Privacy Notice

Vesta is an unregistered, UK-focused service for people aged 18 and over. Its operator decides why and how personal data is processed to run the platform. Before Vesta expands beyond its initial UK availability, we will publish verified operator and privacy-contact details.

This notice covers Vesta's website, accounts, kitchen profiles, reports and support. A cook that receives and independently uses a visitor's WhatsApp enquiry, phone call, payment or food-order information makes its own decisions about that data and may be a separate controller.

We process account identifiers and authentication data; cook and kitchen details such as names, public contact information, general area, menus, images and links; reports and moderation records; service and security signals; and device or preference data such as a selected general area and enquiry basket.

Vesta also records limited first-party engagement events, such as profile views, menu interactions and contact clicks. The service uses a browser session identifier and stores an HMAC-derived analytics value for up to 30 days. We do not receive the content of a direct WhatsApp conversation, final food order, food payment or delivery merely because we provide a link to a cook.

We use data to provide accounts and kitchen hosting; publish cook-selected public information; enable direct contact with cooks; protect the service; prevent abuse and fraud; handle reports; comply with legal obligations; and understand how the service is used.

We rely on the lawful basis appropriate to each purpose, including performance of a contract, legitimate interests, legal obligations and consent where required. We will not use personal data for food transactions because Vesta does not process them.

We share data only where needed to operate Vesta, comply with law or protect rights and safety. This can include hosting, authentication, database, security and CAPTCHA providers, professional advisers and authorities. Public kitchen information is visible to visitors. When you choose an external contact link, that provider handles data under its own privacy terms.

We keep data only as long as needed for the purpose, including security, legal and dispute needs. Analytics events are designed to be removed after 30 days. Account deletion is available in account settings; deleting an account cannot remove information that a cook independently received through a direct contact channel.

Depending on applicable law, you may have rights to access, correct, erase, restrict, object to or port your data, withdraw consent and complain to the Information Commissioner's Office. We will publish a verified privacy contact before wider public availability so these requests can be made directly.

We will update this notice when our processing changes, including before we introduce subscriptions, paid plans, delivery, payments or new tracking. This version is dated 20 September 2026 and applies to the UK only.