Privacy Policy

1. Information collected and why

We process information needed to provide accounts, shopping carts, orders, subscriptions, customer support, and website security. The information visible in the current website flows includes:

• Account and sign-in details: email address, authentication credentials managed through Supabase Auth, and name or phone information provided at sign-up or in your profile.
• Saved delivery details: address label, street, city, state, and postal code, used to check service coverage and deliver orders.
• Cart information: selected products, quantities, and options, saved to your account so the cart can be used across signed-in sessions.
• Order information: customer name, email and phone, delivery address, requested date and meal slot, items and quantities, special instructions, amounts, order status, and payment status. This is used to process, fulfill, support, and administer orders.
• Subscription information: selected plan and period, amount, status, and provider identifiers, to create and manage the subscription.

Do not include sensitive personal or medical information in order instructions unless it is necessary to explain a dietary or delivery requirement.

2. Google Sign-In

If you choose Google Sign-In, your browser is redirected through Supabase Auth and Google's OAuth service. The website receives a Supabase-authenticated user record, including an email address when available and provider profile metadata such as a name when supplied. The site uses the account identity to sign you in and associate your profile, cart, saved addresses, orders, and subscriptions with your account. Google and Supabase process information under their own privacy terms.

3. Contact messages

The Contact page currently opens a prefilled Gmail compose window. Information typed into that form is placed in the draft in your browser; the website does not store or submit it through that form. You decide whether to send the draft in Gmail, which then processes it. A separate Resend-backed contact API route exists in the project and would forward submitted name, email, subject, and message to Resend if that route is called and configured. The current Contact page does not call that route. Contact details sent by ordinary email are processed by the email providers involved.

4. Storage and processing

The website uses Supabase for authentication and database storage. Account profile details, saved addresses, carts, order records, and subscription records are read from or written to Supabase in the current application flows. Privileged server operations use server-side Supabase access; secrets are not intended for client-side use. The SQL setup included with the project enables row-level security for customer data tables, but actual production protection depends on the deployed database configuration.

During checkout, a short-lived order idempotency key and request fingerprint are held in the browser's session storage to avoid duplicate order submissions. Supabase Auth also maintains a sign-in session using browser cookies/session data that the server reads when handling authenticated requests. The cart itself is stored in Supabase for signed-in customers. The code reviewed does not show persistent local-storage cart storage.

Order records include a copy of the delivery address and may remain after a saved address is removed from your account. No fixed data retention schedule is configured in the website code.

5. Service providers and external services

Based on the integrations in the current website, information may be processed by:

• Supabase: authentication and database services for account and commerce data.
• Google: OAuth sign-in, Gmail when you choose to send a contact draft, and Google Maps when the Contact page map is loaded. Loading the map makes a request to Google, which may receive technical and network information from your browser.
• Razorpay: payment checkout for eligible orders and subscription payments. Payment details are entered in Razorpay's checkout; the website stores order/payment status and provider references. Review Razorpay's own privacy information for its handling of payment data.
• Resend: the project contains a contact-email endpoint that sends contact fields to Resend if invoked and configured, although the current Contact page uses Gmail instead.
• Website hosting: the site is published on Vercel. The project does not specify hosting-log contents or retention settings; the host may process technical request data to operate and secure the site.

The reviewed source code does not show an analytics or advertising tracker integration. This may change if production configuration or external scripts are added.

6. Cookies, sessions, and tracking

Necessary browser session data supports Supabase sign-in and authenticated requests. Checkout uses session storage for temporary order-retry protection. No separate analytics, advertising, or marketing-tracking cookies were identified in the source reviewed. Google Maps and third-party checkout load content from their providers and are subject to those providers' practices.

7. Retention and account requests

The project does not define a general retention period or automatic deletion schedule. Order history and related transaction records are stored in Supabase. You can update some profile information and delete saved addresses in your account, but there is no self-service account or complete personal-data deletion feature. An order record is linked to the customer account in the database, so deleting an account may require resolving existing order and legal record requirements first.

For a request to access, correct, or delete personal information, or for an account-related question, contact us using the details below. We may need to verify your identity and may retain information where required or permitted by applicable law or needed to complete an outstanding transaction. The business should confirm its retention schedule and request-handling process.

8. Security

The application uses authenticated sessions, server-side handling for privileged database operations, and row-level security policies in the provided database setup. We take reasonable steps to protect information, but no internet transmission or storage system can be guaranteed completely secure. Keep your credentials private and tell us promptly if you believe your account has been accessed without permission.

9. Privacy requests and applicable rights

You may contact us to ask about information associated with your account or to request access, correction, or deletion, subject to identity checks and applicable Indian law. We will consider and respond to requests as required by applicable law. Some information may need to be retained for orders, payments, dispute handling, or legal obligations. This page is not a substitute for advice about your rights in a particular situation.

10. Contact about privacy

For privacy or account requests, contact House of Superfoods:

The website does not identify a named privacy or grievance officer. The business should confirm whether a designated contact is required and publish the appropriate name and contact process.

11. Policy updates and effective date

We may update this policy when our services or data practices change. The current version and effective date will be shown here. The business should review the listed providers, retention information, and outstanding owner-confirmation items before publication as final.