Privacy Policy

1. Personal Data We Collect

• Contact & Profile Details: Your full name, mobile phone number, email address, and Google account credentials when signing in.
• Delivery & Fulfilment Details: Recipient name, contact number, delivery address (unit/building, street, postcode, city/state), and specific access notes.
• Order & Preference Data: Items ordered, selected pickup or delivery dates, preferred time slots, custom cake notes, and dietary restrictions.
• Technical & Browsing Data: IP address, device type, browser information, pages visited, and interaction data collected through cookies (subject to consent).
• Payment Information: Payment transactions are processed directly by authorized third-party payment gateways. We do NOT store or have access to your full credit/debit card numbers or online banking passwords.

2. Purpose of Collecting & Processing Your Data

• Baking, packing, and preparing your made-to-order artisanal cakes and desserts.
• Coordinating store pickup or dispatching orders with air-conditioned delivery drivers.
• Sending essential transactional communications: Order confirmation receipts, payment notifications, pickup readiness alerts, and delivery updates via Email and WhatsApp.
• Enforcing our daily 40-order kitchen capacity limit and preventing double-booking.
• Responding to your inquiries, customer service requests, or order amendments.
• Complying with statutory accounting, tax reporting, and legal obligations in Malaysia.

3. Disclosure to Third Parties

• Logistics & Delivery Partners: Recipient name, delivery address, and phone number are provided to our drivers solely to execute and deliver your order within the designated window.
• Address Search: When Google Maps address suggestions are enabled, search text is sent to Google to find matching addresses. You may enter your address manually instead.
• Delivery Coverage Checks: When checking a delivery address, its street/building address, postcode, and city are sent to Google Geocoding and Routes to match the destination, calculate driving distance, and determine the café's delivery fee. This check also applies to manually entered delivery addresses.
• Payment Processors: Authorized Malaysian financial payment gateways (FPX, credit card, e-wallet processors) to verify and process transactions.
• Cloud & Technology Infrastructure: Reputable cloud hosting (Vercel), database storage (Supabase), and notification providers (Resend, WhatsApp Cloud API) operating under strict security standards.
• Regulatory Authorities: Government agencies or law enforcement where required by Malaysian law.

4. Data Security & Kitchen Safeguards

• Encrypted data transmission across the entire website via Secure Socket Layer (SSL/TLS).
• Database Row-Level Security (RLS) restricting customer access solely to their own records.
• Role-based staff permissions: Kitchen and production staff only view product quantities, items, and first names on daily prep summaries; full phone numbers and addresses are restricted to management.

5. Data Retention

6. Your Rights Under the PDPA

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate, incomplete, or outdated information via your Account Profile or by contacting us.
• Right to Withdraw Consent: Opt out of non-essential communications or marketing updates at any time.
• Right to Erasure: Request deletion of your customer account profile, subject to statutory record-keeping requirements.

7. Cookies & Analytics Policy