Policies
Privacy policy
Last updated: 28 September 2026
This policy explains what personal data we collect, why, who we share it with, and your rights under India's Digital Personal Data Protection Act, 2023.
1. Who is responsible for your data
Boffo Cakes, a proprietorship of Sayona Gupta ("Boffocakes", "we"), CG-244, Salt Lake Sector II, Kolkata 700091, West Bengal, is the Data Fiduciary for the personal data described here. For anything about your data, contact Sayona Gupta (Proprietor) at boffocakes.official@gmail.com or +91 90519 18008.
This notice is also available in Bengali and Hindi. Just ask us.
2. What we collect
| What | Why |
|---|---|
| Your name, phone number and email | To take and confirm your order, send order updates and contact you about it |
| Recipient's name, phone number and delivery address | To deliver the cake |
| Order details: cake, message on the cake, date, allergy notes, photos you send us | To make your cake correctly |
| Payment status (paid / unpaid) | To confirm your order. Card, UPI and bank details are handled by our payment partner; we never see or store them. |
| Messages you send us on WhatsApp | To answer you and handle your order |
| How you use our website: how you arrived (for example Google or Instagram), pages and cakes viewed, searches, whether an order was started | To understand what people look for and improve the site. This is tied to a visit code that disappears when you close the tab, and no name, phone number or IP address is stored with it. If you place an order during that visit, we link how you found us and what you viewed to your order. |
| Your answer to "How did you find us?", if you choose to give one | To know which ways of reaching people work |
| Whether you've agreed to offers and reminders, and when | So we only send them to people who agreed, and can show that you did |
| Only if you accept cookies: a random device code stored on your device for 12 months, and cookies from Google Analytics and Microsoft Clarity | The device code lets us recognise your device when you come back, so we can see how you first found us and how many different people visit. It contains no name or number. Google Analytics and Microsoft Clarity give visit statistics and show where the site is confusing. If you place an order, your device's earlier visits are linked to it. You can change this any time in Cookie settings; if you withdraw, the device code is removed. |
3. Why we're allowed to use it
When you place an order or send us a message, you give us your details for that purpose, and we use them only for it (a legitimate use under the DPDP Act). We do not use your details for marketing just because you ordered. For anything optional (offers and reminders, analytics cookies) we ask for your consent, and you can withdraw it at any time, as easily as you gave it.
4. Who we share it with
We don't sell your data. We share only what's needed with:
- Delivery partners: recipient's name, phone number and address, to deliver your order.
- Our payment partner: to process online payments.
- Meta (WhatsApp): when we message you on WhatsApp.
- Service providers who run our systems: website hosting, our order database, image hosting, and (only if you accept cookies) Google Analytics and Microsoft Clarity.
- Government authorities, where the law requires it.
Some of these providers may store data on servers outside India, as allowed under the DPDP Act.
5. Marketing messages: only with your consent
- Order updates (confirmation, delivery, review request) are part of your order and are always sent.
- Offers, new designs and celebration reminders (for example a reminder before a birthday you ordered for last year) are sent only if you ticked the box to receive them when ordering, or agreed on WhatsApp. We record when you agreed.
- If you ordered from us before this policy, we may send you offers and reminders, each with this notice and an easy way to stop.
- To stop: tap "Stop offers" or reply STOP on WhatsApp, or email boffocakes.official@gmail.com. We stop straight away and won't message you offers again unless you ask us to. Your orders aren't affected.
6. Photos of cakes
We photograph cakes we make and may share them on our website and social media. A name or message written on the cake may sometimes be visible. We never share photos of people (such as photos printed on a cake) or anything that identifies someone without consent. Tell us if you'd rather we don't share your cake at all.
7. How long we keep it
- Order records: as long as tax and accounting laws require us to keep them.
- Your contact details for offers and reminders: until you withdraw consent or ask us to delete them.
- Anonymous website usage: kept in anonymous form only.
8. Your rights
Under the DPDP Act you can:
- ask for a summary of the personal data we hold about you and who we've shared it with;
- ask us to correct, complete or update it;
- ask us to delete it (we may keep what the law requires us to keep);
- withdraw consent you've given, as easily as you gave it;
- nominate someone to exercise these rights for you if you can't;
- raise a complaint with us, and if you're not satisfied, with the Data Protection Board of India.
To use any of these rights, write to boffocakes.official@gmail.com or WhatsApp +91 70444 14447. We reply within 7 days and aim to resolve every request within 30 days.
9. Children
Orders must be placed by adults. We don't knowingly collect personal data from children. Names and ages written on cakes come from the person placing the order.
10. Keeping it safe
Your data is stored in access-controlled systems. Only the people who need it to handle your order can see it. If a data breach affects your personal data, we will inform you and the Data Protection Board of India as the law requires.
11. Changes
If we change this policy, we'll update the date at the top of this page.