Last updated: 7 October 2026
GoDeli ("we", "us", "our") operates the GoDeli platform at godeli.ie. This policy explains what personal data we collect, why we collect it, how it is used, and your rights under the EU General Data Protection Regulation (GDPR) and Irish data protection law.
We take your privacy seriously. We collect only what is necessary, we do not sell or share your data for advertising, and we do not use advertising trackers or build profiles of you. The only measuring we do is our own optional, first-party visitor analytics, and only if you say yes in the cookie banner.
GoDeli is the data controller for personal data processed through this platform. If you have questions about this policy or wish to exercise your rights, contact us at daniel@godeli.ie.
| Data | Purpose | Legal basis |
|---|---|---|
| Name (first and last) | So the deli can identify your order at collection | Contract performance (Art. 6(1)(b)) |
| Phone number | So the deli can contact you about your order, for example to confirm the details of a custom cake or a collection time | Contract performance (Art. 6(1)(b)) |
| Items ordered, customisations, total | To fulfil your order and generate a receipt | Contract performance (Art. 6(1)(b)) |
| Custom cake details (size, flavour, filling, design, colours, writing, and any dietary needs you specify) | To make your cake to your specification when you order one | Contract performance (Art. 6(1)(b)) |
| Bakery order choices (cake or cupcakes, size, cake type, cream, toppings, personal message) | To make your cake or cupcakes to your specification | Contract performance (Art. 6(1)(b)) |
| Images you upload (for example a photo to be printed on a cake or cupcakes) | To print the image on your order. The image is uploaded to our image host, stored with your order, and shown to the deli's staff who download it to print it | Contract performance (Art. 6(1)(b)) |
| Special requirements, allergies and dietary needs (free text, and any dietary options you pick) | To make your order safely and as requested. This can be health-related information | Your explicit consent (Art. 9(2)(a)), given when you type it in, you can leave it blank |
| Collection time and your substitution preference | To prepare your order for when you arrive, and to know what to do if an ingredient runs out | Contract performance (Art. 6(1)(b)) |
| Order and payment reference numbers (from SumUp) | To match your payment to your order and to process refunds | Contract performance (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for financial records |
| Text messages (SMS) we send you (receipt, refund or cancellation notices) and delivery status | To send you a copy of your receipt once you have paid, and to tell you if your order is cancelled or refunded | Contract performance (Art. 6(1)(b)) |
| Anonymous session ID (created by Firebase when you order) | To let your browser place and confirm your order without you creating an account. It is not linked to your identity beyond that order | Legitimate interests (Art. 6(1)(f)), to operate the service securely |
| Visitor analytics, only if you accept them in the cookie banner: pages viewed, buttons and links tapped, how far you scroll, how long you spend on the page, which basket and checkout steps you reach, the type of any form error (never what you typed), page errors and load speed, device, browser, operating system, screen size, language, the site you came from, approximate country and town (worked out from your connection, your IP address is not stored), and random visitor and visit ID numbers | To understand how the ordering page is used so the deli and GoDeli can fix problems and improve it. Shown to the deli owner as charts and as step-by-step records of anonymous visits | Consent (Art. 6(1)(a)), you can refuse in the banner, and withdraw at any time using “Cookie settings” in the page footer |
| Geolocation (if you allow it) | To sort nearby delis by distance | Consent (Art. 6(1)(a)), you can decline or revoke via browser settings |
We collect your name and phone number so the deli can identify and, where needed, contact you about your order. We do not collect your email address or payment card details as a customer. Payment is handled directly by SumUp. If you provide dietary needs, allergies or special requirements for a cake, they are used only to make that order and are not used for any other purpose.
Images you upload. Only upload an image you own or have permission to use. If it shows other people, please make sure they are happy for it to be printed. We use your image only to fulfil your order: we do not use it for marketing, we do not sell it, and we do not use it to identify anyone. To print it, the deli's staff download it and upload it to the website of the cake image printing machine in the bakery, which is operated by a third party and handles the image under its own privacy policy.
Text messages. Your receipt (a short text with a link to an image of it, which shows your items, total and collection time, and not your phone number) and any refund or cancellation notice are sent to the phone number you give us, by text message (SMS). Please give a mobile number that can receive texts. You can opt out of texts at any time by emailing daniel@godeli.ie with your mobile number, and we will stop texting it. We only send texts about orders you have placed, never marketing. Messages are sent through Amazon Web Services (Amazon SNS) and carried by mobile networks, which handle delivery under their own policies.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account authentication | Contract performance (Art. 6(1)(b)) |
| Business name, address, phone, hours, menu | To display your deli listing and accept orders | Contract performance (Art. 6(1)(b)) |
| Logo, category pictures and brand colour you upload or choose | To display your deli page. Images are stored with our image host | Contract performance (Art. 6(1)(b)) |
| Customer images, special requirements and order choices you receive | To make and print customers' orders. You must use them only for that order and delete or stop using them once the order is complete | Contract performance (Art. 6(1)(b)) |
| Orders received (customer names, phone numbers, items, cake details, uploaded images, totals) | Order fulfilment, contacting customers about their orders, and business analytics | Contract performance (Art. 6(1)(b)) |
| Visitor analytics for your page (anonymous visits, taps, time on page, funnel) | To show you how customers use your order page | Contract performance (Art. 6(1)(b)); the underlying visitor data is collected on the visitor's consent |
| Aggregated order statistics | AI-generated business insights shown to the deli owner | Legitimate interests (Art. 6(1)(f)), only anonymised totals are sent to OpenAI, no customer personal data |
We use the following third parties to operate this service. Each is bound by a Data Processing Agreement and processes data only on our instructions.
| Processor | Purpose | Location |
|---|---|---|
| Google Firebase (Google LLC) | Authentication and database storage | EU data centres where possible; subject to Google's Standard Contractual Clauses |
| SumUp Payments | Card payment processing, PCI-DSS Level 1 compliant | EU |
| OpenAI | Generating business insights for deli owners using aggregated, non-personal statistics only | USA, subject to Standard Contractual Clauses |
| Vercel | Hosting the website. Our servers see a visitor's IP address while handling a request (and use it to work out country and town) but we do not store it | EU / USA, subject to Standard Contractual Clauses |
| Cloudinary | Storing and serving images (customer-uploaded photos for printing, deli logos and category pictures) | USA / global network, subject to Standard Contractual Clauses |
| Amazon Web Services (Amazon SNS text messaging) | Sending receipts and refund or cancellation notices to customers' phone numbers | USA, subject to Standard Contractual Clauses |
| Google (Places address search) | Address search while a deli is being set up | USA, subject to Standard Contractual Clauses |
| Mapbox | Address search and geocoding during deli setup | USA, subject to Standard Contractual Clauses |
We do not use Google Analytics, Meta Pixel, or any advertising or tracking technologies.
If you are in the EU or UK, you have the following rights:
To exercise any of these rights, email us at daniel@godeli.ie. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission of Ireland (dataprotection.ie).
When a deli's staff print a customer's image, they can use their device's camera to scan a QR code on the printing machine. The camera is used only for that scan, only after your browser asks for permission, and only while the scanner is open. The camera feed is processed on the device, and no photo or video from it is recorded, uploaded or stored by us.
See our Cookie Policy for full details. We use technically necessary storage, plus optional analytics storage if you accept it in the cookie banner. No advertising or cross-site tracking cookies.
All data is transmitted over HTTPS. Authentication credentials are hashed by Firebase and never accessible to us. Payment card data is processed entirely by SumUp and never passes through our systems.
Our service is not directed at children under 16. We do not knowingly collect personal data from children.
We may update this policy from time to time. We will notify deli owners of material changes by email. The date at the top of this page always reflects the most recent version.
Questions? Email us at daniel@godeli.ie