Privacy Policy

This policy explains how Krishva's Kitchen (“we”, “us”) handles personal information when you use our mobile app, visit this website or place an order with us.

The data controller for the purposes of UK data protection law is Krishva Food Services Limited, a company registered in England and Wales under company number 16583340, which trades as Krishva's Kitchen.

Registered office: 7 Berkeley Road, London NW9 9DJ. You can reach us about anything in this policy at support@krishvaskitchen.com.

Depending on how you use our services, we may collect:

• Account details — your name, phone number and email address. Your phone number is how you sign in: we send a one-time passcode to it rather than asking you to keep a password.
• Google account details, if you choose to link one — signing in with Google is optional. If you use it, we receive the email address, display name and profile photo held on that Google account.
• Delivery details — the address you ask us to deliver to and any instructions you add for the rider. If you place or adjust your address on the map, the coordinates of that location are saved with the address so our riders can find you. Your postcode is checked against our delivery area.
• Order and subscription history — what you ordered, which plan you are on and how many meal credits you have remaining.
• Payment information — your card details are entered into a secure payment form provided by Stripe and go directly to Stripe. We never receive or store your card number, security code or expiry date. What we keep is the payment reference and its status, linked to the order or subscription it paid for.
• Notification token — an identifier for your device, stored against your account so we can send you push notifications about your orders.
• Technical and diagnostic data — device type, app version and basic diagnostics, used to keep the service working. See App diagnostics and analytics below.

We use personal information to:

• take, prepare and deliver your orders;
• manage your subscription and keep track of your meal credits;
• send you push notifications about an order or your account;
• contact you about a delivery or a problem with your account;
• handle cancellations, complaints and customer support enquiries;
• keep records we are required to keep, and improve the service.

We only send marketing messages where you have agreed to receive them, and you can opt out at any time.

We process personal information where it is necessary to perform our contract with you (taking and delivering your order), where we have a legitimate interest in running and improving the service, where we need to comply with a legal obligation, and — for optional things such as marketing — where you have given consent.

We share personal information only where it is needed to run the service. The providers we use, and what each one is used for, are:

• Google Firebase Authentication — signing you in by phone number and one-time passcode, and linking a Google account if you choose that option.
• Google Cloud Firestore (Firebase) — storing your profile, saved delivery addresses, orders, subscriptions and meal credits, payment records and notification data.
• Firebase Cloud Functions — processing orders, subscriptions and payments on our servers.
• Firebase Cloud Messaging — sending push notifications about your orders; your device's notification token is stored against your account.
• Firebase Storage — storing our own menu, business and notification images. Customers do not upload files to it.
• Stripe — taking payment. Your card details go directly to Stripe and we never receive them.
• Google Sign-In — an optional way to sign in. If you use it, we receive the email address, display name and profile photo on that Google account.
• Google Maps — letting you place and fine-tune your delivery location on a map, with your device's GPS if you allow it.
• postcodes.io — checking that a postcode falls inside our delivery area. Only the postcode is sent.
• MyWay Route Planner — planning and assigning delivery routes for our own riders. Delivery details are exported manually by our staff as a file when routes are being planned — there is no automatic connection between our systems and MyWay.
• Namecheap — hosting this website.

Deliveries are made by our own riders, managed by us. MyWay Route Planner is a route-planning tool we use to organise those riders; it is not a courier and does not deliver your order.

We may also share information where the law requires it. We do not sell personal information, and we do not share it for anyone else's advertising.

Some of the providers listed above are based outside the United Kingdom, or store data outside it. Where personal information is transferred abroad, we rely on the safeguards those providers put in place for international transfers, such as the UK addendum to the standard contractual clauses approved for use under UK data protection law. If you would like more detail about a particular provider, email support@krishvaskitchen.com and we will tell you what we know.

Our mobile app includes Google's Firebase Analytics and Firebase Crashlytics components. We do not send any custom analytics events of our own, and we do not use them to build a profile of you or to target advertising.

These components can collect a baseline of app and device information automatically. We would rather tell you that plainly than claim a certainty we do not have, so: if any such collection is active, it is limited to what those Google services gather by default to report app stability and general usage, and it is governed by Google's own terms as well as this policy. If you want to know exactly what is being collected at any point, email support@krishvaskitchen.com and ask — we will check and tell you.

We keep personal information for as long as your account is active, and afterwards only for as long as we need it. Our retention periods are:

• Order and payment records — 6 years, which is the period HMRC requires business records to be kept.
• Account details — for as long as your account is active, then 12 months after it becomes inactive.
• Support messages by email or WhatsApp — 2 years.
• Marketing consent — until you withdraw it.

These periods may be extended where the law requires it — for example where records are needed for an accounting, tax or legal obligation, or for a claim that is still open. When a period ends, we delete the information or remove what identifies you from it.

Under UK data protection law you have the right to access the personal information we hold about you, to have it corrected or deleted, to object to or restrict how we use it, and to ask for a copy in a portable format. Where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, email support@krishvaskitchen.com. If you are not satisfied with our response you can complain to the Information Commissioner's Office (ico.org.uk).

You can delete your account yourself at any time — see how to delete your account for the steps, and for what is deleted and what we keep.

We take reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access. Card details are handled by Stripe and never reach our systems. No system is completely secure, so we also limit what we collect and who inside the business can see it.

This website sets no cookies. It uses no analytics, no advertising or tracking pixels, and no third-party scripts. The pages are served as they are, and nothing is stored on your device to identify you or follow you between visits.

If we ever add analytics or other non-essential cookies, we will update this section and ask for your consent before setting them.

Our services are intended for adults. We do not knowingly collect personal information from children. If you believe a child has given us their details, contact us and we will delete them.

We may update this policy as the service changes. When we do, we will update the date shown at the bottom of this page, and we will tell you directly if the change materially affects how we use your information.