Privacy notice
Last updated: 9 September 2026
What we collect, why, how long we keep it and what you can make us do about it. The short version: the recipe you paste in is used to produce your reading and for nothing else, and it is never used to train a model.
1. Who is responsible
STARBAK LIMITED, trading as Sugarhold, is the controller of the personal data described here. Our company details are on the legal information page. For anything about your data, write to support@starbak.shop.
2. What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Email address and password (stored hashed) | To create your account and let you sign in | Performance of a contract |
| Plan, billing period, subscription status, invoices | To provide the plan you bought and to meet our tax and accounting duties | Contract, and legal obligation |
| Last four digits of your card, card type, expiry date | So you can tell your payment methods apart | Performance of a contract |
| The recipe text you paste and the reduction you choose | To produce your reading. Nothing else. | Performance of a contract |
| Saved recipes and cards (Kitchen plan only) | Because saving them is what that plan is for | Performance of a contract |
| Server logs: IP address, browser, pages requested, timestamps | To keep the service running, and to detect and stop abuse | Our legitimate interest in a secure, working service |
| Aggregate usage counts (only if you accept analytics cookies) | To see which parts of the site people actually use | Your consent |
| Emails you send us | To answer you and to keep a record of what was agreed | Contract, and our legitimate interest in handling enquiries |
We do not ask for your name, your address, your date of birth or anything about you as a person. We have no interest in building a profile of you, and we do not.
Sugarhold covers nothing to do with health, nutrition or diet, so we neither seek nor want special category data. Please do not put anything of that kind into the recipe box. Where the service detects wording of that kind it stops rather than answering.
3. What we never do
- We do not use what you paste in to train or improve any model, ours or a third party’s. It is sent to be classified, the classification comes back, and that is the end of it.
- We do not sell your data, and we do not share it for advertising.
- We do not build advertising profiles or do behavioural tracking.
- We do not take automated decisions that produce legal or similarly significant effects.
4. How long we keep things
| Recipe text, Free and Reduce plans | Held only for as long as it takes to produce your reading, then discarded. It is not written to our database. |
|---|---|
| Saved recipes, Kitchen plan | Until you delete them, or 30 days after you close your account, whichever is sooner. |
| Account record | While your account is open, then 30 days. |
| Invoices and payment records | Six years, because tax law requires it. |
| Server logs | 90 days. |
| Support correspondence | Two years from the last message. |
5. Who else is involved
We use a small number of service providers, each under a written contract that allows them to act only on our instructions:
- a cloud hosting and application platform, which runs the site;
- a database, authentication and file storage provider, which holds your account;
- a payment processor, which takes payments and holds your card details, not us;
- an AI provider, which receives the pasted recipe solely in order to classify it, under terms that forbid using it for training;
- an email provider, which sends account and billing emails.
We will also disclose data where the law requires it, and to advisers or a buyer if the business is ever sold — in which case we would tell you first.
6. Security
Everything is served over HTTPS. Passwords are stored hashed and salted, never in a form we could read. Access to production data is limited to the people who need it and is logged. Card numbers never reach our servers: they are handled entirely by a payment processor certified to PCI DSS Level 1, on its own hosted page, over an encrypted connection. If a breach ever puts you at real risk, we will tell you and the Information Commissioner’s Office without undue delay.
7. Sending data outside the United Kingdom
Some of our providers operate outside the UK. Where personal data leaves the UK, we rely on UK adequacy regulations where they cover the destination, and otherwise on the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, together with a transfer risk assessment. Ask us and we will tell you which applies to a particular provider.
8. Your rights
Under UK data protection law you may ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data, where we have no continuing reason to keep it;
- restrict what we do with it while a dispute is sorted out;
- send it to you, or to someone else, in a machine-readable form;
- stop processing it where we rely on legitimate interests;
- withdraw consent, where consent is what we relied on — analytics cookies, for example.
Write to support@starbak.shop. We reply within one month, and we do not charge for it.
9. Complaining
If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you came to us first, but you do not have to.
10. Children
Sugarhold is for people aged 18 or over. We do not knowingly collect data about children. If you believe a child has given us data, tell us and we will delete it.
11. Cookies
What we set, and what each one does, is on the cookie notice.
12. Changes
If we change this notice we will update the date at the top, and we will tell account holders by email before anything material takes effect.
Questions about any of this: write to support@starbak.shop or call +44 7824871118. Monday to Friday, 09:00–17:00 UK time.
Sugarhold is a trading name of STARBAK LIMITED.