Privacy Policy

1. What Information We Collect

Information you provide to us

We collect personal information that you voluntarily provide when you register an account, set up your storefront, place an order, request a custom order, or otherwise contact us. Depending on how you use the Services, this may include:

• Account details — your name, email address, and mobile number used to create and secure your BakeLink account.
• Storefront details (bakery owners) — your business name, description, tagline, logo and cover images, contact phone and WhatsApp number, social media links, and business address.
• Catalogue content (bakery owners) — product names, descriptions, prices, photographs, categories, flavours, and store opening hours.
• Order details (customers) — your name, phone number, optional email address, requested delivery or pickup date and time, product selections, customisation notes, and inspiration images uploaded with a custom order request.
• Communications — any messages, questions, or feedback you send to us or to a bakery through the Services.

Payment information

Subscription payments by bakery owners are processed by our payment partner, Razorpay. We do not collect or store your full card number, UPI PIN, or bank credentials on our servers. Razorpay collects and processes that information directly under its own privacy policy. We retain only limited records such as your subscription status, plan, and transaction references.

Information collected automatically

When you access the Services, we and our infrastructure providers automatically collect certain technical information, such as your IP address, browser and device type, operating system, the pages you view, and the dates and times of your visits. This information is used to operate, secure, and improve the Services.

2. How We Use Your Information

We use the information we collect to:

• Create, authenticate, and manage your account and storefront.
• Display bakery storefronts and product catalogues to customers.
• Receive, route, and manage orders and custom order requests between customers and bakeries.
• Send transactional and operational notifications, including order alerts and reminders, via WhatsApp, email, or in-app messages.
• Process subscription payments and manage free trials and renewals.
• Provide customer support and respond to your enquiries.
• Maintain the security and integrity of the Services and prevent abuse.
• Comply with our legal obligations and enforce our Terms and Conditions.
• Analyse usage to understand, maintain, and improve the Services.

3. Bakery Owners vs. Their Customers

BakeLink is a multi-tenant platform, which means the way we handle data depends on your relationship with us:

For bakery owners

When you register a bakery, BakeLink acts as the controller of your account data and processes it to provide you the Services described above.

For customers of a bakery

When you place an order through a bakery's storefront, the order information you provide is made available to that bakery so it can fulfil your order. The bakery is responsible for how it uses your information once it is shared with them. BakeLink processes this information on the bakery's behalf to operate the platform. If you have a question about how a specific bakery uses your information, please contact that bakery directly. You may also contact us using the details at the end of this policy.

4. Legal Bases for Processing

We only process your personal information when we have a valid reason to do so. The legal bases we rely on include:

• Performance of a contract — to provide the Services you or a bakery have requested, such as fulfilling an order.
• Legitimate interests — to secure, maintain, and improve the Services and to prevent fraud and abuse.
• Consent — where you have given us consent, for example to receive certain communications. You may withdraw consent at any time.
• Legal obligation — to comply with applicable laws and regulations.

5. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

• With bakeries — order and custom order details are shared with the bakery you order from so it can fulfil your request.
• With service providers — we share information with the trusted third parties listed below who help us operate the Services, under contracts that require them to protect your data.
• For legal reasons — when required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of BakeLink, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction.

6. Third-Party Services We Rely On

To deliver the Services, we use a small number of carefully chosen processors. Each handles only the data needed for its function and is governed by its own privacy policy:

• Supabase — authentication and database hosting, including sign-in by email or Google account.
• Firebase Storage (Google) — secure storage of product images, logos, and inspiration images.
• Razorpay — processing of subscription payments.
• WhatsApp (Meta) — delivery of order alerts and reminder notifications.
• Vercel — hosting and delivery of the website and application.

If you sign in with Google, we receive basic profile information (such as your name and email address) from Google to create and authenticate your account. We do not receive your Google password.

7. Cookies and Tracking

We use cookies and similar technologies that are strictly necessary to operate the Services, primarily to keep you signed in and to maintain your session securely. We do not use these technologies to build advertising profiles. Most browsers let you refuse or delete cookies; however, disabling essential cookies may prevent you from signing in or using parts of the Services.

8. How Long We Keep Your Information

We retain your personal information only for as long as is necessary for the purposes set out in this policy, including for as long as your account is active, to provide the Services, and to comply with our legal, accounting, or reporting obligations. When information is no longer needed, we will delete or anonymise it. If you close your account, we will delete or anonymise your account information within a reasonable period, except where we are required to retain it by law.

9. How We Keep Your Information Safe

We implement appropriate technical and organisational measures designed to protect your personal information, including encryption in transit, access controls, and authentication managed by trusted providers. Although we perform regular routine backups, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account password confidential and for all activity under your account.

10. International Data Transfers

The Services are hosted and operated primarily in India, and our service providers may process and store information in other countries. If you access the Services from a region with data protection laws that differ from those of India, please be aware that your information may be transferred to, stored in, and processed in India and other countries. By using the Services, you consent to such transfers.

11. Your Privacy Rights

Subject to applicable law, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information.
• Object to or restrict certain processing of your information.
• Withdraw consent where processing is based on consent.
• Request a copy of your information in a portable format.

Bakery owners can review and update much of their information directly from their admin dashboard. To exercise any of these rights, or if you are a customer who wishes to access or delete information held by a bakery, please contact us using the details below. We will respond in accordance with applicable law. You also have the right to lodge a complaint with a data protection authority.

12. Children's Privacy

The Services are intended for users who are at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

13. Do-Not-Track Signals

Most web browsers and some mobile operating systems include a Do-Not-Track ('DNT') feature. As no uniform technology standard for recognising and implementing DNT signals has been finalised, we do not currently respond to DNT browser signals. If a standard is adopted in the future, we will update this policy accordingly.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we do, we will revise the 'Last updated' date at the top of this page. We encourage you to review this policy periodically. Your continued use of the Services after any changes take effect constitutes your acceptance of the revised policy.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us at: