Privacy policy

This site is run by [legal entity name], registered at [registered business address], trading as SNAPP. That entity is the data fiduciary for everything described here.

Questions, corrections and deletion requests go to our Grievance Officer, [grievance officer name], at [grievance officer email]. We answer within 30 days and usually the same week.

Everything below comes from you, at checkout. There is no third-party data buying.

What we deliberately do not ask for: date of birth, gender, any government ID, your precise location, or anything at all about what you buy anywhere else.

All payments run through Razorpay. When you pay, the card number, CVV, UPI PIN or netbanking login are entered on Razorpay's own secure surface — they are never sent to us, never pass through our servers and are never stored by us. We could not leak them if we tried, because we do not have them.

What comes back to us afterwards is a receipt: a payment ID, the method used, the last four digits of a card, the amount and whether it succeeded. That is what lets us confirm your order and refund it later.

Razorpay is a payment processor regulated in India and handles that data under its own privacy policy, which is worth a read if payments are your thing.

The contents of your bag are stored in your own browser's local storage. It is not a cookie, it is not sent to us, and we cannot see it. Nobody here knows you put a Grand Snapp in the bag at midnight and took it out again.

It only reaches us when you check out. Empty the bag, or clear this site's data in your browser, and it is gone.

We use the small number of cookies a shop actually needs: keeping your checkout session together, and remembering that you dismissed the banner at the top of the page.

We also run the Meta (Facebook) Pixel. It is how we find out whether an advert we paid for actually led to an order, which is the only way a business this size can avoid wasting money on ads nobody acted on.

It tells Meta which pages you opened here, when you added something to your bag, when you started checkout, and the rupee value and order number of a completed order. It does not send them your name, your phone number, your address or your card details — those never go anywhere near it. It sets Meta's own cookies, and it can mean you later see a SNAPP advert on Facebook or Instagram.

If you would rather it did not: any ad blocker stops it, as does turning off “off-Facebook activity” in your Meta account settings. Nothing about the shop or your order stops working if you do — the site does not check whether it loaded.

• Whoever delivers your order — your name, phone number and address. Not your email, not your order history, not what you paid.
• Razorpay — to take the payment and process refunds.
• Supabase — the database where orders are stored.
• Meta (Facebook) — which pages you opened, and the value and order number of a completed order, so we can tell whether an advert worked. Never your name, phone, address or card details. See §05.
• Our hosting provider — to serve you this page.
• A tax authority or a court, if we are legally required to hand something over. We would tell you unless we were forbidden to.

That is the entire list. We do not sell your details and we do not swap them with other brands. Meta is the one advertising partner in this business, and §05 says exactly what it is given.

We send a drop reminder roughly once a week, and only to people who asked for it. It has an unsubscribe link in every message and one click is all it takes. On WhatsApp, reply STOP.

Messages about an order you actually placed — confirmation, delivery window, a problem in the kitchen — are not marketing, and you cannot unsubscribe from those while the order is live. That is the point of them.

If you send a gift to someone, their details are used for that delivery and nothing else. We do not add gift recipients to any list.

• Orders and invoices — 8 years. Indian tax and accounting rules require it, and this is not a choice we get to make.
• Mailing list — until you unsubscribe, then 30 days so we do not accidentally add you back.
• Gift messages — 90 days after delivery, then deleted.
• Support conversations — 2 years, so a repeat problem has a history.
• Abandoned bags — never stored. See section 04.

You can ask us at any time to:

• tell you exactly what we hold about you;
• correct something that is wrong;
• delete what we hold;
• stop sending you anything;
• send you a copy of your order history.

Message us from the phone number or email on the order, or write to the Grievance Officer in section 01. We may ask one question to confirm it is really you — usually an order number. We act within 30 days.

One honest limit: we cannot delete the invoice records behind orders you have already placed, because we are required to keep them for 8 years. We can delete everything else and disconnect your name from anything that does not have to carry it.

• Everything between your browser and this site is encrypted in transit.
• The database enforces row-level access rules, so an order can only be read by the people entitled to read it.
• Admin access is limited to the people who bake and pack. It is a short list.
• We hold no card data at all, which removes the most valuable thing to steal.

No system is perfect. If something did go wrong and your data was exposed, we would tell you what happened and what we did about it — quickly, and in the same plain language as the rest of this page.

This shop is meant for adults placing orders with their own payment methods. We do not knowingly collect anything about anyone under 18. If you think we have, tell us and it will be deleted the same day.

When we add a tool or change how something works, this page is updated before the change goes live, and the date at the top moves. If a change is significant — a new category of data, a new recipient — we say so on the site rather than hoping you re-read the page.

Anything on this page, including a deletion request or a complaint, can go through the contact page. If you are not satisfied with how we handle it, you can escalate to the Data Protection Board of India.