Privacy Policy

1. Who We Are and Who Controls Your Data

Savor Everything operates a Barbados-focused food ordering and delivery marketplace. For the purposes of the Barbados Data Protection Act, 2019, the data controller responsible for personal data processed through the Services is Savor Everything (operated by [Savor Everything legal entity — to be confirmed], a business established in Barbados).

This Privacy Policy explains how we collect, use, share, retain, and protect personal data, and the rights you have under Barbadian data protection law. It applies to our websites, applications, account features, ordering and delivery services, Savor Atlas, Savor Pass, Savor ID, Savor credits, support channels, and Savor GPT OAuth actions.

If you have questions about this policy or how your data is handled, or if you wish to exercise your rights, contact us at privacy@savoreverything.com. Where we are required to have a data protection officer or privacy contact, that person can be reached at the same address.

2. Information We Collect

We collect information you provide directly, including your name, email address, phone number, delivery addresses, account credentials, support messages, dietary preferences, allergies, dislikes, reviews, and other information you choose to save in your Savor Everything account.

When you place or prepare an order, we collect order details such as restaurant, menu items, cart contents, delivery instructions, delivery location, payment status, order status, tips, fees, credits, points, and related transaction records.

For the Creator Program, we also process creator applications, account-verification evidence, accepted-terms records, creator codes, order-attribution records, eligibility and payout records, and fraud-review signals such as repeated customer, account, payment, device, or delivery-location patterns where reasonably necessary to protect the program.

When a creator connects a social account through the provider's official sign-in, we collect, within the scopes that provider grants, the provider account identifier, handle, display name, profile link, avatar, follower and engagement statistics, and a limited snapshot of recent public content. We use this information to verify account ownership, set follower-based earning tiers, verify submitted content, and display creator profiles within Savor Everything. Provider access and refresh tokens are stored encrypted and are never displayed, and connected-account statistics may be refreshed periodically while the connection remains active. Disconnecting a social account stops further collection, and we revoke or delete the associated tokens.

If you follow a creator on Savor Everything, we record the follow relationship and your notification preference so we can show follower counts, determine creator earning tiers, and send updates you have chosen to receive. You can unfollow a creator or turn off notifications at any time.

We also collect technical information such as device, browser, IP address, approximate location, log data, cookies and similar identifiers, and usage information needed to operate, secure, debug, and improve Savor Everything. When you follow a link from Savor Everything to an external website, we may record the source page, destination domain and path, link label, time, and a session identifier so we can measure traffic sent to partners. We do not retain destination URL query strings or fragments in this record.

3. Sensitive Personal Data (Allergies, Health, and Dietary Needs)

Some information you can save — such as allergies, medical or dietary restrictions, and religious dietary requirements — may be treated as sensitive personal data under the Barbados Data Protection Act, 2019. We collect and use this information only to help you order food that suits your needs, to pass relevant notes to restaurants, and to power dietary filters and suggestions.

You choose whether to provide this information. By saving allergy, health, or religious dietary details in your account or in order notes, you consent to our processing them for the purposes described in this policy. You can update or remove these details in your account, and you can place orders without saving them.

Because allergen and dietary tools may be incomplete or wrong, you should still confirm safety-critical requirements directly with the restaurant. See our Terms of Service for more on food safety.

4. Legal Basis for Processing

Under the Barbados Data Protection Act, 2019, we process personal data only where we have a lawful basis to do so. Depending on the activity, our basis is one or more of the following:

• Performance of a contract — to create and operate your account, process orders, coordinate delivery, and provide Savor Pass, credits, and support you request.
• Consent — for sensitive personal data (such as allergy, health, or religious dietary details), for non-essential cookies and analytics, and for direct marketing where consent is required. You may withdraw consent at any time.
• Legal obligation — to meet tax, accounting, records, and other legal requirements that apply to us in Barbados.
• Legitimate interests — to prevent fraud and abuse, secure and debug the Services, and improve our products, in a way that is balanced against your rights.

5. Savor GPT and OAuth Actions

If you use the Savor Everything GPT in ChatGPT, account features require you to sign in securely with Savor Everything through OAuth. ChatGPT receives an access token that lets it call approved Savor Everything action endpoints for your account.

Savor Everything uses that token to identify your account and authorize the requested scope, such as profile, restaurants, cart, orders, reviews, preferences, or Savor Pass information. We store OAuth authorization codes, access tokens, and refresh tokens in hashed form, along with consent and audit metadata.

Savor Everything receives the action request data needed to fulfill the GPT request, such as a restaurant search, cart change, order lookup, preference update, checkout handoff, or Atlas review action. Messages and other activity inside ChatGPT may also be processed by OpenAI under OpenAI's own terms and privacy policy.

You should not paste passwords, API keys, payment card numbers, government IDs, or other unnecessary sensitive information into ChatGPT or Savor GPT conversations.

6. How We Use Information

We use information to create and secure accounts, process orders, maintain carts, support checkout handoff, coordinate restaurants and delivery workflows, provide order history and tracking, manage Savor Pass or Foodie benefits, maintain Savor ID, provide credits or points, and operate Savor Atlas reviews.

We also use information to provide customer support, respond to inquiries, prevent fraud or misuse, enforce policies, debug technical issues, improve products and services, measure traffic and referrals sent to external partners, and comply with legal, tax, accounting, security, and operational obligations.

7. Payments

Payment confirmation happens on Savor Everything checkout or through our payment providers. Savor GPT may help prepare a cart and provide a checkout handoff, but it does not complete payment inside ChatGPT.

Payment processors may collect and process payment information under their own terms. Savor Everything stores payment status and transaction references needed to operate orders, refunds, support, and accounting. We do not store full card numbers, CVV/CVC codes, or other sensitive cardholder authentication data.

8. Cookies and Similar Technologies

We and our service providers use cookies, device identifiers, and similar technologies to keep you signed in, remember preferences, secure the Services, measure performance, and understand how the Services are used.

Some cookies are strictly necessary to operate the Services. For non-essential cookies and analytics, we rely on your consent where required, and you can manage your choices through your browser settings or any cookie controls we provide. Blocking some cookies may affect how the Services work.

9. How We Share Information

We share information with restaurants, delivery partners, service providers, payment processors, hosting providers, analytics and security providers, and support tools when needed to provide Savor Everything services. Where we use processors, we put written agreements in place requiring them to protect personal data and use it only on our instructions.

For example, restaurants may receive order items, customer notes, and fulfillment details; delivery partners may receive delivery address, instructions, and order status details; and service providers may process data to host, secure, or support the platform.

We do not sell your personal information. We may disclose information if required by law, to protect rights and safety, to investigate abuse or fraud, or in connection with a business transaction such as a merger, acquisition, financing, or sale of assets.

10. International Data Transfers

Some of our service providers — including payment processors, hosting, analytics, communications, and OpenAI/ChatGPT — may process personal data outside Barbados. Where we transfer personal data outside Barbados, we take steps required by the Barbados Data Protection Act, 2019 to ensure an adequate level of protection, such as using providers subject to comparable data protection standards and putting appropriate safeguards or contractual protections in place.

By using the Services and features that rely on these providers, you understand that your data may be processed in other countries with different data protection laws.

11. Reviews and Public Content

If you submit Savor Atlas reviews or other public content, that content may be displayed publicly with related restaurant and profile information. Reviews may be moderated, rejected, hidden, or removed if they violate our policies or applicable law.

Do not include private information about yourself or others in public reviews.

12. Data Retention

We keep personal data only for as long as needed to provide Savor Everything services, maintain account records, support orders, meet legal and accounting obligations, resolve disputes, enforce agreements, and protect the platform. When data is no longer needed, we delete, anonymize, or restrict it.

OAuth tokens may expire, rotate, or be revoked. Order, payment, review, audit, and support records may be retained for the periods required by Barbadian tax, accounting, security, and fraud-prevention rules, which may be longer than the life of your account.

13. Security

We use technical and organizational measures designed to protect personal data, including access controls, encrypted transport, hashed OAuth tokens, logging, monitoring, and environment-based secret management. If a personal data breach occurs that is likely to affect your rights, we will notify the Data Protection Commissioner and affected individuals where the Barbados Data Protection Act, 2019 requires.

No system is perfectly secure. You are responsible for maintaining the confidentiality of your account credentials and for using strong, unique passwords.

14. Your Data Protection Rights

Subject to the Barbados Data Protection Act, 2019 and its exemptions, you have the right to:

• Access the personal data we hold about you and ask how it is processed.
• Correct inaccurate or incomplete personal data.
• Request erasure of your personal data where the law allows.
• Restrict or object to certain processing, including processing based on our legitimate interests.
• Object to direct marketing at any time.
• Request portability of personal data you provided to us, in a structured, commonly used format.
• Withdraw consent at any time where we rely on consent, without affecting processing already carried out.

15. How to Exercise Your Rights

You can update account profile details, delivery addresses, dietary preferences, allergies, dislikes, and other saved preferences through Savor Everything account tools where available, and you can disconnect Savor GPT through ChatGPT's connected apps or action settings.

To make any other request — including access, correction, erasure, restriction, objection, portability, or token revocation — contact us at privacy@savoreverything.com. We will respond within the time required by law. We may need to verify your identity, and some data must be retained to complete active orders, prevent fraud, or meet legal, tax, and accounting obligations.

16. Automated Processing and AI

We use automated tools for fraud prevention, security, eligibility checks, and AI-assisted features such as Savor GPT and dietary suggestions. These tools help operate the Services but are not used to make decisions that produce legal or similarly significant effects about you without a lawful basis and appropriate safeguards. Where such a decision would be made, you may contact us to request human review.

In the Creator Program, automated concentration or invalid-activity signals may temporarily hold attribution, rankings, or payouts for review. A permanent program ban or voiding decision is made through human review, and creators may contact support@savoreverything.com to ask for the decision to be reviewed.

17. Children's Privacy

Savor Everything is intended for adults. Under Barbadian law, a person under 18 is a child. The Services are not directed to children, and we do not knowingly collect personal data from a child without the consent of a parent or guardian. We never knowingly collect personal data from children under 13.

If you are under the age of majority, you may use the Services only with the permission and supervision of a parent or legal guardian. If you believe a child has provided personal data to us, contact us so we can review and take appropriate action.

18. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and provide additional notice where appropriate.

19. Contact and Complaints

For privacy questions, data protection rights requests, or Savor GPT OAuth support, contact Savor Everything at privacy@savoreverything.com.

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commissioner of Barbados, who supervises compliance with the Barbados Data Protection Act, 2019.