1. Introduction
Welcome to Boxmycake ("we", "our", or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website and related services (the "Service").
By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please discontinue use of the Service.
2. Information We Collect
2.1 Account & Profile Information
- Authentication: Email address and password, or phone number (verified via OTP), or Google account details — depending on the sign-up method you choose.
- Profile: Full name and profile photograph that you choose to upload.
2.2 Order & Delivery Information
- Delivery Address: Full address, pincode, city, state, and contact phone number — entered manually by you for order delivery.
- Order Details: Items ordered, quantities, special instructions, and delivery slot preferences.
2.3 Payment Information
- Payment is processed through Razorpay. Your credit/debit card, UPI, or net banking details are sent directly to Razorpay and are not stored on our servers.
- We maintain a record of your wallet balance and payment status (paid/unpaid) for order management.
2.4 Automatically Collected Data
- Local Storage: We use browser local storage (via Zustand) to remember your login session, cart items, and selected delivery pincode. This data stays on your device and is not sent to us.
- Server Logs: Standard server logs (IP address, browser type, access times) may be recorded by our hosting provider (Vercel) for operational purposes.
3. How We Use Your Information
- To create and manage your account and verify your identity via OTP.
- To process, fulfill, and deliver your orders.
- To process payments securely through Razorpay.
- To communicate transactional updates such as order confirmations, delivery status, and receipts.
- To manage your saved delivery addresses for faster checkout.
- To maintain your wallet balance and order history.
- To detect and prevent fraud or misuse of the Service.
4. Photo Upload (Camera & Gallery)
Our Service allows you to upload a profile photograph by selecting an image file from your device (via the standard file picker). We do not access your device camera, nor do we read any other images from your gallery or file system. The image you select is uploaded to our secure storage (Cloudinary) and used solely as your profile picture.
5. Location Information
With your explicit permission, we may access your device's GPS location to:
- Auto-detect your delivery pincode when setting a delivery location.
- Auto-fill your city, state, and address details when adding a new delivery address.
- Record approximate delivery coordinates (latitude/longitude) with your order for delivery accuracy.
Location access is entirely optional. You can always enter your pincode and address manually. We only access your location when you tap the "Detect my location" or "Auto-fill from my location" button. We do not track your location in the background. Your coordinates are used only for the specific order or address you are creating and are stored with that record.
Reverse geocoding (converting coordinates to address) is performed using the OpenStreetMap Nominatim service. Your coordinates are sent to this service momentarily and are not stored by them.
6. Third-Party Services
We use the following third-party services that receive limited data to operate the Service:
- Firebase (Google): User authentication (email, phone OTP, Google Sign-In) and Firestore database to store your account profile, orders, addresses, and product data.
- Cloudinary: Cloud storage and CDN for uploaded profile images and product images.
- Razorpay: Payment processing. Payment details are transmitted directly from your browser to Razorpay. We only receive confirmation of payment status.
- Google reCAPTCHA: Used during phone number OTP verification to prevent abuse.
- Vercel: Hosting and server infrastructure. Standard server logs (IP, browser, timestamps) may be recorded.
- OpenStreetMap Nominatim: Reverse geocoding — converts GPS coordinates to address/pincode when you use the location detection feature.
We do not sell or share your personal information with any advertising networks, data brokers, or marketing platforms.
7. Data Security
We implement reasonable security measures including encrypted connections (SSL/TLS), secure authentication, and access controls to protect your personal information. Payment data is handled entirely by Razorpay, which is PCI-DSS compliant. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
8. Data Retention
We retain your account and order data for as long as your account is active. If you request account deletion, we will remove your personal data within 7–10 business days, except where retention is required by law (e.g., financial records for tax compliance). Order records may be anonymized rather than fully deleted where legally required.
9. Your Rights
You have the following rights regarding your personal information:
- Access: View your personal data through your profile page.
- Correction: Update your name, email, or addresses directly from your profile.
- Deletion: Request deletion of your account and all associated data.
To exercise any of these rights, please contact us at hello@boxmycake.com.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any material changes will be posted on this page with a revised "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.
11. Contact Us
If you have any questions about this Privacy Policy, please contact us:
- Email: hello@boxmycake.com
- Phone: +91 98765 43210
- Address: 123 Sweet Street, Mumbai
