Privacy Policy

1. Who We Are and Who Controls Your Data

SAVOREVERYTHING INC., operating as Savor Everything in Barbados, provides a Barbados-focused food ordering and delivery marketplace and is the data controller responsible for personal data processed through the Services under the Barbados Data Protection Act, 2019.

This Privacy Policy explains how we collect, use, share, retain, and protect personal data, and the rights you have under Barbadian data protection law. It applies to our websites, applications, account features, ordering and delivery services, Savor Atlas, Savor Pass, Savor ID, Savor credits, support channels, and Savor GPT OAuth actions.

If you have questions about this policy or how your data is handled, or if you wish to exercise your rights, contact us at privacy@savoreverything.com. Where we are required to have a data protection officer or privacy contact, that person can be reached at the same address.

2. Information We Collect

We collect information you provide directly, including your name, email address, phone number, delivery addresses, account credentials, support messages, dietary preferences, allergies, dislikes, reviews, and other information you choose to save in your Savor Everything account.

When you place or prepare an order, we collect order details such as restaurant, menu items, cart contents, delivery instructions, delivery location, payment status, order status, tips, fees, credits, points, and related transaction records.

For the Creator Program, we also process creator applications, account-verification evidence, accepted-terms records, creator codes, order-attribution records, eligibility and payout records, and fraud-review signals such as repeated customer, account, payment, device, or delivery-location patterns where reasonably necessary to protect the program.

When a creator connects a social account through the provider's official sign-in, we collect, within the scopes that provider grants, the provider account identifier, handle, display name, profile link, avatar, follower and engagement statistics, and a limited snapshot of recent public content. We use this information to verify account ownership, set follower-based earning tiers, verify submitted content, and display creator profiles within Savor Everything. Provider access and refresh tokens are stored encrypted and are never displayed, and connected-account statistics may be refreshed periodically while the connection remains active. Disconnecting a social account stops further collection, and we revoke or delete the associated tokens.

When a creator submits a video to a creator campaign, we process the video link, the platform's video identifier, title, thumbnail, and publish date, and the creator's rule and disclosure confirmations. While the clip is tracked we record a daily snapshot of its platform-reported views and, where available, likes, through the creator's connected account or the platform's public data. We use these records to calculate campaign earnings and to detect removed, private, duplicate, or artificially boosted videos. Automated checks may place a clip on hold and create a flag record, and a person reviews each flag before it counts against the creator.

If you follow a creator on Savor Everything, we record the follow relationship and your notification preference so we can show follower counts, determine creator earning tiers, and send updates you have chosen to receive. You can unfollow a creator or turn off notifications at any time.

If you use Plan my eats on Savor Atlas, we store whether you are visiting or local, the place you stay at or start from (a place you pick from our list or search, or, if you choose "Use my location", your device location rounded to about 100 metres), your dates or how long you want to plan for, the meals you want to eat out, and the party, budget, travel and food preferences you select, together with the plan we generate and a hashed form of your IP address to limit abuse. When you search for a place to stay or start from, the text you type may be sent to Photon, an OpenStreetMap-based search service run by komoot, to find matching places in Barbados. If you ask us to email the plan, we store your email address and use it to send that plan. We send you marketing emails only if you tick the separate opt-in box. To choose restaurants and write plan descriptions, we may send these plan details and restaurant information, never your email address, to our AI provider. Lodging and place data © OpenStreetMap contributors.

We also collect technical information such as device, browser, IP address, approximate location, log data, cookies and similar identifiers, and usage information needed to operate, secure, debug, and improve Savor Everything. When you follow a link from Savor Everything to an external website, we may record the source page, destination domain and path, link label, time, and a session identifier so we can measure traffic sent to partners. We do not retain destination URL query strings or fragments in this record.

3. Sensitive Personal Data (Allergies, Health, and Dietary Needs)

Some information you can save, such as allergies, medical or dietary restrictions, and religious dietary requirements, may be treated as sensitive personal data under the Barbados Data Protection Act, 2019. We collect and use this information only to help you order food that suits your needs, to pass relevant notes to restaurants, and to power dietary filters and suggestions.

You choose whether to provide this information. By saving allergy, health, or religious dietary details in your account or in order notes, you consent to our processing them for the purposes described in this policy. You can update or remove these details in your account, and you can place orders without saving them.

Because allergen and dietary tools may be incomplete or wrong, you should still confirm safety-critical requirements directly with the restaurant. See our Terms of Service for more on food safety.

4. Legal Basis for Processing

Under the Barbados Data Protection Act, 2019, we process personal data only where we have a lawful basis to do so. Depending on the activity, our basis is one or more of the following:

• Performance of a contract: to create and operate your account, process orders, coordinate delivery, and provide Savor Pass, credits, and support you request.
• Consent: for sensitive personal data (such as allergy, health, or religious dietary details), for non-essential cookies and analytics, and for direct marketing where consent is required. You may withdraw consent at any time.
• Legal obligation: to meet tax, accounting, records, and other legal requirements that apply to us in Barbados.
• Legitimate interests: to prevent fraud and abuse, secure and debug the Services, improve our products, and count visits and estimate the country, region and city of each visit from its IP address, to prevent abuse and measure our audience, in a way that is balanced against your rights.

5. Savor GPT and OAuth Actions

If you use the Savor Everything GPT in ChatGPT, account features require you to sign in securely with Savor Everything through OAuth. ChatGPT receives an access token that lets it call approved Savor Everything action endpoints for your account.

Savor Everything uses that token to identify your account and authorize the requested scope, such as profile, restaurants, cart, orders, reviews, preferences, or Savor Pass information. We store OAuth authorization codes, access tokens, and refresh tokens in hashed form, along with consent and audit metadata.

Savor Everything receives the action request data needed to fulfill the GPT request, such as a restaurant search, cart change, order lookup, preference update, checkout handoff, or Atlas review action. Messages and other activity inside ChatGPT may also be processed by OpenAI under OpenAI's own terms and privacy policy.

You should not paste passwords, API keys, payment card numbers, government IDs, or other unnecessary sensitive information into ChatGPT or Savor GPT conversations.

6. How We Use Information

We use information to create and secure accounts, process orders, maintain carts, support checkout handoff, coordinate restaurants and delivery workflows, provide order history and tracking, manage Savor Pass or Foodie benefits, maintain Savor ID, provide credits or points, and operate Savor Atlas reviews.

We also use information to provide customer support, respond to inquiries, prevent fraud or misuse, enforce policies, debug technical issues, improve products and services, measure traffic and referrals sent to external partners, and comply with legal, tax, accounting, security, and operational obligations.

7. Payments

Payment confirmation happens on Savor Everything checkout or through our payment providers. Savor GPT may help prepare a cart and provide a checkout handoff, but it does not complete payment inside ChatGPT.

Payment processors may collect and process payment information under their own terms. Savor Everything stores payment status and transaction references needed to operate orders, refunds, support, and accounting. We do not store full card numbers, CVV/CVC codes, or other sensitive cardholder authentication data.

8. Cookies and Similar Technologies

We and our service providers use cookies, device identifiers, and similar technologies to keep you signed in, remember preferences, secure the Services, measure performance, and understand how the Services are used.

Necessary cookies keep sign-in, your cart, security and cookie choices working. Optional analytics and advertising are off until you allow them. Choose Necessary only, Accept all, or individual preferences in the cookie panel; reopen Cookie settings in the footer or admin account menu at any time. Your choice lasts up to one year. Withdrawing optional consent stops future collection and unloads previously allowed advertising and analytics runtimes.

For every visit, without cookies or storage on your device, we record the time, broad site area, pages viewed, device type, whether you were signed in, referring website and an approximate country, region and city looked up from your IP address on our own servers, using DB-IP's IP to City Lite database. We keep a keyed hash of your IP address, never the address itself, for 30 days to detect abuse and to leave our own team's visits out of our counts, and a daily visitor code, derived from your network and browser, that cannot be linked across days. This does not depend on your cookie choice and is not linked to your account.

With analytics consent, we also keep an identifier in your browser so we can recognise it between visits, and record visits, page views by broad site area, Atlas returns, and visible-tab activity. Signed-in accounts can be associated with visit totals and last-seen times. A visit ends after 30 minutes without visible activity; online means a visible heartbeat within 90 seconds. On Savor Atlas, the same consent also lets us record which videos, stories and places you open, roughly how long you watch, what you type into the Atlas search box and how many results it found, and when you open the map or plan builder, change the sort or filters, or tap to order. Apart from those Atlas searches, we do not collect form contents, private URL parameters or precise location for these analytics. This Atlas activity is kept for 13 months. Parish clusters use a parish explicitly present in an address you supplied, with unknown locations left unknown. With analytics enabled, you may also choose to supply a parish at signup; this is optional and is stored separately from later delivery locations.

We use Google AdSense to provide advertising on public content pages. Google and other third-party advertising providers may place and read cookies, use web beacons, and collect IP addresses, device identifiers, and information about visits to this and other websites to serve and measure ads, prevent fraud, and, where permitted, personalize advertising. Google processes this information under its own privacy policies and your advertising settings.

• How Google uses information from sites and apps that use its services
• Manage Google advertising personalization
• IP Geolocation by DB-IP (db-ip.com), licensed under CC BY 4.0

9. How We Share Information

We share information with restaurants, delivery partners, service providers, payment processors, hosting providers, analytics and security providers, and support tools when needed to provide Savor Everything services. Where we use processors, we put written agreements in place requiring them to protect personal data and use it only on our instructions.

For example, restaurants may receive order items, customer notes, and fulfillment details; delivery partners may receive delivery address, instructions, and order status details; and service providers may process data to host, secure, or support the platform.

We do not sell your personal information. We may disclose information if required by law, to protect rights and safety, to investigate abuse or fraud, or in connection with a business transaction such as a merger, acquisition, financing, or sale of assets.

10. International Data Transfers

Some of our service providers, including payment processors, hosting, analytics, communications, and OpenAI/ChatGPT, may process personal data outside Barbados. Where we transfer personal data outside Barbados, we take steps required by the Barbados Data Protection Act, 2019 to ensure an adequate level of protection, such as using providers subject to comparable data protection standards and putting appropriate safeguards or contractual protections in place.

By using the Services and features that rely on these providers, you understand that your data may be processed in other countries with different data protection laws.

11. Reviews and Public Content

If you submit Savor Atlas reviews or other public content, that content may be displayed publicly with related restaurant and profile information. Reviews may be moderated, rejected, hidden, or removed if they violate our policies or applicable law.

Do not include private information about yourself or others in public reviews.

11A. YouTube and Other Embedded Videos

Savor Everything uses YouTube API Services. Videos from YouTube play in YouTube's embedded player, and we use YouTube API Services to look up public details such as when a video was published and how long it is. Creators who connect a YouTube account to the Creator Program let us read their channel and video information and view counts, read-only, to track campaign clips; we never post to or change their account.

When an embedded YouTube, Instagram, or TikTok player loads, that platform may receive your IP address and device information and may set cookies under its own privacy policy. Google's handling of YouTube data is described in the Google Privacy Policy.

External players on Atlas load directly when you open a video, independently of your analytics and advertising cookie choices. You can also follow a direct link to the original platform. Reopen Cookie settings in the footer to change or withdraw optional analytics and advertising choices; withdrawal reloads the page to unload previously allowed advertising code. Google's separate regional consent message may request additional advertising choices where applicable.

Creators can remove Savor Everything's access to their YouTube account at any time in their Google account security settings. Disconnecting the account on the Savor Creators page also revokes that access and deletes the access tokens we hold. Creators and rights holders can take an embedded video, or all of theirs, off Savor Atlas at once on the "Remove your video" page (linked from each video and the site footer). If they leave an email, we keep it with the request only to reply.

• Google Privacy Policy
• YouTube Terms of Service
• Google account permissions (remove Savor Everything's access)

12. Data Retention

We keep personal data only for as long as needed to provide Savor Everything services, maintain account records, support orders, meet legal and accounting obligations, resolve disputes, enforce agreements, and protect the platform. When data is no longer needed, we delete, anonymize, or restrict it.

Visit records are kept for 13 months, IP hashes for 30 days, and daily visitor codes become unlinkable within two days. Optional visit, page-view and outbound-click records are deleted after 13 months; tab presence is deleted after two days. Account visit totals, first/last-seen dates and the parish at the first recorded visit remain with the account until deletion. Turning off analytics stops new collection; it does not invent or erase order history. You can request deletion of existing personal data through our privacy contact.

OAuth tokens may expire, rotate, or be revoked. Order, payment, review, audit, and support records may be retained for the periods required by Barbadian tax, accounting, security, and fraud-prevention rules, which may be longer than the life of your account.

13. Security

We use technical and organizational measures designed to protect personal data, including access controls, encrypted transport, hashed OAuth tokens, logging, monitoring, and environment-based secret management. If a personal data breach occurs that is likely to affect your rights, we will notify the Data Protection Commissioner and affected individuals where the Barbados Data Protection Act, 2019 requires.

No system is perfectly secure. You are responsible for maintaining the confidentiality of your account credentials and for using strong, unique passwords.

14. Your Data Protection Rights

Subject to the Barbados Data Protection Act, 2019 and its exemptions, you have the right to:

• Access the personal data we hold about you and ask how it is processed.
• Correct inaccurate or incomplete personal data.
• Request erasure of your personal data where the law allows.
• Restrict or object to certain processing, including processing based on our legitimate interests.
• Object to direct marketing at any time.
• Request portability of personal data you provided to us, in a structured, commonly used format.
• Withdraw consent at any time where we rely on consent, without affecting processing already carried out.

15. How to Exercise Your Rights

You can update account profile details, delivery addresses, dietary preferences, allergies, dislikes, and other saved preferences through Savor Everything account tools where available, and you can disconnect Savor GPT through ChatGPT's connected apps or action settings.

To make any other request, including access, correction, erasure, restriction, objection, portability, or token revocation, contact us at privacy@savoreverything.com. We will respond within the time required by law. We may need to verify your identity, and some data must be retained to complete active orders, prevent fraud, or meet legal, tax, and accounting obligations.

16. Automated Processing and AI

We use automated tools for fraud prevention, security, eligibility checks, and AI-assisted features such as Savor GPT and dietary suggestions. These tools help operate the Services but are not used to make decisions that produce legal or similarly significant effects about you without a lawful basis and appropriate safeguards. Where such a decision would be made, you may contact us to request human review.

Savor Atlas can order videos and posts "For you". It learns from what you open, how long you watch, what you like, and which places you open, kept as a small numeric summary plus your most recent 200 interactions. When you are signed in, that summary is saved to your account so it follows you between devices; when you are not, it lasts only for your visit and is not stored. For you is the default order on Savor Atlas and always puts new posts first or close to it. To rotate the dish and place suggestions between visits, your browser also keeps a list of the places it showed you in the past week; that list stays on your device and is never sent to us. You can switch to Latest (newest first) at any time, and you can clear the summary with "Reset recommendations" in the Atlas sort and filter menu.

In the Creator Program, automated concentration or invalid-activity signals may temporarily hold attribution, rankings, or payouts for review. A permanent program ban or voiding decision is made through human review, and creators may contact support@savoreverything.com to ask for the decision to be reviewed.

17. Children's Privacy

Savor Everything is intended for adults. Under Barbadian law, a person under 18 is a child. The Services are not directed to children, and we do not knowingly collect personal data from a child without the consent of a parent or guardian. We never knowingly collect personal data from children under 13.

If you are under the age of majority, you may use the Services only with the permission and supervision of a parent or legal guardian. If you believe a child has provided personal data to us, contact us so we can review and take appropriate action.

18. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and provide additional notice where appropriate.

19. Contact and Complaints

For privacy questions, data protection rights requests, or Savor GPT OAuth support, contact Savor Everything at privacy@savoreverything.com.

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commissioner of Barbados, who supervises compliance with the Barbados Data Protection Act, 2019.