1. Who is responsible
Butterleaf Bakehouse, a sole proprietorship trading as Butterleaf Bakehouse, at A-103, Shivay Splendid, Nr. Taksh Galaxy Mall, Ankhol, Vadodara, Gujarat 390019, is the data fiduciary for the personal data described here, under India’s Digital Personal Data Protection Act, 2023.
2. What we collect
When you order
- Email address — to sign you in and send order updates.
- Recipient name and phone number — so the delivery reaches the right person.
- Delivery address — to deliver.
- Order contents, delivery date and slot, gift and cake messages.
When you get in touch
- Your name, email, phone and whatever you write in a contact or custom-order form.
Automatically
- A session cookie once you sign in, so you stay signed in.
- Your basket, stored in your own browser — it does not reach us until you check out.
- Standard server logs kept by our hosting provider (IP address, page, timestamp) for security and diagnostics.
What we never collect
Card, UPI and banking details. Those go directly to Razorpay and never touch our systems. We only receive a payment reference and whether it succeeded. We also set no advertising or tracking cookies, and we do not track you across other websites.
3. Why we use it, and on what basis
- To fulfil your order — performance of our contract with you. Without this data we cannot bake or deliver.
- To sign you in — your consent, given when you request a sign-in link.
- To answer enquiries — your consent, given when you write to us.
- Newsletter — your consent, given when you subscribe. Withdraw it any time.
- To keep tax and accounting records — our legal obligation.
We do not use your data for automated decision-making or profiling, and we do not send marketing to customers who have not asked for it.
4. Who we share it with
Only the services needed to run the shop, each handling data on our instructions:
- Razorpay — payment processing.
- Vercel — website hosting.
- Neon — the database holding orders and accounts.
- Resend — sending sign-in links and order emails.
- A delivery person, who receives the recipient’s name, address and phone number for that delivery only.
We may also disclose data where the law requires it. Beyond that we do not share, rent or sell your data, and we run no advertising trackers.
Some of these providers store data on servers outside India. Where that happens, it is under contractual terms requiring protection equivalent to this policy.
5. How long we keep it
- Order records: 8 years, as tax law requires.
- Account and saved addresses: until you ask us to delete them.
- Enquiries and contact messages: up to 2 years.
- Newsletter subscription: until you unsubscribe.
6. Your rights
Under the DPDP Act 2023 you may:
- Access the personal data we hold about you.
- Correct anything inaccurate or incomplete.
- Erase it — except order records we are legally required to retain.
- Withdraw consent for anything based on it, such as the newsletter.
- Nominate someone to exercise these rights if you die or become incapacitated.
- Complain to us, and to the Data Protection Board of India.
Email hello@butterleafbakehouse.com and we will respond within 7 days. We may ask you to confirm your identity first — usually by replying from the email address on the account.
7. Security
The site runs entirely over HTTPS. Sign-in uses single-use links rather than passwords, so there is no password of yours for us to lose. Payment details never reach our systems. Access to the order database is limited to the bakery.
No system is perfectly secure. If a breach ever affects your data, we will notify you and the Data Protection Board as the DPDP Act requires.
8. Children
This shop is not intended for children under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
9. Changes
If we change this policy we will update the date at the top of this page. Where a change is significant and affects data we already hold, we will tell you directly.
10. Grievance Officer
Setu — hello@butterleafbakehouse.com, +91 94267 79599, at the address in section 1.