Last updated: 20 July 2026
This policy explains what personal data The Hidden Leaf Cafe ("we", "us", "our"), a business operated by Abdul Kareem at Shop F3, 1st Floor, Piaray Ashiyana, Bara Imam Road, Kalaburagi, Karnataka 585104, India, collects through this website (hiddenleafcafe.in), why we collect it, who else sees it, how long we keep it, and how you can get it back or have it deleted.
We are the Data Fiduciary for this data under India's Digital Personal Data Protection Act, 2023 and the rules made under it. We have written this policy item by item, in plain language, because that is what the law asks for and because a policy nobody can follow protects nobody.
The short version. We collect what we need to hold your seat, cook your food, take your payment and give you your Leaf Coins. We do not sell your data, we do not run advertising trackers, and we never see your card or UPI details. You can download everything we hold, or delete your account, from your account page at any time, without asking us first.
We only collect data for the purposes listed here. If you do not use a feature, we do not collect the data in its row.
| What | Why we need it |
|---|---|
| Your name | To know whose seat it is when you walk in |
| Your mobile number | To confirm the booking, and to reach you if something changes |
| Date, start time, duration, number of PCs, which stations | To hold the right machines for the right hours |
| Payment status and the reference number from our payment aggregator | To tell paid bookings from unpaid ones, and to process refunds |
| Whether you ticked the WhatsApp reminder box, and when | To prove we had your permission before messaging you |
| What | Why we need it |
|---|---|
| Your mobile number and/or email address | This is your login. You can have either, or both |
| A one-time login code | To check it is really you. We store only a scrambled (hashed) copy, never the code itself |
| The IP address the login request came from | To stop someone hammering the login with automated attempts |
| A login token on your device | So you stay signed in and do not re-enter a code every visit |
| Your display name and profile photo, if you set one | To show on your account page |
Google sends us your email address, name and profile picture from your Google account. We use them to create or find your account, nothing else. We do not get your Google password, your contacts, or anything else in your Google account. You can log in with a mobile number instead if you would rather not use this.
| What | Why we need it |
|---|---|
| Your name | So the kitchen knows whose order it is |
| Your WhatsApp number (optional) | Only to credit Leaf Coins to your account. Leave it blank and the order still works |
| What you ordered, and the total | To cook it and bill it |
| What | Why we need it |
|---|---|
| Your rating and what you wrote | To publish it on the site |
| Your name, and how you want it shown (full name, first name only, or anonymous) | You choose what appears publicly |
| Your mobile number | To check the review is from a real customer and to stop fake reviews. It is not published unless you tick the box asking us to show it, and even then only partly hidden, for example 987•••••10 |
| Your email address (optional) | Only so we can reply to you privately. Never published |
For the Instagram-follow or Google-review bonus we ask for your Instagram username or the name you left the Google review under, so we can find it and confirm the bonus. You may also attach a screenshot as proof. Screenshots are stored privately, are visible only to our staff, and rejected ones are deleted automatically within 7 days.
Your name and mobile number go on the bill, along with the items, amounts and how you paid. If you ask for the bill on WhatsApp we also record the number we sent it to and whether it arrived.
Like every website, ours receives standard technical information your browser sends: your IP address, approximate region, and device and browser type. Our hosting providers process this to deliver the pages and block attacks. We do not use it to build a profile of you.
Most of what we collect is what you type in to get something done: you cannot hold a station without giving us a name and a number. For anything beyond that, we ask separately and we never tick the box for you.
You can withdraw consent at any time: untick the box next time, reply STOP to a promotional message, or delete your account outright from your account page. Withdrawing consent does not undo what we lawfully did beforehand, and it does not affect messages that are not marketing, such as your booking confirmation, your bill or your login code.
We only send offers to people who asked for them. The box on the booking form is unticked by default; leave it unticked and we will never send you a promotional message.
If you tick it and then do not finish your booking, we may send you a single WhatsApp message with a discount code, valid for a short time. We send at most one such message per phone number in any 30-day period, and none at all once you have booked or visited.
To stop: reply STOP to that message, or tap the STOP button on it. We will not send you offers again. We keep your number on a do-not-message list purely so that we can honour that request. That list is the one thing we keep even if you delete your account, because deleting it would let the system message you again, which is exactly what you asked us not to do.
These messages travel over the WhatsApp Business Platform, so Meta processes them in order to deliver them, under their own terms.
We do not sell your personal data, and we never will. We share it only with the service providers that make the cafe work, and only with the part they need:
| Who | What they get | What for |
|---|---|---|
| Our RBI-authorised payment aggregator | Your name and mobile number, the amount, a booking reference | To take the payment and issue refunds |
| Supabase | Everything in section 1. They host it, they do not use it | Database and file hosting |
| Cloudflare | Your IP address and request details | Website hosting, blocking attacks and bots, and cookie-free visitor counts (Web Analytics) |
| Meta (WhatsApp Business Platform) | Your mobile number and the message content: booking confirmations, bills, login codes, and offers if you asked for them | To deliver WhatsApp messages |
| If you use "Continue with Google", your sign-in. Separately, your IP address whenever a page loads their fonts or sign-in script | Sign-in, and delivering fonts | |
| Resend | Your email address and your login code | To email one-time login codes |
| jsDelivr | Your IP address when a page loads | Delivering part of the site's code |
We may also disclose information where the law requires it, for example to a court, a tax authority or the police acting under lawful authority.
We use no tracking or advertising cookies. The site keeps a small amount of functional data on your device: your login token so you stay signed in, a note that you have already seen the intro animation, and your name and number on the food-ordering page so you do not retype them. This stays on your device and is not used to identify or track you. Clearing your browser data removes it, and you will simply be asked to log in again.
To understand how many people visit and which pages are popular, we use Cloudflare Web Analytics. It is privacy-first by design: it sets no cookies, stores nothing on your device, does not fingerprint your browser, and does not follow you to other websites. It reports only aggregate counts, never anything that identifies you.
| What | How long |
|---|---|
| Login codes | 5 minutes, then they stop working. Deleted within 24 hours |
| The IP address logged with a login request | Deleted with the login code, within 24 hours |
| Your login session | 8 hours, or 14 days if you tick “keep me signed in on this device”. Ends sooner if you log out. |
| Your account, name, photo, handles and Leaf Coins | Until you delete your account |
| Rejected bonus screenshots | Deleted automatically within 7 days |
| Booking and order records | While your account is open. Your name and number are removed from them if you delete it |
| Bills and payment records | 6 years, because tax law requires it. Your name and number are removed if you delete your account. See section 8 |
| Do-not-message list | Indefinitely, so your STOP keeps working |
Go to your account page and choose Delete my account. You will be asked to confirm with a one-time code. It happens immediately. You do not have to email us and wait.
What is deleted: your name, mobile number, email address, profile photo, login history, IP records, Leaf Coins balance, Instagram handle or Google review name, and any screenshots you sent us. Your name and number are also stripped from your past bookings and food orders.
What we have to keep, and why: the DPDP Act lets us keep personal data where another law requires it, and requires us to tell you when we do. Indian tax law makes us retain our books of account for six years. So the bill itself stays, with the date, items and amounts. Your name and phone number are removed from it first, because a cafe bill below ₹50,000 to a customer who is not GST-registered does not legally need to carry them. In the rare case of a bill of ₹50,000 or more, the name has to stay on the invoice, and we will tell you so on screen at the time.
We also keep, permanently, your number on the do-not-message list if you had asked us to stop sending offers, for the reason given in section 4. And we keep a record that a deletion happened, with no name attached, so we can show we honoured your request.
Deleting your account forfeits any Leaf Coins balance. We cannot restore an account once it is gone.
Under the DPDP Act you have the right to:
If you do not have an account, or cannot get into it, contact our Grievance Officer below and we will handle your request by hand. We may ask you to confirm your identity first, so that nobody else can request your data or delete it.
No system is perfect. If a breach ever affects your personal data we will notify you and the Data Protection Board of India as the law requires.
Your bookings, orders, bills, account details and Leaf Coins are stored on servers in India (our database is hosted in the Mumbai region).
Some of the services that sit around it operate globally, so a limited amount of data passes outside India: WhatsApp messages are delivered by Meta, login codes sent by email go through Resend, and Cloudflare handles website delivery and security. We only use providers who commit to protecting your data, and we do not transfer it to any country restricted by the Government of India for this purpose.
If we add a feature that collects something new, we will update this page and change the date at the top before turning it on. If the change is significant we will tell you directly.
For any question or complaint about your personal data or this policy, including requests to access, correct or delete your data, contact our Grievance Officer:
Abdul Kareem · Grievance Officer
Email: admin@hiddenleafcafe.in ·
Phone/WhatsApp: +91 88616 64952
We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
The Hidden Leaf Cafe · Shop F3, 1st Floor, Piaray Ashiyana, Bara Imam Road, Kalaburagi, Karnataka 585104
FSSAI Reg. No.: 21226090000393
Phone/WhatsApp: +91 88616 64952 ·
Email: admin@hiddenleafcafe.in