Privacy Policy

Welcome to Tiffin Wales. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and food delivery services (collectively, the "Services").

By accessing or using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of our Services.

We collect information you provide directly, and certain data automatically when you use our Services.

Information you provide

• Account details: name, email address, phone number, password.
• Delivery information: street address, city, postal code, GPS coordinates.
• Order details: items ordered, meal plan preferences, spice levels, special instructions.
• Payment information: card type, last 4 digits, billing name (full card numbers are handled by our payment processor — never stored on our servers).
• Communications: messages you send to our support team, feedback, or reviews.

Information collected automatically

• Device information: device type, OS, app version, unique device identifier.
• Usage data: pages viewed, features used, time spent, interaction patterns.
• Location data: approximate location to find nearby kitchens and calculate delivery fees.
• Push notification tokens: to send you order updates (you can disable this anytime).

We use the information we collect to:

• Process and fulfill your orders, including meal plans and subscriptions.
• Deliver food to your address and coordinate with delivery drivers.
• Calculate delivery fees based on your distance from the kitchen.
• Send order confirmations, delivery updates, and receipts.
• Process payments and prevent fraudulent transactions.
• Provide customer support and resolve disputes.
• Send promotional offers (only if you opt in — you can unsubscribe anytime).
• Improve our menu, services, and overall user experience.
• Comply with legal obligations.

We do not sell your personal information. We only share it with trusted partners strictly to deliver our Services:

Who we share with

• Delivery partners: name, address, and phone — only for completing your delivery.
• Payment processors: encrypted payment data — for transaction processing.
• Notification providers: device token — to send you order updates.
• Analytics providers: anonymized usage data — to improve the app.
• Legal authorities: only when required by law or to protect our rights.

What we never share

• Your full card number (never stored, never shared).
• Your password (always hashed — even we can't read it).
• Your personal data with advertisers or data brokers.

All payments are processed by PCI-DSS compliant third-party payment gateways (Stripe, Razorpay, or similar). We never store full credit or debit card numbers on our servers.

• We only receive a token or the last 4 digits of your card from the payment provider.
• Cash on Delivery (COD) orders are tracked but do not involve card data.
• Refunds are processed through the original payment method within 5–10 business days.

Our website and app use cookies and similar technologies to:

• Keep you logged in between sessions.
• Remember your cart and delivery address.
• Measure which features are useful and which need improvement.
• Detect and prevent security threats.

You can control cookies through your browser settings, but disabling essential cookies may prevent core features (like login and cart) from working properly.

We use industry-standard security measures to protect your data:

• TLS/SSL encryption for all data transmitted between your device and our servers.
• Hashed passwords using bcrypt — we never store plain-text passwords.
• Firewall & WAF to block malicious traffic.
• Regular security audits of our codebase and infrastructure.
• Access controls — employees only access data on a need-to-know basis.

We retain your data only as long as necessary to provide our Services and comply with legal obligations:

• Active accounts: data retained while your account is active.
• Order history: retained for 7 years for tax and legal compliance.
• Account closure: personal data deleted or anonymized within 30 days of account deletion request.
• Backups: may persist for an additional 30 days before being purged from archives.

Depending on your location, you may have the following rights over your personal data:

Universal rights

• Access: request a copy of the personal data we hold about you.
• Correction: fix any inaccurate or incomplete information.
• Deletion: request deletion of your account and personal data.
• Opt-out: turn off marketing communications at any time.

GDPR rights (EU/UK users)

• Data portability — receive your data in a machine-readable format.
• Restrict processing — limit how we use your data.
• Object to processing — including profiling.
• Lodge a complaint with your local data protection authority.

CCPA rights (California users)

• Know what personal data is collected and why.
• Know if data is sold (we do not sell).
• Opt out of "sales" (not applicable — we never sell).
• Non-discrimination for exercising your rights.

Our Services are not intended for children under 13 (or 16 in the EU). We do not knowingly collect personal information from children.

If you believe a child has provided us with personal data, please contact us at privacy@tiffinwales.com and we will delete it promptly.

Our app integrates with these trusted third parties. Each has its own privacy policy:

• Payment processors — Stripe, Razorpay, or similar.
• Notification services — OneSignal for push notifications.
• Maps & location — OpenStreetMap, MHJ Maps, Google Maps.
• Analytics — anonymized usage statistics.
• Cloud infrastructure — secure hosting in the United States.

We are not responsible for the privacy practices of these third parties. Please review their policies separately.

We may update this Privacy Policy from time to time. When we do:

• The "Last updated" date at the top of this page will change.
• Significant changes will be communicated via in-app notification or email.
• Continued use of our Services after changes means you accept the updated policy.

We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out to us using the contact information below. Our team responds to all privacy inquiries within 30 days.