Legal
Privacy notice
Last updated 2 November 2026
Draft — to be reviewed by a solicitor before launch.
This notice explains how Outzu uses your personal data. Outzu is run by Arri Tech Ltd (company number 13784390, [ADDRESS]), the controller of your data. Questions or requests: support@outzu.com.
The short version
- We collect what we need to plan, split the bill, pay each other back and get home safe — nothing more.
- We never sell your data. Restaurants can pay for a spot in search, always labelled Sponsored; this uses no information about you beyond the area you search in.
- We never hold or move your money. Your payout details are encrypted and only shown to someone who currently owes you.
- Your location is used only during a Get Home Safe trip you start, and your home address is never shown to anyone.
- You can download your data or delete your account in the app at any time.
What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Email address, or your Apple or Google sign-in | To sign you in (we email a one-time code) and stop abuse | Contract |
| Phone number, if you add one | Optional. Only to help friends find you, never to sign in. We don’t check it | Legitimate interests |
| Name, photo, language, country | So friends recognise you; to show the right language and currency | Contract |
| Plans, votes, chat messages | To run the plans you create or join | Contract |
| Receipts, bill items, who had what | To split the bill | Contract |
| What you owe and are owed, payment status | To track paying back | Contract |
| Payout details (bank details, payment handles) | To show a friend who owes you how to pay you. Stored encrypted. | Contract |
| Location during Get Home Safe | To show your group you’re on the way and tell when you’re home | Consent, each trip |
| Home location | To tell when you’ve arrived. Stored encrypted; never shown to anyone | Consent |
| Emergency contacts’ names and numbers | To text them if you press SOS | Consent (and their legitimate interest in being told) |
| Subscription status | To unlock Outzu Pro | Contract |
| Device and app information, crash reports | To keep the app working and secure | Legitimate interests |
| Messages you send us | To reply | Legitimate interests |
You must be 18 or over to use Outzu.
Who sees what
- Friends in a plan see your name, photo, RSVP, votes, chat messages, what you claimed on that plan’s bill and what you owe or are owed.
- Someone who owes you sees the payout details you’ve added, only while they owe you.
- Friends you share a trip home with see that you’re on the way and your live location until the trip ends. They never see your home address.
- Your emergency contacts get a text with your last known location only if you press SOS.
- Restaurants see only aggregated numbers (for example how often they were chosen), never who you are.
- Our support staff can see account information when helping you; this access is logged.
- Authorised Outzu staff can read plan and group chats, to deal with reports and keep Outzu safe. Only staff with that specific permission can, and every time they do it is logged.
Processors we use
We use these companies to run Outzu. They act on our instructions and may only use your data to provide their service to us.
| Processor | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | EU (Stockholm) |
| SMS Tools | SOS texts to your emergency contacts | [VERIFY] |
| Anthropic, OpenAI | Reading receipt photos into items | US (standard contractual clauses / UK addendum) |
| Google (Maps Platform, Firebase) | Place search, maps, push notifications, crash reports | EU/US |
| RevenueCat, Apple, Google | Outzu Pro subscriptions | US |
| Stripe | Restaurant subscriptions | EU/US |
| Resend | Emails | [VERIFY] |
| Cloudflare | Hosting this website | Global |
| PostHog | Privacy-friendly product analytics, without cookies | EU |
Where data leaves the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement / Addendum.
How long we keep it
- Location points from a trip home: 24 hours after the trip ends.
- Trips home: 30 days, then deleted. SOS records are kept without a location after 30 days.
- Receipt photos: 180 days.
- Cached place details from Google: up to 30 days.
- Your account and content: until you delete your account. Past bills stay for your friends, without your name, so their records still add up.
- Messages to support: up to 2 years.
Your rights
You can ask to access, correct, delete or move your data, object to or restrict some uses, and withdraw consent at any time (for example by stopping a trip home or removing your home location). In the app: Profile → Download my data and Profile → Delete account. Or email support@outzu.com. We reply within one month.
If you’re unhappy, please tell us first. You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
Security
Data is encrypted in transit. Payout details and home locations are also encrypted at rest with keys only our servers hold. Access is limited by strict database rules, and staff access is logged.
Changes
We’ll tell you in the app before any important change to this notice.