Privacy notice · 2026-07-27
Your food can be local. Your data should stay purposeful.
This notice explains what Food & Folk collects, why it is needed, and the controls available to you.
Who controls the data
Farm & Folk is the marketplace data controller. Privacy requests can be sent to [email protected]. Each vendor remains responsible for customer information they receive to fulfil an order.
What we use
We process account identity and contact details, vendor applications and onboarding answers (including intended products, producer description, business stage and progress through setup), public farm and product photos, basket and order records, payment references, signed collection QR data, verified reviews, collection history, notifications, audit and security events. For user agreements, we retain the agreement type and version, document fingerprint, acceptance method and time. When a visitor creates an account or marketing subscription, we may also record first-touch campaign parameters, the landing-page path and an external referring hostname, together with the optional detail supplied in the signup question about how they heard about Farm & Folk. These measured and self-reported sources are kept separately to understand which outreach is effective. We do not retain the landing-page query string or a full referring URL. Precise browser location is used only to calculate nearby results and is not stored. A vendor's exact collection address is disclosed only to a customer who has paid that vendor.
Why we use data
Data is used to provide the marketplace contract, tailor seller setup, understand where prospective sellers pause, plan proportionate seller support and future service tiers, route payments, prevent fraud, support collections and verified reviews, meet legal obligations, operate a secure service, deliver important account notifications, and measure the effectiveness of Farm & Folk's marketing on a legitimate-interest basis. Seller position answers inform guidance and communications but do not decide marketplace approval.
Google sign-in and Google user data
When you choose Google sign-in, we receive only the basic OpenID profile information Google makes available for authentication: your name, email address, profile image and the Google account identifier needed to link the sign-in method. We use this information only to create or sign you into your Farm & Folk account, maintain the linked sign-in method, prevent account abuse and provide account support. We do not request access to Gmail, Google Drive, Calendar, Contacts or other Google services. Google authentication credentials, where supplied by Google, are retained only as needed by our authentication service to maintain the account link and are not disclosed to vendors. We do not sell Google user data, use it for advertising, or transfer it to third parties except service providers required to operate our authentication and marketplace services, or where required by law. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Facebook sign-in and Facebook user data
When you choose Facebook sign-in, we request only your public profile and email address for authentication. We may receive your name, email address, profile image and Facebook account identifier. We use this information only to create or sign you into your Farm & Folk account, maintain the linked sign-in method, prevent account abuse and provide account support. We do not request permission to publish to Facebook, access your friends list or use Facebook data for advertising. Authentication credentials supplied by Facebook are encrypted and retained only as needed by our authentication service to maintain the account link. They are not disclosed to vendors. We do not sell Facebook user data or transfer it to third parties except service providers required to operate our authentication and marketplace services, or where required by law.
Email updates
Marketing email is optional and separate from the marketplace contract. Subscription requires email confirmation. We store the email, consent version, form placement, first-touch attribution and consent timestamps for accountability and campaign measurement. Every marketing message must include an unsubscribe control, and account settings provide another way to stop updates. Transactional receipts, agreement notices and security messages are unaffected.
Retention and sharing
Account data is kept while the account is active. Agreement acceptance evidence and related audit events are retained as needed to establish the terms governing marketplace activity and resolve disputes. Incomplete media is short-lived; public photos remain until removed or replaced. Verified reviews remain linked to the transaction but display only a shortened customer name. Questionnaire identity, contact, address and business details may be shared with Stripe to pre-fill the connected-account verification the seller chooses to complete; Farm & Folk does not collect Stripe's remaining high-risk identity documents or bank credentials. Transaction records are retained only as required for accounting, disputes and law, then deleted or anonymised. Information is not sold.
Your controls
Account settings provide a portable data export, email preferences and password-confirmed deletion. Deleting a shopper account removes login data and anonymises retained transaction contacts. You may also request access, correction, restriction, objection or erasure, and may complain to the UK Information Commissioner's Office.
If our legal terms change, we'll notify you in your account and ask you to accept the updated terms before you can continue with actions like ordering, payments, and collection.