Privacy policy

Hop-In Express, the convenience store in Eastleigh that runs hopinexpress.com and the Hop-In Express app, is the data controller for the information described here. To ask about your data, use the contact page.

• Account: your name, email address, mobile number and password (stored as a hash; we cannot read it).
• Orders: what you ordered, the slot, the delivery address, the price paid, refunds, and the messages about swaps.
• Payment: the card brand and the last four digits, so you can recognise the payment. The card number itself goes to Stripe and never reaches us.
• Age verification: only the outcome, verified or not, the provider's reference for the check, and whether you were born before 1 January 2009 (the tobacco law asks only that, so we keep a yes or no, never your date of birth). The document and selfie are handled by the verification service and are not stored on your account.
• Messages: anything you send through the contact or franchise forms.
• Technical: your IP address and browser or app version in server logs, used for security and to keep the site running.
• Our drivers' location: see section 6. We never collect a customer's location from their phone.

• To take, pick, deliver and refund your orders (performance of a contract).
• To check age for restricted products (legal obligation).
• To contact you about an order: a swap, a delay, a driver at the door (contract).
• To reset your password when you ask us to (contract).
• To answer messages you send us (legitimate interest).
• To show a customer where their delivery is, from the driver's phone while it is out (legitimate interest: knowing when to be at the door).
• To keep the site secure and stop abuse (legitimate interest).

We do not send marketing emails or texts, and we do not sell or share your details for anyone else's marketing. Every email we send is about an order or your account.

• Stripe processes payments and refunds. They receive your card details and the amount.
• Resend delivers our emails. They receive your email address and the message.
• Didit checks your age when you buy alcohol, tobacco or vapes. They receive your email address, your mobile number if you gave one, and the photo ID and selfie you show them, and tell us the outcome.
• Our hosting providers store the website and database on our behalf.
• Expo delivers updates to the app. Your phone asks them for the latest version, so they see its IP address and app version.
• OpenStreetMap and postcodes.io draw the delivery map and turn a postcode into a place on it. Only the postcode, and your phone's IP address for the map pictures, leave the app.
• Our staff see your name, address and order to pick and deliver it. Managers can see who did what on each order.
• The police or a regulator, where the law requires it, for example an age-check inspection.

• Driver location: while a driver has an order out for delivery, the app sends their phone's position every few seconds so the customer of that order, and the shop's managers, can see where it is. It stops when the round is finished, and Android shows a notification for as long as it runs. Only the latest position is kept, for three minutes, and it is never saved to our database: there is no record of where anyone drove. Customers' phones never send their location.
• Camera: staff use it to scan barcodes and to photograph new products. Scans are not kept as pictures; a product photo becomes part of the shop's catalogue.
• On your phone: your sign-in is kept in the phone's secure storage. Your basket, shopping list and checkout details are kept on the phone for the account signed in, and cleared if someone else signs in on it.
• Card payments in the app go straight to Stripe, as on the website, including Google Pay.

We use one cookie, to keep you signed in. Your basket and shopping list are kept in your browser's storage so they survive a refresh. We do not use advertising or tracking cookies.

Your account and orders for as long as you have an account, and order records for six years afterwards because tax law requires it. Age-verification outcomes for as long as the account exists. Messages you send us for two years. Server logs for 30 days. A driver's position for three minutes.

Under UK GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it (we may need to keep order records for tax), object to how we use it, or ask us to move it elsewhere. Ask through the contact page and we will reply within one month. You can delete your account yourself at any time from your account page (hopinexpress.com/account/delete) or in the app (Account, Delete my account).

You can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first.

The site and the app talk to us over HTTPS, passwords are hashed, payment details never touch our servers, and staff access is by role and is logged. No system is perfect; if we ever find a breach that affects you, we will tell you.

The site and the app are for adults. We do not knowingly hold data about anyone under 18.

We will update this page when anything changes, for instance when a new service handles part of your data. The date at the top tells you when.