Privacy notice · 2026-07-20
Your food can be local. Your data should stay purposeful.
This notice explains what Farm & Folk collects, why it is needed, and the controls available to you.
Who controls the data
Farm & Folk is the marketplace data controller. Privacy requests can be sent to [email protected]. Each vendor remains responsible for customer information they receive to fulfil an order.
What we use
We process account identity and contact details, vendor applications, public farm and product photos, basket and order records, payment references, signed collection QR data, verified reviews, collection history, audit and security events, and the policy version accepted. Precise browser location is used only to calculate nearby results and is not stored. A vendor's exact collection address is disclosed only to a customer who has paid that vendor.
Why and where
Data is used to provide the marketplace contract, route payments, prevent fraud, support collections and verified reviews, meet legal obligations, and operate a secure service. The application and PostgreSQL database are initially hosted on DigitalOcean, with S3-compatible object storage for media; the portable deployment can later move to AWS. AWS SES handles service email, Stripe handles payment and vendor onboarding data, and Postcodes.io receives a postcode to return map coordinates.
Email updates
Marketing email is optional and separate from the marketplace contract. Subscription requires email confirmation. We store the email, consent version, source and consent timestamps for accountability. Every marketing message must include an unsubscribe control, and account settings provide another way to stop updates. Transactional receipts and security messages are unaffected.
Retention and sharing
Account data is kept while the account is active. Incomplete media is short-lived; public photos remain until removed or replaced. Verified reviews remain linked to the transaction but display only a shortened customer name. Transaction records are retained only as required for accounting, disputes and law, then deleted or anonymised. Information is not sold.
Your controls
Account settings provide a portable data export, email preferences and password-confirmed deletion. Consumer deletion removes login data and anonymises retained transaction contacts. You may also request access, correction, restriction, objection or erasure, and may complain to the UK Information Commissioner's Office.
Material changes require acceptance of a new policy version before further purchases.