bodies, courts, regulators, tax authorities, or another recipient where required by law or reasonably necessary to establish, exercise, or defend legal rights.
  • We do not sell personal data and the production app contains no third-party advertising SDK.

Data Retention

  • Active Firebase Authentication and profile records are retained while the account remains active. Firebase states that authentication IP logs are kept for a few weeks and that, after deletion is initiated, other authentication information is removed from live and backup systems within up to 180 days.
  • Order, payment, refund, earnings, payout, ledger, chargeback, and supporting accounting records are normally retained for six years from the end of the company financial year to which they relate, or longer where an enquiry, dispute, legal claim, fraud investigation, or legal hold remains open.
  • Support messages, refund records and evidence, profile photographs, driver identity, licence and insurance files, and operational notification records currently have no general automatic time-based deletion job. They remain until account deletion removes them, an authorised manual review deletes them, they are replaced, or continued retention is no longer necessary for the applicable support, safety, contract, fraud, dispute, or legal purpose.
  • Legal-acceptance, order, refund, payout, administrator, security, account-deletion, and other audit records currently have no general automatic expiry in application code. Relevant records are retained or pseudonymised for accountability, security, fraud prevention, financial compliance, disputes, and legal claims and must be reviewed and erased or anonymised when those purposes no longer justify identification.
  • Notification tokens are retained until logout or account-switch cleanup, invalid-token cleanup, token replacement, or completed account deletion. Firebase states that Firebase installation identifiers are removed from live and backup systems within up to 180 days after the deletion API call.
  • Firebase Crashlytics retains crash traces and associated installation identifiers for 90 days before removal begins. Google Analytics user-level and event-level retention is controlled by the Analytics property setting, normally two or fourteen months for a standard property; aggregated standard reports are not governed by that setting.
  • App Check attestation material is not retained by Firebase App Check. App Check tokens remain valid for their configured lifetime, which Firebase limits to no more than seven days; tokens used with replay-protection features may be retained for up to 30 days.
  • On-device preferences, drafts, basket state, recent postcodes, card-display information, and identifiers remain until replaced, cleared by the app or user, or removed with app storage or uninstallation, subject to device backups.
  • The ten-minute phone-availability rate-limit record and 180-day-refresh postcode cache do not currently have automatic deletion jobs. Cloud and security logs are retained according to the configured Google Cloud or Firebase log retention and backup settings rather than an app-level deletion timer.

Account Deletion

  • Customers may request deletion in-app from Settings > Delete Account. Driver and restaurant users may use the available account-closure route or contact support@cullyexpress.com. A request creates a pending record for controlled administrative processing rather than immediately erasing an active account.
  • Deletion is deferred while an order is active or, for a customer, while a refund remains unresolved. The request may also be deferred or restricted where records are required for payment reconciliation, safety, fraud, a dispute, a legal claim, tax, accounting, or another legal obligation.
  • When deletion completes, Cully Express deletes the Firebase Authentication user, personal profile, notification preferences and device-token records, role-specific support records, checkout or temporary workflow records selected by the cleanup policy, and the user’s role-specific Cloud Storage prefixes, including customer profile and refund uploads or driver photographs and documents.
  • Completed orders, payment, refund, earnings, payout, ledger, liability, legal-acceptance, fraud-prevention, deletion, and audit records may be retained where necessary. The cleanup removes direct contact information, free text, private snapshots, and private media and replaces the Firebase identifier with a deterministic deletion pseudonym where the production retention process supports that field.
  • Stripe PaymentIntent metadata is updated to replace the customer identifier with the deletion pseudonym. Provider backups and Firebase Authentication or installation records may take up to the provider’s stated deletion period to disappear.
  • Deletion is permanent when completed, but it does not require deletion of records that must lawfully be retained, information that has been irreversibly anonymised, information held by an independent recipient for its own lawful purposes, or local copies in device storage and backups that Cully Express cannot directly control.

Automated Checks and Profiling

  • Cully Express uses automated eligibility, pricing, distance, phone-rate-limit, App Check, payment-state, duplicate-order, promotion, notification, and workflow checks to provide and protect the service.
  • An unaccepted order may be timed out automatically and an uncaptured payment authorisation released when the restaurant does not respond within the applicable period. Scheduled workflows may also activate orders and reconcile objective order or payment states. These rules use status and timing information rather than personal profiling and are necessary to take steps requested by the customer or perform the order contract.
  • Refund activity is profiled into a risk score and level using order and refund frequency information. The result may prompt an administrator to review a case. It does not itself reject a claim, issue a refund, suspend an account, or make another legal or similarly significant decision.
  • Apart from the objective service-execution rules described above, the production system does not use profiling to make decisions based solely on automated processing that produce legal or similarly significant effects. Users may contact support@cullyexpress.com to ask for an explanation or human review of an account, refund, fraud, promotion, restaurant, or driver decision.

Marketing

  • The production app sends operational and transactional notifications connected with accounts, orders, delivery, refunds, restaurants, drivers, and administration where enabled.
  • The production code does not implement marketing email campaigns, personalised advertising, sale of audience data, or promotional push-notification campaigns. Restaurant promotions and sponsored cards may be displayed as platform content, but the audited implementation does not use personal profiles to select behavioural advertising.
  • If Cully Express introduces direct electronic marketing, it must provide the notices and consent or opt-out rights required by law before using personal data for that new purpose.

Security

  • We use encrypted HTTPS or TLS transmission provided by the app, Firebase, Google Cloud, Stripe, and other HTTPS services. Provider-managed encryption protects Firebase and Google Cloud data at rest.
  • Firebase Authentication, phone verification, App Check, Firestore Rules, Storage Rules, server-authoritative Cloud Functions, role and ownership checks, active-Admin checks, transaction and idempotency controls, audit logging, token isolation, and restricted evidence paths are used to protect production data.
  • Production logging is designed to redact email addresses, credentials, tokens, client secrets, and long identifiers from app logs and to record categories or shortened identifiers where practical. Cloud providers may still process request metadata, IP addresses, security events, and technical identifiers required to operate and protect their services.
  • No security measure can guarantee absolute security. Users should protect their password and device and report suspected misuse to support@cullyexpress.com.

International Transfers

  • The configured Cloud Firestore database and Cloud Functions region is europe-west2 in London. This does not mean that every Firebase, Google, Apple, Stripe, card, analytics, crash-reporting, notification, authentication, support, or backup operation remains in the United Kingdom.
  • Firebase Authentication is operated from United States data centres. Firebase, Google Cloud, Firebase Analytics, Crashlytics, Cloud Messaging, App Check, Apple, Stripe, banks, card networks, postcodes.io, OpenStreetMap services, and their subprocessors may process information in the United Kingdom, European Economic Area, United States, or other countries where they maintain facilities.
  • For restricted transfers, we rely as applicable on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another lawful contractual transfer mechanism provided by the recipient.
  • A copy of, or information about, the relevant transfer safeguards may be requested from support@cullyexpress.com, subject to lawful confidentiality restrictions.

Your Data Protection Rights

  • Subject to the conditions and exemptions in data-protection law, individuals may request access to their personal data, correction of inaccurate or incomplete data, erasure, restriction of processing, or delivery of qualifying data in a portable format.
  • Individuals may object to processing based on legitimate interests, including relevant profiling. We will stop that processing unless we demonstrate compelling legitimate grounds that override the individual’s interests, rights and freedoms or the processing is required for legal claims.
  • Where processing relies on consent, consent may be withdrawn at any time without affecting processing that was lawful before withdrawal. Device location and notification permission can also be changed through device settings.
  • Rights are not absolute. We may retain or continue processing information where necessary for a legal obligation, tax or accounting requirement, payment reconciliation, safety, fraud prevention, another person’s rights, or the establishment, exercise, or defence of legal claims.
  • Requests should be sent to support@cullyexpress.com. We may request proportionate information to verify identity and authority before disclosing or changing account information.

Complaints

  • A privacy or data-protection complaint may be sent to support@cullyexpress.com or by post to the registered office. Please describe the issue and the outcome requested so that it can be investigated.
  • An individual may complain to the Information Commissioner’s Office at ico.org.uk or by using the contact details published by the ICO. The right to complain to the ICO is not affected by first contacting Cully Express.

Children

  • Cully Express customer accounts and orders are intended for people aged 18 or over, consistently with the Customer Terms. We do not knowingly offer customer ordering accounts to children.
  • If we learn that a child’s personal data has been submitted contrary to the service rules, we will assess and delete or restrict it where required by law, subject to any necessary safety, legal, or transaction record.

Changes to This Policy

  • We may update this Policy when the service, providers, law, or processing purposes change. The version and last-updated date shown in the app identify the notice in force.
  • Where a change introduces a materially different processing purpose or requires consent, we will provide an appropriate notice and obtain consent where the law requires it. A transparency update that does not introduce new processing does not by itself require a user to consent again.

Contact

  • For privacy questions, data requests, or security concerns, contact support@cullyexpress.com.
  • Postal correspondence may be sent to the registered office listed below.

Company Information

Cully Express (a trading name of A&S Signatures Ltd) Company Number: 15693230 Registered Office: The Collar Factory St. Augustine Street Taunton Somerset TA1 1QN United Kingdom Support: support@cullyexpress.com

Privacy Policy | Cully Express