Last updated: November 1, 2026
Introduction
Asparagus ("we," "our," or "us") operates the Asparagus mobile application (the "App"), a food delivery and personalized meal-plan service. This Privacy Policy explains what personal data we collect, how we use it, how long we keep it, and the rights you have over your data.
By using the App, you agree to the practices described in this policy. If you do not agree, please discontinue use of the App.
1. Information We Collect
1.1 Account & Identity Information
When you register or manage your account, we collect:
When you sign in through a social provider (Google, Apple, or Facebook), we also receive the name, email address, and unique identifier associated with that account.
1.2 Health & Nutrition Data
To generate personalized meal plans, we collect:
1.3 Smart Band / Wearable Device Data
If you connect a compatible smart band, we collect via Bluetooth:
1.4 Location Data
We collect location data to enable delivery and branch selection:
Location is only accessed when the App is in use; we do not track location in the background.
1.5 Order & Payment Data
When you place orders, we collect:
Payment transactions are processed through a secure external payment gateway. We do not store full card numbers or CVV codes.
1.6 Family Members
If you add family members to your account, we collect the same profile and health information for each member as described above, entered by you as the account holder.
1.7 Customer Support (Crisp Chat)
When you contact us through the in-app live chat, your name, email address, phone number, and profile photo are shared with Crisp (our customer support platform) along with the content of your support conversations.
1.8 Device & Technical Information
We automatically collect:
1.9 Notifications
We collect your notification preferences and the read/unread status of in-app notifications.
2. How We Use Your Information
Purpose
Data Used
Account creation and authentication
Identity, contact, and social-login data
Personalised meal-plan generation
Health, nutrition, and smart band data
Order processing and delivery
Order, payment, address, and recipient data
Location-based branch and delivery routing
GPS coordinates and saved addresses
Push notifications (orders, offers, promotions)
FCM token, notification preferences
Customer support
Name, email, phone, chat history
Loyalty and referral programme
Points balance, referral codes
App performance and remote configuration
Device info, Firebase Remote Config (no personal data sent)
We do not sell your personal data to third parties.
3. Data Retention
Data Category
Retention Period
Account profile (name, email, phone, DOB, etc.)
Retained for the lifetime of your account. Deleted within 30 days of account deletion request.
Health & nutrition data
Retained while your account is active. Deleted within 30 days of account deletion request.
Smart band / wearable readings
Retained for 12 months from the date of recording, then automatically purged from our servers. Deleted immediately upon account deletion request.
Order history
Retained for 5 years for legal, tax, and accounting purposes, even after account deletion.
Payment records
Retained for 5 years in accordance with financial regulations.
Delivery addresses
Retained while your account is active. Deleted within 30 days of account deletion request.
Customer support chat history
Retained for 2 years from the date of the conversation, then deleted from Crisp's systems in accordance with their data retention policy.
Device / FCM tokens
Deleted upon logout or account deletion.
Local cache on your device
Cleared when you log out or delete the App. Health assessment and smart band readings cached locally are cleared when you delete your account.
When a retention period expires, data is either deleted or anonymised so that it can no longer be linked to you.
4. How to Delete Your Data
4.1 Delete Your Account (Full Deletion)
You can permanently delete your account and all associated personal data directly from within the App:
1. Open the App and go to Profile → Settings → Account.
2. Tap Delete Account.
3. Confirm the action when prompted.
Upon confirmation, your account and all personally identifiable data stored on our servers will be scheduled for deletion and completed within 30 days. Order history and payment records will be anonymised rather than deleted where retention is required by law (see Section 3).
You may also request account deletion by emailing us at [email protected] with the subject line "Account Deletion Request." We will process your request within 30 days.
4.2 Partial Data Deletion
4.3 Data Requests
To request a copy of the personal data we hold about you, email us at [email protected] with the subject line "Data Access Request." We will respond within 30 days.
5. Data Sharing & Third Parties
We share data only where necessary:
Third Party
Data Shared
Purpose
Google (Sign-In, Maps)
OAuth tokens; GPS / address queries
Authentication; geocoding
Apple (Sign-In)
OAuth tokens
Authentication
Facebook (Login)
OAuth tokens
Authentication
Firebase / Google (FCM, Remote Config)
Device tokens; no personal data via Remote Config
Push notifications; app configuration
Crisp
Name, email, phone, profile photo, chat messages
Customer support live chat
Payment gateway
Order amount and transaction ID
Secure payment processing
All third parties are contractually required to handle your data in accordance with applicable privacy law.
6. Data Security
We protect your data using:
No method of transmission or storage is 100 % secure. If you believe your account has been compromised, contact us immediately at [email protected].
7. Children's Privacy
The App is not directed at children under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
8. Your Rights
Depending on your location, you may have the right to:
To exercise any of these rights, contact us at [email protected].
9. Cookies & Local Storage
The App stores data locally on your device using platform storage (SharedPreferences). This data includes your session token, saved addresses, and cached health assessments. It is not shared with advertisers. You can clear it by logging out or uninstalling the App.
10. Push Notifications
We use Firebase Cloud Messaging to send you push notifications about orders, promotions, and app updates. You can manage notification permissions at any time through your device settings (iOS: Settings → Notifications → Asparagus; Android: Settings → Apps → Asparagus → Notifications).
11. Location Permissions
Location access is required to detect your nearest branch and calculate delivery eligibility. We collect location only while the App is open (foreground access). You can revoke location permission at any time in your device settings; some delivery features will be unavailable without it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this document and notify you via an in-app notice or push notification for material changes. Continued use of the App after changes constitutes acceptance of the updated policy.
13. Contact Us
For privacy questions, data requests, or account deletion, please contact:
Asparagus
Email: [email protected]
We will respond to all requests within 30 days.
Internal management tools
Asparagus Reviews Manager (Google Business Profile data)
Asparagus Reviews Manager is an internal tool used only by the management team of Asparagus Restaurants to respond to customer reviews on our own Google Business Profile locations. It is not offered to the public or to other businesses.
Information we access: through the Google Business Profile API, and only for locations we manage, we access reviews posted on our locations (the reviewer's public display name, star rating, review text and date), the replies we publish, and basic location details.
How we use it: only to read new reviews, prepare a suggested reply, send it to an authorized staff member for approval, and publish the approved reply. No reply is published without a staff member's decision.
AI processing: to draft a reply, the review text is sent to our AI service provider (Anthropic). It is used only to generate that reply and is not used to train AI models.
Retention: review text and reviewer names are deleted from our systems 25 days after we receive them.
Sharing: we do not sell, rent or share this information, and we do not use it for advertising.
Asparagus Reviews Manager's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Asparagus Ads Manager (Google Ads data)
Asparagus Ads Manager is an internal tool used only by the management team of Asparagus Restaurants to plan, run and monitor advertising campaigns in our own Google Ads account. It is not offered to the public or to other businesses.
Information we access: through the Google Ads API, and only for our own advertising account, we access campaign settings, budgets and ads, performance figures (impressions, clicks, cost, calls, direction requests and store visits), and our branch locations. We do not access data about individual customers.
How we use it: to analyse performance, prepare campaign proposals, and apply changes only after approval by an authorized staff member. Spending never exceeds the monthly limit set by management.
AI processing: performance figures and campaign settings may be sent to our AI service provider (Anthropic) to prepare analyses and proposals. They are not used to train AI models.
Sharing: we do not sell, rent or share this information with third parties.
Asparagus Ads Manager's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Security, revoking access and deletion: access is restricted to authorized Asparagus staff. The Google account owner can revoke these tools' access at any time at myaccount.google.com/permissions. Deletion requests can be sent to [email protected] and are completed within 30 days.