Privacy notice.

Effective date: 13 October 2026. Version 2026-10-13.

The M Plus Matcha ("M+") mobile app is operated by M Leeds Ltd ("we", "us"), which is the data controller for the information described in this notice. This notice explains what information the app and our service process, why, who receives it, how long it is kept, and the choices and rights you have.

• Data controller: M Leeds Ltd
• Company number: 17105351
• Registered office address: 21 Thorntons Arcade, Leeds, England, LS1 6LQ
• ICO data protection registration: application reference C2040595 (registration number to be added when issued)
• Privacy contact email: info@mplusmatcha.com (or Account → Feedback in the app)
• Data protection officer: none appointed; we are not required to appoint one

• Account information: the identifier from the sign-in method you use, your email address, any name supplied by that sign-in method, and your membership tier. When you join, the app asks for your first name and saves it with your account as your account's name. We put it on your orders and use it to greet you, and you can change it at any time in Account. If your account still has no name, the name you first give for an order is saved with your account and used for your later orders when you give none. Depending on what is enabled in the app, you sign in with a phone number and a one-time code, with Sign in with Apple, or with an email address and password.
• Phone number: if you sign in with a phone number, or have a verified phone number on your account, we use it to send one-time sign-in codes and to identify your membership.
• Optional greeting name: a name you choose for the app to greet you by. It is optional and can be skipped, changed or cleared. Saving, changing or clearing it does not change your sign-in identity, payment identity or membership tier.
• Optional birthday: if birthday benefits are available and you choose to add your birthday, we store the day and month (not the year). The birthday benefit requires the day and month to have been saved at least 30 days before your birthday.
• Order information: the selected store, items, options, prices, discounts, payment status, pickup estimate, fulfilment status and order history, and the name you give for an order. Our team sees that name, with a short order code, on the order ticket so that they can hand the order to the right person. The app also remembers the name on your device for your next order.
• Payment information: card details and your billing postcode are entered into Square's payment form and tokenised by Square. Square processes and retains payment information for payment processing, fraud prevention and its legal obligations. We receive a payment token and the amount and status needed to complete the order. Square's SDK and payment APIs can also return limited card information, such as brand, last four digits, expiry and billing postcode; our membership database does not store those card details. We do not receive full card numbers or card security codes. If you join M+ Club, Square saves your card for recurring payments and we keep a reference to it.
• Rewards information: your M+ coins balance and history, tier, eligible benefits and redeemed rewards, and, where referral features are available, referral links you share or use.
• In-store membership identification: where available, a one-time six-digit member code you show at the counter. When you use in-store identification and have a verified phone number, we create or update a customer record with Square containing your phone number, email address and an "M+" lookup name, so that staff can attach an in-store purchase to your membership. Staff see that lookup name and the last four digits of your phone number.
• Fraud-prevention identifiers: a one-way hash of your verified phone number, which we keep after account deletion so that a deleted account cannot claim new-member benefits again; and, for M+ Club, a per-device identifier recorded when a Club drink is redeemed. We use these only to prevent abuse of promotions and memberships.
• Device, app and notification information: your Apple Push Notification service token, device model, app version and notification settings; a daily record that you used the app (date, platform and app version); and app launch events (launch type, platform, app version and a random per-install identifier that we store only in hashed form).
• Marketing choices and consent records: whether you have opted in to marketing push notifications, drops or marketing emails, and when and where each choice was made.
• Terms records: which version of our Terms and Conditions was recorded as accepted for your account, and when, including any confirmations you give when buying an M+ Drink Card or joining M+ Club.
• Feedback and support information: the category, message, optional reply email and related order details that you choose to send.
• Technical and security information produced by our hosting, sign-in, database and payment services, such as request timestamps, IP addresses, error logs, sign-in events and fraud signals. Square's payment SDK also processes device and user identifiers and payment-feature interaction information for analytics, and crash diagnostics for reliable payment functionality.

The app does not request or process your device location.

We use information to:

• create and secure your account and let you sign in — performance of our contract with you;
• show the current menu, stores, prices and rewards, and take, charge, prepare and support your pickup orders — contract;
• run the M+ coins programme, M+ Drink Card and M+ Club and the benefits you use, including in-store identification, birthday and referral benefits where they are available — contract; consent for the birthday benefit;
• send order-status and other service notifications that you allow in iOS — contract;
• send marketing push notifications or marketing emails — consent, only if you have opted in;
• greet you by your chosen name if you save one — consent;
• prevent duplicate or fraudulent payments and misuse of rewards, memberships and promotions, including keeping the fraud-prevention identifiers described above — our legitimate interests in running a fair programme;
• answer feedback and support requests — legitimate interests;
• keep required financial and tax records, and records of consent and Terms acceptance — legal obligation;
• understand how the app is used and diagnose service failures — legitimate interests; and
• comply with legal obligations — legal obligation.

We share information only with service providers that help us run the app and the service:

• Square: payment tokenisation and processing, orders and fulfilment (including the name and code on your order), fraud controls and transaction records; customer records for in-store identification when you use it; saved cards for M+ Club.
• Apple: Sign in with Apple, the Apple Push Notification service and the App Store. M Leeds Ltd publishes the app on the App Store.
• Twilio: sending one-time sign-in codes by SMS when phone sign-in is enabled.
• Email delivery providers: our sign-in service's email provider for account emails such as sign-in and password messages, and Resend for order confirmations, membership emails and, only if you have opted in, marketing emails.
• Hosting: our database and sign-in service run on self-hosted Supabase software on Microsoft Azure servers in the North Europe (Ireland) region.

Twilio and Resend may process information in the United States; those transfers are covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or, where the provider is certified, the UK–US Data Bridge. Transfers to our Azure servers in Ireland are covered by the UK's adequacy regulations for the EEA. These providers also process information under their own terms and privacy notices. We do not sell personal information or share it for cross-context behavioural advertising.

• Account, membership, M+ coins and preference information: while your account exists.
• Daily app-use records: while your account exists, deleted when your account is deleted. App launch events: 90 days.
• Deletion-status reference: in app versions that offer saved deletion status, the app securely saves a private reference on this device so you can check progress after signing out. Our service retains its matching status record while deletion is pending and for 90 days after completion. You can remove the saved reference from this device at any time; doing so does not cancel the deletion request.
• Device tokens: deleted when your account is deleted, and earlier when they stop working.
• Saved greeting name: until you change it, clear it or delete your account.
• The name given for an order: on that order's record for as long as the order record is kept; on your device until you change it or remove the app.
• Order, payment and liability records: 6 years after the end of the financial year they relate to, as required for accounting and tax, held after account deletion without direct links to your account.
• Fraud-prevention phone-number hash: 3 years after account deletion.
• Marketing consent records: while your consent stands and 3 years after you withdraw it.
• Feedback messages: 2 years; detached from your account and stripped of any reply email when your account is deleted.
• Operational logs: up to 90 days.
• Backups: encrypted backups of our database are kept for up to 12 months and then deleted. A backup made before you clear your greeting name or delete your account can still contain that information until the backup itself is deleted; if we ever restore from a backup we re-apply later deletions.

You can start permanent account deletion in the app at Account → Settings → Delete my account. Once the request is accepted:

• your existing sessions can no longer use the service, and member benefits stop;
• device tokens and app-use records are deleted, and marketing messages stop;
• member codes are invalidated. We delete the Square customer record used for in-store identification as part of completing deletion; provider checks may leave this step pending;
• your membership profile is anonymised, and any saved greeting name is deleted from the active record, even while other deletion steps are still in progress;
• feedback is detached from your account and any reply email is removed.

If a payment, refund, fulfilment, Club charge or paid Drink Card balance still needs to be resolved, deletion stays visibly in progress until that value is reconciled or handled by support; paid value is not silently forfeited. If you signed in with Apple, the app asks you to continue with Apple once more so that Apple access can be revoked before your sign-in identity is removed. Order, payment, liability, consent and fraud records that we are legally required to keep, and the fraud-prevention phone-number hash, may retain a pseudonymous internal reference; their direct links to your account are removed after financial resolution.

We aim to complete deletion within one month. In app versions that offer saved deletion status, you can check it on this device, including after signing out. If your version does not offer this feature, contact info@mplusmatcha.com to check progress. The status will show when deletion has finished or when fresh Apple confirmation is needed. If you cannot access that status or the request is still pending after one month, contact info@mplusmatcha.com for help. Keep the saved reference private; anyone who can use it can see the status of that request.

• Permission for order-update notifications is controlled in iOS Settings.
• Marketing push notifications and drops can be turned off in Account → Settings, and you can unsubscribe from marketing emails using the link in any marketing email.
• You can change or clear your greeting name in Account → Settings.
• You can sign out at any time.

You have the right to ask for access to your information, to have it corrected or erased, to restrict or object to its use (including objecting to direct marketing at any time), to receive it in a portable format, and to withdraw consent where we rely on consent. To make a request, email info@mplusmatcha.com or use Account → Feedback in the app. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

We use encrypted network connections, restricted service credentials, server-side price validation, signed webhook verification, idempotency controls and access controls. No system is completely secure. The app is for people aged 16 or over.

We may update this notice when the app, our providers or legal requirements change. We will update the effective date above and tell you about material changes in the app before they apply.