StudentMenu

DRAFT — for review by a qualified solicitor before publishing, alongside the Student Terms.

Privacy Policy

This policy explains what StudentMenu Ltd ("StudentMenu", "we"), a company registered in England and Wales, collects when you use the StudentMenu app, card and website, why, who it goes to, and how to delete it. We are the data controller. Questions or requests: fortune@studentmenu.co.uk.

1.What we collect

Your account	Your name, the email you sign in with and a password (stored only as a one-way hash). If you sign in with Google or Apple, the account id and email they give us. With Apple you can hide your email; we then see an Apple relay address.
Student details	Your university or college, your university email (to verify you're a student, with a 6-digit code), your area, and — where you give them — course dates, date of birth, gender and a student ID reference. Your card carries a university code so staff can see you're a student.
Your card and activity	Your card's QR code, points, rewards and redemptions, which restaurants have scanned your card, group orders you start or join, the societies you join, referrals, and your settings (theme, card design).
Photos you post	Photos of your food you choose to share, with the restaurant and dish they belong to. They're checked automatically before they appear, can be reported by other students, and expire after a while.
Location	Only when you allow it: to show restaurants near you, draw walking routes, and — when you send a group order to the till — to check you're at the restaurant. Your location is used at that moment and not stored.
Sticker scans	When a StudentMenu sticker or poster is scanned we count it, with the time, the device type and a one-way hash of the network address — not who you are.
Payments	If you buy PLUS+ on our website, payment is handled by Stripe. We never see or store your card number. PLUS+ can't be bought in the app.

We don't use advertising trackers, we don't build advertising profiles, and we never sell your data.

2.Why we use it

To run your account and card — verifying you're a student, applying discounts and points, group orders and society membership. (Lawful basis: our contract with you.)
To keep StudentMenu safe — preventing fraud and abuse, checking photos, acting on reports and blocks. (Legitimate interests.)
To tell you what you need to know — codes, receipts, changes to your account, and replies to you. (Contract.) Any marketing email is optional and has an unsubscribe link. (Consent or legitimate interests.)
To improve the service — counting scans, orders and redemptions in total, so restaurants and societies can see what works. (Legitimate interests.)
To meet legal duties — tax records for payments made on the website. (Legal obligation.)

3.Who sees it

Restaurants you use see what they need to serve you: your first name, that you're a verified student, your card's tier and points with them, and what you ordered.
Societies you join see that you're a member.
Other students see photos you post (with your first name), and your first name in a group order you share.
Services that run StudentMenu for us, only for that purpose: Render (servers and database), Cloudflare (photo storage), Postmark (email), Stripe (website payments), OpenAI (automatic checks of photos you post), Google and Apple (if you sign in with them), OpenStreetMap services and CARTO (maps, street names and walking routes — they receive the position you ask about, not who you are).

Some of these providers are in the United States. Where your data leaves the UK, it is protected by the UK's data bridge with the US or by the UK's approved contract terms.

4.How long we keep it

Your account and card: until you delete your account.
Photos you post: until they expire, you delete your account, or they're removed after a report.
Sign-in and verification codes: 10 minutes.
Scan counts and order totals: kept, but no longer linked to you once your account is deleted.
A one-way hash of the email of a deleted account, so a banned account can't simply re-register.

5.Deleting your account

In the app or on the website: Settings → Delete account. Without the app: studentmenu.co.uk/delete-account. Either way we email you a 6-digit code to confirm it's you.

Deleting removes your account, card, points, rewards, photos, society memberships, blocks and sessions. If you signed in with Apple, we also revoke StudentMenu's access to your Apple ID.

6.Your rights

You can ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to take it elsewhere. Email fortune@studentmenu.co.uk and we'll reply within a month. If you're unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

7.Security, children and changes

Passwords are hashed, connections are encrypted, and codes expire quickly and are limited in how often they can be requested. StudentMenu is for university and college students and isn't directed at children. If we change this policy in a way that matters, we'll tell you in the app or by email before it applies.

Last updated: September 2026