What we know about you, and why.

crumbor.in is run by Crumbor, 180/A1, Mount Pleasant Road, Udhagamandalam (Ooty), The Nilgiris, Tamil Nadu 643001. We decide how the personal data you give this site is used, which makes us responsible for it under India's Digital Personal Data Protection Act, 2023. You can reach us at hello@crumbor.in.

When you place an order

• Your name, email address and mobile number.
• The delivery address and pincode.
• If the box is a gift: the recipient's name and mobile number, and your note to them.
• What you ordered, what you paid, and how the order went — baked, shipped, delivered, or refunded.
• Razorpay's reference for your payment, so we can match it to your order and refund it if we need to.

When you check a pincode we look it up to tell you whether we deliver there. The lookup itself is not stored.

Automatically

• Your IP address when you place an order, counted to stop anyone placing dozens of orders at once. We hold cookies for an order before it is paid, so an unlimited order button would let one person tie up a whole bake.
• If something breaks, a technical error report: the page, your browser and device type, and what failed. These reports are set up to leave out your name, email, address and anything you typed.
• Basic request logs kept by our hosting provider — IP address, the page requested, and when — to keep the site running and secure.

When you write to us

Your message and the address it came from.

Shopping on Crumbor sets no cookies of ours — no analytics, advertising or tracking cookies. The box you are building and your cart are saved in your browser's local storage, on your own device, so they survive a refresh. They reach us only when you place an order, and the cart empties once you have. Clearing this site's data in your browser removes them.

When you pay, Razorpay's payment window loads from Razorpay and may use its own cookies to process and secure the payment, under Razorpay's privacy policy. The only cookie Crumbor itself sets is a sign-in cookie for our own staff on the kitchen's admin pages.

• To bake, pack and ship your order, with the recipient's name and address on the parcel.
• To email you about that order: the confirmation, the shipping notice with the courier's docket number, and anything that changes — a cancelled bake, or a checkout that did not complete.
• To take payments and make refunds.
• To answer you when you write, and to settle a complaint or dispute.
• To keep the shop secure and working: preventing abuse, and finding and fixing errors.
• To keep the business records Indian tax and accounting law requires.

You give us these details to place an order, and we use them for that order and the legal obligations that come with it — nothing else. Emails about a live order are not optional, because they carry your tracking link and your cancellation deadline.

We do not send marketing email. If we ever do — a note that a bake is about to close, say — it will go only to people who asked for it, with a working unsubscribe, and unsubscribing will never stop the emails about an order you have placed.

The recipient's name, mobile number and address are used only to deliver that box. They go on the parcel and to the courier, who may call the number to find the door. We do not email or message the recipient ourselves, and nothing in the box shows a price.

Please enter someone's details only if you are confident they would be happy to receive a parcel from you.

Only the companies that help us run the shop, and only what each one needs:

Each handles your data under its own privacy and security terms. We also disclose information when the law requires it — to a court, a tax authority, or the police acting with proper authority — or to protect customers and the business from fraud. We never sell or rent personal data, and never share it for advertising.

Our database and website run in Mumbai. Some of our providers process data outside India, including for email delivery and error reports. We use only providers that commit to protecting it, and transfer data only where Indian law allows.

• Order records — who ordered, where it went, what was in it, what was paid or refunded, and the emails about it: up to eight years from the order. That covers the period Indian tax and accounting law expects business records to be kept, and any dispute about the order. Then they are deleted.
• Messages you send us: as long as it takes to deal with them, and no longer than the order they are about.
• Anything else we hold about you, including the records that stop repeated orders: no longer than your order records.
• Error reports: deleted automatically by our error-reporting provider after a limited period.
• Your cart, in your browser: until you place the order or clear your browser's data.

You can ask us to:

• tell you what personal data we hold about you and how we have used it;
• correct anything wrong or out of date — a mistyped email, or a changed address before your bake's cutoff;
• delete it. We delete everything we are allowed to; records the law makes us keep, such as those of a paid order, we keep only for that reason and delete when the period ends;
• withdraw consent you have given;
• let someone you nominate exercise these rights for you if you die or become unable to.

Write to hello@crumbor.in from the email address you ordered with, so we know the request is really yours. We reply within 30 days. If you are not happy with the answer, take it to our grievance officer (below), and you can also complain to the Data Protection Board of India.

Every page is served over HTTPS. Your details are read and written only by our own servers, never directly from a browser, and the kitchen's admin pages are behind one-time sign-in links rather than passwords. We never receive or store card or bank details. No system is perfectly secure; if a breach ever affects your data, we will tell you and the authorities as the law requires.

Your order link is the key to your order. There is no account and no password, so anyone with the link can see the order — including the name and delivery address on it. Keep it to yourself, and forward the confirmation email only to someone you would share those details with.

Crumbor is for adults. You need to be 18 or over to place an order, and we do not knowingly collect personal data from children.

If we change how we use personal data, we will update this page and the date at the top. If a change affects orders already placed, we will tell those customers by email.

Write to hello@crumbor.in — it reaches the kitchen, and we aim to reply within one working day.

If we have not put something right, raise it with our grievance officer, Tharunniha, at hello@crumbor.in. We acknowledge every complaint within 48 hours and resolve it within one month of receiving it.

Crumbor · 180/A1, Mount Pleasant Road, Udhagamandalam (Ooty), The Nilgiris, Tamil Nadu 643001