Privacy Policy

1Who we are

CakeBabu lets you design a cake in 3D and order it from a local bakery. It is run by Anubhav Kalita from Guwahati, Assam, India.

For the details you give us, we decide why and how they are used, so we are responsible for looking after them under India’s data protection law, the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000. You can reach us at our contact email (being set up).

2What we collect

We ask only for what is needed to take your order. You type most of it yourself.

What	Why we need it	Who sees it
Your name and mobile number	So the bakery knows whose order it is and can call you if needed. The number is also checked with an SMS code, so nobody can order with your number.	The bakery you order from. Our SMS provider sees the number to send the code.
Delivery address, and your note to the bakery	So the bakery can deliver, and follow your note (“less sugar”). If you pick self pickup, no address is needed.	The bakery you order from.
Your cake design, size, flavour, message, and the date and time you pick	To make the cake you designed.	The bakery you order from.
The order itself: bakery, price, status, and the time of each step	To run the order, show you its progress, and sort out problems.	You, the bakery, and us.
The UPI reference number, if you type it after paying	Optional. It helps the bakery match your payment. We never ask for your UPI ID, UPI PIN, card or bank details.	The bakery and us.
Your account, only if you make one: your name, and the mobile number, email address or Google account you sign in with	So you can sign in, and see your orders and saved things on any device. With Google, Google tells us your Google account ID, name and email address, and whether Google has checked the email. We do not get your Google password or anything else from your Google account.	You and us. The bakery sees only the name and number you put on an order.
What you keep in your account: saved cake designs, challenge badges, delivery addresses, and which orders are yours	So they are there on every device you sign in on. Your last 5 delivery addresses are saved when you order. You can remove them any time.	You and us.
Your location, only if you tap “Use my current location”	To put the nearest bakeries first and to check whether a bakery delivers to you. Your phone sends rough coordinates to our server for this. We do not save them. The order keeps only the distance in km.	Our server. The bakery sees only the distance.
Your IP address	To stop abuse, such as someone asking for hundreds of SMS or email codes. It is kept with the code records, which we clear within about a day. Our hosting provider also keeps ordinary server logs.	Us and our hosting provider.

An account is optional. You can order as a guest with a verified mobile number. If you only browse, design a cake or look at bakeries, we do not ask for or save your name, number or address.

3Cookies and what is saved on your device

We use only what CakeBabu needs to work. There are no advertising cookies, no analytics and no trackers.

Verified-number cookie. Remembers which mobile numbers you have verified on this browser, for up to 90 days, so you do not get a new SMS code for every order. JavaScript on the page cannot read it.
Code cookies. Live for 15 minutes while you type an SMS or email code, or while Google sign-in finishes.
Account cookie. If you sign in, it keeps you signed in on this browser for up to 180 days. JavaScript on the page cannot read it. Signing out removes it.
Saved on your device. Your name, number and last delivery address (so you do not retype them), a list of your orders with a private key that lets you see their status, and any designs you save. This stays in your browser or app. You can clear it any time in your browser settings. Clearing it does not delete your orders from our records (see “Delete your data”). As a guest you will then no longer see them in My orders; with an account, they come back when you sign in. When you sign out, CakeBabu removes your account’s orders, designs and details from that device.
Notifications. If you allow them, CakeBabu shows an alert on this device when your order changes. The alert is made on your device. No notification service gets your data.
Bakeries. When a bakery logs in, a sign-in cookie keeps it logged in for up to 30 days.

4How we use your details

We use your details to:

take your order and pass it to the bakery, and show you its progress;
check your mobile number with an SMS code;
if you make an account, sign you in with an SMS code, an email code or Google, and show your orders, designs and addresses on your devices;
keep CakeBabu safe and stop abuse;
answer your questions and complaints;
keep the records the law asks us to keep.

We do not sell your details, rent them out, use them for advertising, or send you marketing messages. By sending an order you agree to the uses above.

5Who we share it with

The bakery you order from. It gets your name, mobile number, address (for delivery), note, cake design and order details, so it can make and hand over your cake. Bakeries are separate businesses. Our terms require them to use your details only for your order and to keep them safe. If you choose self pickup, you get the bakery’s address and map pin once it accepts.
Message Central, our SMS provider. It gets your mobile number to send and check the verification code.
Resend, our email provider, if you sign in with an email address. It gets your email address and the sign-in code to send you.
Google, if you tap “Continue with Google”. Google signs you in and tells us your Google account ID, name and email address. When the sign-in screen shows the Google button, your browser loads it from Google, so Google can see your IP address and browser details. Google’s own privacy policy covers what Google does.
Supabase, which stores our database, and Vercel, which hosts the website and runs our server. Your order details are held there. They may keep data on servers outside India.
Google Fonts. When CakeBabu opens, your browser loads its fonts from Google, so Google can see your IP address and browser details, as on most websites that use Google Fonts. If you tap “Open in Maps”, Google Maps opens in a new tab.
OpenStreetMap. When you type an address, your browser sends what you type to Photon, a map search run by komoot on OpenStreetMap data, to suggest places and to check that the address is a real place. If Photon can’t be reached, it asks OpenStreetMap’s own search once instead. To name your area when you share your location (such as “Hatigaon”), our server asks OpenStreetMap’s Nominatim service, and if that doesn’t answer, your browser asks OpenStreetMap or BigDataCloud. These services see your IP address. We do not save any of it.
Your UPI app and bank, when you pay. That happens between you and the bakery. We are not part of it.
Authorities, only if the law requires it, such as a court order.

If CakeBabu were ever sold or merged with another business, your details would move with it, and this policy would keep applying.

6Payments

You pay the bakery directly by UPI. CakeBabu does not take, hold or see your money. We never ask for your UPI PIN, card number or bank login. Your UPI app and bank handle the payment under their own policies.

The bakery’s UPI ID is shown to you only after the bakery accepts your order, so you can pay it. If we add online payment through a payment gateway such as Razorpay, we will update this policy before it starts.

7How long we keep it

Order records (name, number, address, design): as long as they are needed for the order, refunds, disputes and the records the law asks us to keep. After that we delete them or remove the personal details.
Your account and what is saved in it: until you delete it, or ask us to.
SMS and email code records, and IP addresses: about a day.
Verified-number cookie: up to 90 days. Account cookie: up to 180 days, or until you sign out.
What is saved on your device: until you clear it.

8Your rights, and how to delete your data

To delete your account

If you made an account, you can delete it yourself any time: tap the profile button at the top right of CakeBabu, then Delete account. Your saved designs, addresses, badges, name and sign-in details are deleted straight away.

Your past orders stay with the bakeries for their records, no longer linked to an account. To have your name, number and address removed from them too, follow “To delete your data” below.

Your other details are tied to your mobile number and your orders. You can ask us to:

tell you what we hold about you and who we shared it with;
correct or complete it;
delete it;
stop using it, if you had agreed to its use and now want to withdraw that;
deal with it through a person you name, if you cannot yourself.

To delete your data

Email our contact email (being set up) with the subject “Delete my CakeBabu data”.
Write the mobile number you used, and the order numbers if you have them (they look like CB-7K2Q9X).
We may send an SMS code to that number to check the request is yours. This stops anyone else from deleting or reading your data.

We reply within 2 days and finish within 30 days. We then delete your name, mobile number, address and notes from our records, or make them anonymous. We pass the request on to the bakeries you ordered from, so they can delete theirs.

We may keep what the law requires, such as the record of a paid order for accounts and tax, or what we need to settle a dispute that is still open. We will tell you what we kept and why. If an order is still being made, we finish or cancel it first.

You can also clear what is saved on your device yourself, in your browser settings or by removing the app.

9How we protect it

Connections to CakeBabu use HTTPS.
Sign-in cookies are signed, and JavaScript cannot read them.
Bakery PINs are stored only in scrambled (hashed) form. We do not keep SMS or email codes in readable form. A code works once and expires in 10 minutes.
With Google sign-in, we check Google’s signature on what Google sends, so nobody can pretend to be Google.
An order can be opened only by you (through the private key on your device, or by being signed in to the account it is in) and by the bakery that received it.
There are limits on guessing codes and PINs, and on how many codes can be requested.

No online service is perfectly secure. If a breach affects your details, we will tell you and the authorities as the law requires.

10If you run a bakery on CakeBabu

We hold your bakery’s name, address, map location, UPI ID, menu and prices, and your login PIN in scrambled form.

Customers see your name, area, menu, rating and distance. They see your UPI ID only on an order you accepted. They see your street address and exact map pin only if they chose self pickup and you accepted. As a bakery you must use customers’ details only for their order and keep them safe. The Terms of Use, section “If you’re a bakery”, has the rules.

11Children

CakeBabu is meant for adults. If you are under 18, ask a parent or guardian to place orders with you. We do not knowingly collect details of children. If you think a child has given us theirs, email us and we will delete them.

12Changes to this policy

When something changes, we update this page and the date at the top. If a change affects how we use your details in a big way, we tell you in CakeBabu before it starts.

13Questions and complaints

Grievance Officer: Anubhav Kalita, CakeBabu, Guwahati, Assam, India.
Email: our contact email (being set up).

We acknowledge a complaint within 48 hours and resolve it within one month. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

In short