What we know about you
Privacy policy
We are a bakery. We collect the four things needed to bake a box and get it to your door, and we do not have a use for anything else. This page says exactly what those things are and how to make us delete them.
Last updated 10 August 2026
No selling
Your details are never sold, rented or handed to an advertiser. Not for any price.
No card data
Razorpay takes the payment. Card and UPI credentials never touch our servers.
No tracking pixels
No advertising trackers, no retargeting, nothing following you to other websites.
Who is responsible for your data
This site is run by [legal entity name], registered at [registered business address], trading as SNAPP. That entity is the data fiduciary for everything described here.
Questions, corrections and deletion requests go to our Grievance Officer, [grievance officer name], at [grievance officer email]. We answer within 30 days and usually the same week.
What we collect, and what it is for
Everything below comes from you, at checkout. There is no third-party data buying.
Your name
So the label on the box has a name on it and the rider knows who to ask for.
Your phone number
Order updates on WhatsApp, and the rider calling you from downstairs. This is the one field that genuinely cannot be skipped.
Delivery address and pincode
To deliver. Kept against the order so a repeat order does not mean typing it again.
Email address
The order confirmation and receipt. Drop reminders only if you asked for them.
What you ordered, and when
Support, refunds, and the accounting records we are legally required to keep.
A gift message, if you write one
We copy it onto a card by hand. Nobody reads it for any other reason and it is deleted after 90 days.
A payment reference from Razorpay
A payment ID, the method type, the last four digits and the amount — enough to match a payment to an order and to issue a refund. Nothing more.
Basic technical data
Which pages loaded and roughly where from, so we can tell a broken checkout from a quiet Tuesday.
What we deliberately do not ask for: date of birth, gender, any government ID, your precise location, or anything at all about what you buy anywhere else.
Payments, and why we never see your card
All payments run through Razorpay. When you pay, the card number, CVV, UPI PIN or netbanking login are entered on Razorpay's own secure surface — they are never sent to us, never pass through our servers and are never stored by us. We could not leak them if we tried, because we do not have them.
What comes back to us afterwards is a receipt: a payment ID, the method used, the last four digits of a card, the amount and whether it succeeded. That is what lets us confirm your order and refund it later.
Razorpay is a payment processor regulated in India and handles that data under its own privacy policy, which is worth a read if payments are your thing.
Your bag lives in your browser
The contents of your bag are stored in your own browser's local storage. It is not a cookie, it is not sent to us, and we cannot see it. Nobody here knows you put a Grand Snapp in the bag at midnight and took it out again.
It only reaches us when you check out. Empty the bag, or clear this site's data in your browser, and it is gone.
Messages you did not ask for
We send a drop reminder roughly once a week, and only to people who asked for it. It has an unsubscribe link in every message and one click is all it takes. On WhatsApp, reply STOP.
Messages about an order you actually placed — confirmation, delivery window, a problem in the kitchen — are not marketing, and you cannot unsubscribe from those while the order is live. That is the point of them.
If you send a gift to someone, their details are used for that delivery and nothing else. We do not add gift recipients to any list.
How long we keep things
- Orders and invoices — 8 years. Indian tax and accounting rules require it, and this is not a choice we get to make.
- Mailing list — until you unsubscribe, then 30 days so we do not accidentally add you back.
- Gift messages — 90 days after delivery, then deleted.
- Support conversations — 2 years, so a repeat problem has a history.
- Abandoned bags — never stored. See section 04.
Your rights, and how to use them
You can ask us at any time to:
- tell you exactly what we hold about you;
- correct something that is wrong;
- delete what we hold;
- stop sending you anything;
- send you a copy of your order history.
Message us from the phone number or email on the order, or write to the Grievance Officer in section 01. We may ask one question to confirm it is really you — usually an order number. We act within 30 days.
One honest limit: we cannot delete the invoice records behind orders you have already placed, because we are required to keep them for 8 years. We can delete everything else and disconnect your name from anything that does not have to carry it.
How it is kept safe
- Everything between your browser and this site is encrypted in transit.
- The database enforces row-level access rules, so an order can only be read by the people entitled to read it.
- Admin access is limited to the people who bake and pack. It is a short list.
- We hold no card data at all, which removes the most valuable thing to steal.
No system is perfect. If something did go wrong and your data was exposed, we would tell you what happened and what we did about it — quickly, and in the same plain language as the rest of this page.
Children
This shop is meant for adults placing orders with their own payment methods. We do not knowingly collect anything about anyone under 18. If you think we have, tell us and it will be deleted the same day.
Changes to this policy
When we add a tool or change how something works, this page is updated before the change goes live, and the date at the top moves. If a change is significant — a new category of data, a new recipient — we say so on the site rather than hoping you re-read the page.
Getting hold of us
Anything on this page, including a deletion request or a complaint, can go through the contact page. If you are not satisfied with how we handle it, you can escalate to the Data Protection Board of India.