Privacy policy
Our privacy commitment
Effective September 22, 2026. Heart of India uses personal information only for reasonable purposes connected with pickup orders, customer service, security, and legal obligations. This policy explains what we collect and how customers can contact us about their information.
Information we collect
When you place a pickup order, we collect your name, email address, telephone number, selected dishes and options, optional order notes, order number, order status, and whether payment was recorded at the store.
The website may process limited technical information, such as an IP address and security identifiers, to protect the ordering and operator systems. Rate-limit records use a one-way hash rather than storing the raw identifier. We do not collect payment-card details, delivery addresses, advertising profiles, or customer account passwords.
How we use information
We use customer information to validate and prepare an order, contact the customer about pickup or an order problem, provide the private order-status page, record payment made at the store, prevent misuse, and meet applicable legal or accounting requirements.
We do not sell personal information or use pickup-order information for unrelated advertising.
Service providers and disclosures
We use service providers to host the website and store the private order spreadsheet. They may process information for us under their own security and privacy obligations. Information may be processed outside Ontario or Canada and may be subject to the laws of the place where it is processed.
We may disclose information when required by law, to respond to a lawful request, to protect customers or the restaurant, or as part of a business transfer subject to appropriate protections.
Cookies and local storage
The site stores the non-sensitive shopping cart in browser storage. After an order is placed, a private high-entropy order link and a secure order-scoped cookie permit access to that order’s status. Anyone with the complete private link can view the order, so customers should keep it private. Staff authentication uses a secure operator-session cookie. We do not use third-party advertising cookies.
Retention and safeguards
Order records are normally retained for up to 365 days, then deleted or de-identified unless a longer period is reasonably required for law, accounting, safety, a dispute, or an active access request. Security measures include restricted spreadsheet access, server-only credentials, scoped customer access, authenticated operator access, and encrypted HTTPS connections in production.
No system can guarantee absolute security. If we learn of a privacy incident, we will investigate and take the notification and reporting steps required by applicable law.
Access, correction, and questions
You may ask whether we hold personal information about you and request access, correction, or deletion where applicable. We may need to verify your identity and may retain information that we are legally required or reasonably permitted to keep.
Contact Heart of India at heartofindia.brampton@gmail.com or 905-500-5382 with a privacy question or complaint. We will review the request and respond within the time required by applicable law.
Policy changes
We may update this policy when our ordering practices or legal obligations change. The current version will be posted on this page with a revised effective date.