Susten builds a weekly meal plan around your goals and maps it to real supermarket products. Doing that well means we hold personal data about you, some of it sensitive. This policy explains what we collect, why, who else touches it, how long we keep it, and the choices you have. It describes what the service actually does today — including the parts still rough at the edges — rather than a generic template.
1. Who we are
The data controller is RS TECHNOLOGY LIMITED, a company registered in England and Wales (company number 17050418), registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We trade as Susten.
For anything in this policy, contact richard@susten.app. We are registered with the Information Commissioner's Office (ICO), registration reference ZC225155.
2. What we collect
Account details
- Email address and first name.
- Your password, stored only as a secure hash (Argon2id) — we cannot read it. Sign-in and email-verification tokens are also stored hashed.
Goals and body metrics
If you use the macro calculator: sex, age, weight, height, activity level, and goal (lose, maintain, gain), plus the calorie and macro targets derived from them.
Dietary requirements and allergens
Your allergens (for example gluten, dairy, nuts), diets (for example halal, kosher, vegetarian, keto), kitchen equipment, budget, and how often you cook. Some of this is special category data — see section 3.
How you use Susten
- Your meal plans, recipe customisations, and recipe ratings.
- Order history: what was on the list, its estimated cost, and the delivery date and time window you recorded.
- Free-text notes you attach to recipes. These are stored as you write them, so please don't put anything in a note you wouldn't want stored.
Technical data
- When you register, sign in, or use a sign-in link, we record the IP address and browser identifier (user agent) of the request alongside the session token, for account security.
- Application logs, which can include your email address, kept for 30 days.
- One optional analytics cookie on this website — see section 6.
Waitlist
If you join the waitlist we collect your email address, first name, and the features you said you were interested in.
3. Health and dietary data (special category data)
Some of what makes Susten useful is legally sensitive. Allergens can reveal a medical condition. Halal or kosher requirements can reveal a religious belief. Body metrics and weight goals relate to your health. UK GDPR calls this special category data and holds it to a higher standard.
We process it only to build and adjust your meal plans, and only with your explicit consent, which we ask for separately when you create your account (Article 9(2)(a) UK GDPR). We record when you gave it and which version of this policy you agreed to. You can withdraw consent at any time by deleting your account, or by emailing richard@susten.app — though without this data Susten cannot plan around your requirements, so withdrawing it means we can no longer provide the personalised service.
4. Why we use your data, and our lawful bases
| What we do | Lawful basis |
|---|---|
| Provide the service: your account, plans, shopping lists, and orders | Performance of a contract |
| Build plans from your health and dietary data | Explicit consent (Article 9(2)(a)) |
| Send service emails: welcome, sign-in links, password and account changes | Performance of a contract |
| Waitlist updates about Susten | Consent (unsubscribe any time) |
| Account security: recording IP and browser data against sessions | Legitimate interests (keeping accounts safe) |
| Keeping deleted users' emails on a do-not-contact list | Legitimate interests (not contacting people who left) |
| Analytics on this website | Consent (the cookie banner) |
We do not sell your data, and we do not use it for advertising. There is no profiling that produces legal or similarly significant effects — the only automated decisions are which recipes end up on your plan.
5. Who we share it with
We use a small number of service providers, each processing data on our instructions:
| Provider | What they do with your data |
|---|---|
| Neon | Hosts our database — everything described in section 2 lives here |
| Render | Hosts our API servers (Frankfurt, EU) |
| Loops | Sends our emails; holds your email address, first name, and waitlist details |
| Netlify | Hosts this website and the app, and stores a record of waitlist email addresses |
| Analytics on this website only, and only if you accept the cookie |
When you click through to Tesco or Sainsbury's, you leave Susten and their privacy policies apply. We don't send them your data — the link works like any link on the web, which means the retailer's site sees your IP address when it loads, as with any site you visit.
Where a provider processes data outside the UK, we rely on UK adequacy decisions or the UK's approved standard contractual safeguards (the IDTA or UK Addendum).
6. Cookies and analytics
This website uses one optional thing: Google Analytics, which sets _ga cookies to help us understand how people use the site. It is off by default and only turns on if you accept it in the banner. Reject it and no analytics cookies are set. You can change your mind by clearing this site's data in your browser, which brings the banner back.
We record your banner choice in your browser's local storage. The app itself stores your sign-in session in local storage too — that's strictly necessary for the service to work and isn't used for tracking. There are no advertising cookies anywhere on Susten.
7. How long we keep it
| Data | How long |
|---|---|
| Account, profile, plans, and order history | Life of your account; erased when you delete it |
| Session tokens (including the IP and browser data on them) | 7 days to expiry, then purged |
| Sign-in and verification tokens | Up to 24 hours to expiry, then purged |
| Application logs | 30 days |
| Waitlist details | Until you unsubscribe, or 12 months after launch |
| Email on the do-not-contact list (after account deletion) | Indefinitely — kept only so we never contact you again |
| Analytics (if accepted) | 14 months, held by Google Analytics |
8. Your rights
Under UK GDPR you can ask us to:
- Access your data — a copy of what we hold about you.
- Correct anything inaccurate.
- Erase it. You can delete your account yourself from the app (Account → Delete account). This permanently removes your account, profile, plans, and history from our database.
- Export it (data portability). There's no self-serve export yet — email us and we'll send you your data within one month.
- Object to processing based on legitimate interests, or restrict processing while we resolve a dispute.
- Withdraw consent at any time, without affecting processing that happened before.
Two honest caveats about deletion:
- We keep your email address on a do-not-contact list after deletion, so we never email someone who left. That is the only thing we keep.
- Deleting your account does not yet automatically remove your contact record from our email provider (Loops) or the waitlist store. Email richard@susten.app and we'll remove those by hand. We're working on making this automatic.
To exercise any right, email richard@susten.app. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out first.
9. Security
Passwords are hashed with Argon2id and never stored in plain text. Session and sign-in tokens are stored hashed. All traffic is encrypted in transit. Access to production data is limited to the people who run the service.
10. Changes to this policy
When we change this policy we'll update the date at the top, and for significant changes we'll tell you by email or in the app before they take effect.
11. Contact
RS TECHNOLOGY LIMITED, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
richard@susten.app