Privacy

Last updated November 2026

What we collect, why, who sees it, and how to have it removed. This is written to the Personal Data (Privacy) Ordinance.

01What we collect

When you order: your name, phone number, email if you give one, delivery address if the order is delivered, and what you bought.

When you browse: a salted hash of your IP address and the page you opened, recorded only when you arrive from a QR code. The address itself is never stored.

We do not use advertising cookies and we do not sell data.

02Why

To fulfil the order: the Seller needs a name and a number to hand the right bag to the right person.

To take payment, which is handled by the payment provider — card details never reach us.

To know which QR codes are being scanned, so a Seller can tell whether the card on their table is working.

03Who sees it

The Seller whose order it is: your name, phone number, email and delivery address, and what you ordered. They need it to fulfil the order and for nothing else.

Our payment provider, for the payment.

Our messaging provider, to send order updates.

Nobody else, unless the law requires it.

04How long

Order records are kept while they are needed for accounting and disputes.

Scan records are kept in aggregate. The hashed address is not linked to a person we can identify.

05Removal

You can ask for your order details to be erased. We remove your name, phone number, email and address from the order and record that we did it; the order's amounts stay for accounting, with no person attached.

Email [email protected] and we will do it within 30 days.

06Contact

[email protected] is the address for both privacy questions and removals.

Questions about this document: [email protected].