Information you provide
Account registration collects your name, email and password. The server stores a password hash, not the password itself. Optional Google sign-in, if configured, uses your verified email, name and provider identifier. Accounts can hold favorites, order history, guest preferences and loyalty records.
Order forms collect contact information, selected kitchen, pickup or delivery choice, item selections and quantities, and, for delivery, an address. A requested time and an optional marketing choice may also be supplied. Catering inquiries collect contact details, city, event date, guest count, selected tier and your message. Use test information in this preview; submitting a test inquiry does not notify staff or confirm a booking.
Support/recovery requests can include an account-linked order, your description and an optional transcript. Signed-in customer privacy requests record a request type, language and optional minimal details, with internal review audit history. Avoid including payment card numbers, passwords or unnecessary sensitive information in any free-text field.
Allergy or dietary notes in an inquiry or other free-text field may reveal health information. Do not submit unnecessary medical details. These notes do not confirm accommodation, and their production handling, protection and retention require owner review.
How records are used
Records support sign-in, saved favorites, order records and status, catering review, communication preferences, reward accounting and staff-scoped customer support. Internal website analytics and segments derive from saved order and loyalty records; they are not a browser advertising tracker. Consent, points, reward and staff decisions can retain audit history.
Service providers and external links
Hosted assets, website infrastructure and application/database storage process requests for the website. Hosting infrastructure may process connection and request information. Provider contracts, logging details and retention settings require owner review before launch. No sale or sharing assessment for applicable privacy law has been approved; do not interpret this draft as a certified no-sale statement.
If enabled later, Stripe provides hosted payment pages and may receive customer/contact details, order identifiers and server-calculated amounts. Full card details are not entered into this website's forms. Google sign-in is optional. Location links open Google Maps only when you choose them. External services have their own privacy notices. Current Stripe setup is deferred; this page does not activate a provider.
The optional owner-only AI drafting tool accepts fixed topics, not customer lists, names, contact details or complaint text. Suggestions are not automatically saved, approved or sent. Real email, SMS and push delivery are not configured in this preview.
Your choices and requests
Buying does not create marketing consent. Signed-in account preferences record optional email choices. A separate explicit action withdraws all account marketing email and records an audited suppression that ordinary preference changes cannot clear. Legacy newsletter records are separate: an unverified account email match cannot withdraw another record; independently verified identity or a secure opt-out link is required. No real send service or opt-out link delivery is configured. Browser storage choices are explained in Cookies & Browser Storage.
Signed-in customers can record an access, correction or deletion request in their account and view its saved status. Owner review records are internal; submitted, in review or closed without execution does not mean data was exported, corrected or deleted. This intake performs none of those operations and does not send messages. Applicable rights, identity verification for fulfillment, portability, qualifying opt-outs, appeals, a verified contact and staffed response/retention procedures remain pending owner/legal review. No statutory response deadline is promised. Clearing browser storage does not delete server records.
Retention, security and age
No approved retention schedule or deletion deadline is set in this draft. Final retention must account for operating needs, legal obligations and audit records. Current protections include password hashing, scoped access and signed authentication; they do not guarantee that every security risk is eliminated. An age/children's-data policy is also pending owner/legal review. Do not submit children's personal information in this test site.
Before public launch
The owner must confirm the responsible legal entity, a working customer/privacy contact, the effective date, applicable retention and request procedures, and the operational policies described below. No legal or regulatory certification is claimed. Nothing here is intended to remove rights that applicable law protects.