Privacy policy.

Indian Oven is a restaurant at Shop 8, Red Sails Building, 18 Main Road, Hout Bay, Cape Town, 7806. We are the responsible party for the personal information described here. Our Information Officer handles privacy questions and requests: email info@indianoven.co.za, call 010 035 2201010 035 2201 or write to us at the address above.

• Your account: your email address (you sign in with an email link, no password), first name, and, if you add them, your mobile number and birthday. Delivery orders need a mobile number so your driver can reach you.
• Your orders: what you order, prices and totals, pickup or delivery, your delivery address and map location, notes you add, payment method and payment status, and your Points and rewards.
• Your location: only when you tap “Use my current location” at checkout, and only after you allow it. The app uses it once to fill in your delivery address. It does not track you in the background.
• Bookings and enquiries: your name, mobile number, date, time, party size and any notes you send when you book a table or ask about functions or catering.
• Payments: you enter card details on Yoco’s secure payment page or on the Yoco card machine at your door. We never see or store your full card number; we receive the amount, payment status and Yoco’s reference.
• Notifications: if you allow notifications, a push token from your phone so we can send order updates.
• Messages: what you send us by WhatsApp, phone or email.
• App crash reports: if the Android app crashes, technical details about the crash: the error, the screen you were on, the app version, your phone model and Android version. They are on unless you turn them off in Profile. We don’t include names, email addresses, delivery addresses, payment details or order numbers.
• Usage analytics, only with your permission: broad information about how the website and app are used, such as pages and features opened. We don’t include names, email addresses, delivery addresses, payment details or order numbers.
• Website speed measurements: how quickly pages on this website load and respond, with the page address and general details such as your device type and browser. They use no cookies and include no names or contact details, and pages for signing in, payments and your account are left out.

• To take, prepare, deliver and support your orders and bookings, and to tell you about them (order status, “Ready for collection”, “Your driver has arrived”).
• To take payment and handle refunds or payment questions.
• To run Oven Club Rewards: Points and rewards.
• If you add your birthday, only for birthday offers, and only if you’ve opted in to news and offers.
• To keep the service secure, prevent fraud and misuse, and keep the records the law requires (for example tax records).
• To send news and offers only if you opt in. Sign-up asks you, the switch is off unless you turn it on, and you can turn it off any time in Profile.
• To find and fix app crashes from crash reports. You can turn them off in Profile.
• To improve the app and website with usage analytics, only if you allow it.
• To keep the website fast, from speed measurements.

We use your information because it is needed to provide what you asked for, to meet legal obligations, for our legitimate interests in running a safe and reliable service, or with your consent where we ask for it.

• Our team sees your order, name and contact details to prepare and hand over your food.
• Your delivery driver sees your name, delivery address, order items and notes. Your mobile number is only available to the driver while your order is on its way, and the driver can call you through the app only during that time.
• Service providers who process information for us under contract: Supabase (our database and sign-in), Yoco (payments), Google Firebase and Google Analytics (notification delivery, app crash reports and, with your permission, usage analytics), Expo (push notifications), Twilio (WhatsApp messages about bookings), Google Places, with OpenStreetMap’s Nominatim service as a backup (finding the address you type), Vercel (hosting our website, website speed measurements and, with your permission, website usage analytics) and Netlify (hosting our driver app).
• Authorities, if the law requires us to share information.

We do not sell your personal information.

Some of these providers store or process information in other countries. We only use providers that are bound by data protection laws or agreements that protect your information to a standard comparable to POPIA.

• Your account details: while your account is open. We delete them within 30 days of your request to delete your account.
• Orders and payment records: five years, because tax law requires us to keep them. After you delete your account they are no longer linked to your name and contact details.
• Booking details: 12 months after the booking date.
• Notification tokens: until you sign out, switch off notifications or the token stops working.
• Your news and offers preference: until you change it.

Information travels encrypted between your device and our systems. Access is limited to signed-in staff and drivers, each seeing only what their role needs. If we believe your personal information has been accessed without authorisation, we will tell you and the Information Regulator as POPIA requires.

You can ask us to:

• show you the personal information we hold about you;
• correct or update it (you can change your name, number, birthday and preferences in the app under Profile);
• delete it, or stop using it for a particular purpose;
• stop sending you news and offers (the switch in Profile, or tell us).

Email info@indianoven.co.za from the address on your account, and we’ll respond within 30 days. If you’re unhappy with how we handle your information, you can complain to the Information Regulator (South Africa) at inforegulator.org.za (opens in new tab).

In the app, go to Profile → Delete your account and confirm. Or email info@indianoven.co.za from the address you sign in with, with the subject “Delete my account”. Either way, we delete your account details within 30 days, and you can cancel in the app while the request is pending. Order and payment records we must keep for tax are kept separately and no longer linked to you. Step-by-step instructions are on our account deletion page.

Indian Oven’s app and online ordering are meant for adults. We don’t knowingly collect personal information from children. If you think a child has given us information, contact us and we’ll delete it.

We’ll update this page when our practices change and change the date at the top. If a change materially affects how we use your information, we’ll let you know in the app or by email before it applies.

We only use usage analytics on this website (Google Analytics and Vercel Web Analytics) if you allow it. You can change that choice here at any time. Speed measurements (Vercel Speed Insights) use no cookies and are always on. The Android app has its own switches in Profile: usage analytics is off unless you turn it on, and crash reports are on unless you turn them off.