Privacy Policy

Sree Svadista Prasada ("we", "us", "our") is a South Indian food ordering and meal-subscription service run from a home kitchen in Milton Keynes, United Kingdom (Edinburgh and Glasgow are planned, not yet served).

For the purposes of UK data-protection law, we are the Data Controller. Our contact details are:

• Email: info@sreesvadistaprasada.com
• Phone: +44 73 0711 9962
• Website: sreesvadistaprasada.com

We collect the following categories of personal data:

We do not collect special-category (sensitive) data such as health information, biometrics, or financial card details. Payment processing is handled entirely by our third-party payment provider.

We process your personal data on the following lawful bases under UK GDPR:

• Contract performance — processing orders, managing subscriptions, arranging delivery.
• Legitimate interests — improving our service, fraud prevention, communicating with customers about their orders.
• Legal obligation — retaining transaction records for tax and regulatory compliance.
• Consent — sending marketing emails and newsletters (you can withdraw consent at any time).

We use an AI language model provided by Anthropic (Claude) for two internal jobs: helping our kitchen write menu descriptions, and, at most a few times a month, explaining a sharp change in our overall figures (for example "orders fell this week"). This AI tool:

• Is used only for internal content and for reading totals, not for automated decisions about customers.
• Never receives names, email addresses, phone numbers, addresses, order contents or anything typed by a visitor, only aggregate counts.
• Is operated in compliance with the EU AI Act's requirements for general-purpose AI systems (GPAI) used in low-risk administrative contexts.
• Does not perform any profiling, automated decision-making, or high-risk AI processing as defined under the EU AI Act or UK GDPR Article 22.

You have the right to be informed about any automated decision-making that significantly affects you. No such processing occurs on this platform.

We use a small number of cookies and browser storage:

• Essential — to keep your basket, keep you signed in and remember your cookie choice. These are always on and need no consent.
• Analytics — only if you choose "Accept all". We use Google Analytics (loaded through Google Tag Manager) to understand how the site is used. If you choose "Essential only", Google Analytics sets no cookies and receives only anonymous, cookieless signals.

You can change your choice at any time by clearing this site's data in your browser; the banner will appear again.

We keep our own count of visits to this site: which pages and dishes are viewed, which buttons are used, and which website or campaign link brought the visitor. This record does not contain your name, email address, phone number or postal address, and anything typed into our forms is not read. To tell that several pages were opened in the same visit, your internet address and browser type are used for a moment to make an anonymous code that changes every day; the address itself is not stored, and the code cannot be turned back into it or used to follow you from one day to the next. If you accept analytics cookies, an anonymous number is kept in your browser so that a return visit can be recognised; if you do not, nothing is stored on your device for this purpose. Visits are not linked to customer accounts. The record is deleted automatically after 400 days.

We send messages about your order or meal plan by email, WhatsApp or text message; these are part of the service. We send offers, news and reminders (such as a request for a review, or notice that your plan is about to end) only if you have ticked the "email me offers" box at sign-up, at checkout or in the Dabba Wala wizard, or joined our newsletter. Every such email has a one-tap unsubscribe link, you can reply STOP on WhatsApp, and you can change your choice in My Account at any time. We keep a record of the messages we send for 400 days.

We share your data only where necessary:

• MongoDB Atlas (MongoDB, Inc.) — our cloud database provider, storing orders, accounts, and enquiries. Data is processed under a Data Processing Agreement.
• Vercel — hosting our frontend application. No personal data is stored by Vercel beyond standard server logs.
• Render — hosting our backend API. Standard server logs apply.
• Stripe — takes card payments. Your card details go to Stripe directly and never touch our servers; we receive a payment reference and the amount.
• Resend — sends our emails (order confirmations, replies, and offers you have asked for).
• Twilio — sends WhatsApp and text messages about your order or plan.
• Google (Firebase) — verifies your phone number with a one-time code when you create an account.
• Google Tag Manager / Google Analytics — only if you accept analytics cookies (Section 5).
• Google OAuth — optional login via Google. We receive only your name and email address; Google's privacy policy governs their processing.
• Delivery and postcode services — we use postcodes.io (a public UK postcode API) and getAddress.io for address lookup. Your postcode is sent to these services only during checkout address lookup; they do not receive any other personal data.
• Anthropic — as described in Section 4, for AI-assisted menu content only. No customer data is shared.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

Some of our service providers (MongoDB Atlas, Vercel, Render, Stripe, Resend, Twilio, Google, Anthropic) may process data outside the UK and EEA. Where this occurs, we rely on adequacy decisions or standard contractual clauses (SCCs) approved by the UK ICO to ensure your data receives an equivalent level of protection.

We retain your personal data for the following periods:

• Account data — until you ask us to delete your account.
• Order and payment records — 6 years, as required for UK tax records, with your name and contact details removed if you delete your account.
• Enquiries and support messages — 2 years from last correspondence.
• Newsletter and offer preferences — until you unsubscribe or withdraw consent.
• Message records and our own visit record — 400 days.

You have the following rights regarding your personal data:

• Right of access — request a copy of all personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
• Right to restriction — limit how we use your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making — not to be subject to solely automated decisions with significant effects (not applicable here, as we do not use such processing).
• Right to withdraw consent — at any time where processing is based on consent (e.g. marketing emails).

To exercise any of these rights, please contact us at info@sreesvadistaprasada.com. We will respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We implement appropriate technical and organisational measures to protect your personal data, including: encrypted data transmission (HTTPS), JWT-based authentication with secure key signing, bcrypt password hashing, and role-based access controls. We do not store payment card details on our systems.

Our service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page and, where appropriate, by email. Continued use of our service after changes constitutes acceptance of the updated policy.

For any privacy-related queries or to exercise your rights:

• Email: info@sreesvadistaprasada.com
• Phone: +44 73 0711 9962