Legal

Privacy Policy

Last updated July 11, 2026 · Terms of Service

This Privacy Policy explains what personal information Annapoorna ("we," "us," "our") collects when you use our online ordering service, how we use and protect it, and the rights and choices you have — including rights available to California residents under the California Consumer Privacy Act (CCPA). This Policy should be read alongside our Terms of Service.

1. Information we collect

• Order information: your name, email address, phone number, chosen pickup location and time, items ordered, any kitchen notes you provide, and your order history.
• Account information (if you create an account): everything above, plus a securely hashed password and your reward-points balance. Passwords are stored as one-way hashes — we cannot recover your password in plain text.
• Payment information: card payments are processed directly by Stripe, a PCI-DSS Level 1 certified processor. Your full card number, CVC and expiry date are transmitted directly from your browser to Stripe and are never passed through or stored on our servers. We receive only a payment confirmation, Stripe payment reference, and the last four digits and brand of your card for display purposes.
• Technical information: your IP address (used for rate-limiting and fraud prevention), browser type, and timestamps of service interactions. We do not run third-party analytics trackers.
• Communications: if you contact us by email or phone, we retain that correspondence to help resolve your issue.

2. Cookies & local storage

We use a small number of essential cookies and browser storage:

• Session cookie: a secure, HTTP-only session cookie that keeps you logged in while you browse. It expires when you close your browser or log out.
• Cart storage: your cart contents are saved in your browser's localStorage so they persist between visits. No personal data is stored there — only item IDs, quantities and prices.
• Contact prefill: if you have ordered before, your name, email and phone are saved in localStorage to pre-fill checkout fields for convenience. You can clear this by clearing your browser data.
• Stripe: Stripe sets its own cookies to operate payment processing and fraud detection. These are governed by Stripe's Privacy Policy.

We do not use advertising cookies, cross-site tracking pixels, or third-party analytics services (e.g. Google Analytics).

3. How we use your information

• To prepare, manage and hand over your order, and to contact you about it.
• To process payment and prevent fraud and abuse (including rate-limiting and IP blocking).
• To operate and administer the rewards programme.
• To send you order confirmations, pickup-ready notifications, and account-related emails.
• To respond to your questions, complaints or requests.
• To fulfil our legal, tax and accounting obligations.
• To improve the reliability and features of the Service based on aggregated, non-identifiable usage patterns.

We do not use your information for targeted advertising, sell your personal information, or share it for third parties' own marketing purposes.

4. How we share your information

We share your personal information only as follows:

• Stripe: to process your payment. Stripe's use of your data is governed by Stripe's Privacy Policy.
• Email service provider: to deliver order confirmation and notification emails. Your name and email address are shared for this purpose only.
• Hosting provider: your data is stored on servers operated by Hostinger. Data is stored in the European Union / United States in accordance with applicable data protection law.
• Legal requirements: we may disclose information if required by law, court order, or to protect the safety of our customers or the public.

We do not sell, rent or trade your personal information to any third party.

5. Data retention

• Order records: retained for 7 years to meet tax and accounting obligations, then deleted or anonymised.
• Account data: retained for as long as your account is active. If you request account deletion, your personal details are removed within 30 days; anonymised order aggregates may be retained for reporting.
• Server logs (IP addresses): retained for up to 90 days for security and abuse prevention, then purged.
• Support correspondence: retained for 2 years after the conversation closes.

6. Security

We protect your information with: HTTPS encryption on all connections; bcrypt-hashed passwords; server-side access controls and least-privilege database credentials; rate-limiting on login and registration endpoints; and Stripe's PCI-DSS infrastructure for payment data. No system is perfectly secure. If you believe your account has been compromised, please contact us immediately.

7. Children

The Service is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. California residents — CCPA rights

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the following rights:

• Right to know: you may request a copy of the categories and specific pieces of personal information we have collected about you in the past 12 months, and information about how we use and share it.
• Right to delete: you may request that we delete personal information we have collected from you, subject to certain exceptions (e.g. information needed to complete a pending order or meet legal obligations).
• Right to correct: you may request that we correct inaccurate personal information we hold about you.
• Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioural advertising, so there is nothing to opt out of in this respect.
• Right to non-discrimination: we will not deny you service, charge you a different price, or provide a lower quality of service because you exercised any CCPA right.

To exercise any of these rights, contact us at hello@myannapoornafoods.com. We may need to verify your identity before fulfilling a request. We will respond within 45 days (extendable by a further 45 days with notice).

9. Your choices (all users)

• Account data: you can update your name, email and phone through our support team at any time.
• Account deletion: contact us and we will delete your account and associated personal data within 30 days.
• Marketing emails: we only send transactional emails (order confirmations, status updates). We do not send marketing newsletters; there is nothing to unsubscribe from.
• Local storage: clear your browser's local storage to remove your saved cart and contact prefill.

10. Changes to this Policy

We may update this Policy from time to time. We will notify you of material changes by posting a notice on the Service or by email. The "last updated" date at the top reflects the most recent revision. Continued use after a change takes effect constitutes acceptance.

11. Contact us

For any privacy question, request, or complaint, contact us at:
hello@myannapoornafoods.com

Annapoorna · San Francisco Bay Area, California, USA