Privacy

Who this is about

This policy covers rootandroast.in and everything you do on it. The site is run by P P Manoj, trading as Root & Roast, at 1/469, Palayad, Melur, Pinarayi, Kannur, Kerala 670661, India. Anything written below about “we” or “us” means that business, and we are the ones responsible for the information described here.

The short version: we collect what an order needs and what the law requires us to keep, and nothing else. There is no advertising on this site and nothing here is sold, rented or shared for marketing.

What we collect

When you place an order

• your name
• your delivery address, including the PIN code
• your phone number, which delivery services in India need and use
• your email address, for the order confirmation and any updates
• what you ordered, what it cost, and the status of the order
• the result of the payment, and the payment provider’s reference for it

We never see or store your card number, your UPI PIN, your netbanking password or any one-time password. Those are entered with the payment provider and never reach this site.

When your order is paid, its details — what you ordered, your name, phone number, email address and delivery address — are emailed through Brevo, our email service, to the shop’s inbox, which is a Gmail account (Google), so that somebody packs it promptly.

While you type your PIN code at checkout, the PIN alone is sent to this shop’s own server to look up its town and state, so you do not have to type them. Nothing from that lookup is stored beyond the ordinary server logs described below, and no other company is asked. Town names come from the India Post All India Pincode Directory, data.gov.in, under the Government Open Data Licence – India.

When you contact us

Your name, your email address, your phone number if you give us one, and your message. We keep it so that we can answer you and so that a second message about the same problem does not start from nothing. Your message and those details are also emailed through Brevo, our email service, to the shop’s inbox, which is a Gmail account (Google), so that somebody sees it promptly. If you reply to an email from us, your reply goes to that inbox too.

If you create an account

Your email address and phone number, and a password you choose, which we store only in a form that cannot be read back (Supabase Auth). If you continue with Google, Google sends us your name, email address and profile photo link; we use the email address only.

Automatically

Cloudflare delivers this site and keeps ordinary server logs of requests to it — the address requested, the time, the browser’s user agent and the IP address it came from. Those logs exist to keep the site available and to deal with abuse.

When you press Pay, we keep a scrambled code made from your network address and one made from your basket, for 2 days. They cannot be turned back into the address. We use them only to limit how many unpaid orders one person can hold.

This site sets no advertising cookies and runs no third-party analytics or tracking scripts. The only cookies it sets are ones that make it work. Every one of them but the basket count is readable only by this site’s own server, none of them is used to track you anywhere, and each is sent only to the part of the site that needs it:

• Your basket — the product codes and quantities you chose and nothing else; no prices and no totals, which are worked out afresh on our side every time a page is drawn. Set the first time you put something in a basket; lasts 30 days.
• Your basket count — the number of items in your basket and nothing else, readable by this site’s pages so the bag icon can show it without asking our server. Set and cleared with the basket; lasts 30 days.
• A random identifier set alongside it, tied to nothing and nobody, used only so that one browser sending requests very quickly — to the basket, the order lookup or the contact form — cannot slow the shop down for everybody else. Lasts 30 days.
• Your offer code — the offer code you applied, so the basket and checkout can show its saving; it is checked again on the server every time. Set when you apply a code and removed when you remove it or once the order is paid; lasts 30 days.
• Your checkout details — what you typed at checkout, held between the form and the review so you do not type it twice. Sent only to the checkout pages; lasts 15 minutes.
• Your saved checkout details — only if you switch on “Remember my details” at checkout: your name, delivery address, mobile number and email, so that next time checkout opens with them already filled in. They are kept in that cookie on your device and nowhere else — not on our side — and sent only to the checkout pages. Anyone else using the same device and browser would see these details at checkout. To clear them, press “Not you? Use different details” at checkout, switch “Remember my details” off, or clear this site’s cookies in your browser. Lasts 180 days.
• The order you are paying for — a link to that order while the payment completes. Sent only to the checkout pages and the payment step; lasts a day.
• Access to your order — the secret from your order confirmation, so you can come back to that order and its invoice without the link. Sent only to the order pages; lasts a year.
• Signing in — if you sign in to an account, a short note of the email a code was sent to (sent only to the sign-in page, lasting an hour), and then the session that keeps you signed in, which lasts until you sign out. Staff signing in to the shop’s back office get the same session, and short-lived drafts of the forms they are filling in there; a customer never receives those.
• Your sign-in email — the email you typed to sign in with a password, so the form can show it again if the password was wrong. Never the password. Sent only to the sign-in page; removed once you are signed in, and in any case gone after 15 minutes.
• Signing in with Google — where you were going before you left for Google, and a one-time check that the sign-in coming back is the one this browser started. Sent only to the sign-in page; gone after 10 minutes or once you are signed in.
• Your contact-form message — only if the form could not accept it: what you typed, so that the page can hand it back rather than make you type it again. Sent only to the contact page, removed the moment that page has shown it, and in any case gone after 10 minutes.

Why we collect it

• To fulfil your order — pack it, hand it to a delivery service, and tell you where it is.
• To take and refund payment, through the payment provider.
• To meet our obligations under Indian tax law, which requires invoices to carry the buyer’s details and requires us to keep them.
• To answer you when you get in touch.
• To keep the site working and to prevent fraud and abuse.

We do not use your details to build a profile of you, and we do not make automated decisions about you.

Who it is shared with

Only the services that are needed to run the shop, and only the part each of them needs:

• Supabase hosts the database the shop’s records live in. The project runs in the ap-south-1 (Mumbai) region, so your order data is stored in India.
• Cloudflare serves the site and sees requests to it.
• Brevo sends the shop’s emails: it receives your email address and the email we send you. When you use the contact form, your message and the details you give with it pass through Brevo on their way to the shop’s inbox, and so do the details of each paid order.
• Google (Gmail) hosts the shop’s inbox, so it stores the contact-form messages forwarded there, the details of each paid order, and every reply you send to an email from us.
• Google: only if you choose Continue with Google; it learns you signed in to this shop.
• Cloudflare Turnstile: checks that sign-in, checkout, the contact form and Find your order are used by a person; it runs in a frame from Cloudflare and sets no cookie on this site.
• The payment provider, once online payment is enabled, receives what it needs to take the payment and returns the result of it.
• The delivery service we hand your parcel to receives your name, delivery address and phone number, because it cannot deliver without them.

We will also disclose information where the law requires it. We do not sell or rent personal information to anybody, for any purpose.

How long we keep it

• Orders and invoices are kept for as long as Indian tax law requires them to be kept, and are not used for anything else in the meantime.
• Messages you send us are kept while we are dealing with them and for a reasonable period afterwards, in case the same matter comes up again.
• Account details are kept until you ask us to close the account.
• Server logs are kept for the short period Cloudflare retains them for.
• The scrambled codes used at Pay are deleted after 2 days.

Security

The site is served over HTTPS. Access to the shop’s records is restricted to staff accounts, and the database enforces that in its own right rather than relying on the application to ask nicely. Staff passwords are stored hashed by our authentication provider and are not readable by us.

What you can ask us to do

• ask for a copy of what we hold about you
• ask us to correct something that is wrong
• ask us to delete it — we will, except for records we are legally required to keep, and we will tell you which those are
• ask us to stop emailing you anything other than order updates

Use the contact page, or write to the grievance officer below. We will not charge you for any of it.

Grievance officer

If you have a complaint about how we have handled your information, or about anything else to do with this site or an order, it goes to a named person rather than into a queue:

Grievance officer

P P Manoj, proprietor

Address

1/469, PalayadMelur, PinarayiKannur, Kerala 670661India

How to reach them

Through the contact page, marking your message for the grievance officer.

We will acknowledge your complaint within 48 hours of receiving it, and resolve it within one month. Those are the periods the Consumer Protection (E-Commerce) Rules, 2020 and the Digital Personal Data Protection Act, 2023 require of us, and we treat them as deadlines rather than as targets.

Children

This shop is not aimed at children and we do not knowingly collect anything from anyone under 18. If you believe we have, tell us and we will delete it.

Changes to this policy

If this policy changes, the date at the top of this page changes with it. We will not quietly widen what we collect or who we share it with.