← Back to Lahori.SG

Privacy Policy

Last updated: 6 July 2026

This policy describes how Lahori.SG collects, uses, stores and protects your personal data when you visit our website, place an order or interact with us through WhatsApp. We are committed to handling your information responsibly and in accordance with Singapore's Personal Data Protection Act 2012 (PDPA).

1. Information We Collect

1.1 Information you provide at checkout

When you place an order through our website, we collect the following personal data through the checkout form:

• Full name — used to identify your order and personalise delivery.
• Phone number — used for order confirmation via WhatsApp, delivery coordination, and to detect returning customers. Phone numbers are normalised to the last eight digits for matching purposes.
• Delivery address, unit number and postal code — used to calculate your delivery fee and dispatch your order. Address entry is assisted by the Google Maps Places Autocomplete service, which means the text you type into the address field is transmitted to Google in real time to generate suggestions.
• Preferred delivery date and time — used to schedule your order.
• Order items and quantities — used to prepare and fulfil your order.
• Email address — if provided, used to send you an order confirmation email.
• Referral source (optional) — if you choose to tell us how you heard about us, this information helps us understand which channels bring customers to our kitchen. Answering is entirely voluntary and does not affect your order.
• Special instructions — any notes you add about spice level, dietary requirements or delivery instructions.

1.2 Information collected automatically when you visit

When you browse lahori.sg, certain technical data is collected automatically by our website and the third-party services it loads. You do not need to place an order for this collection to occur.

• Browser local storage — we store a small amount of data in your browser's local storage to remember your cart contents between page visits, cache current menu stock levels, and recognise you as a returning customer if you have previously placed an order (using a session record that contains your name and phone number). This data stays in your browser and is not transmitted to our servers unless you proceed to checkout. You can clear this data at any time via your browser settings.
• Session storage — we may use your browser's session storage for temporary flags (for example, to remember that you have acknowledged our pre-order notice during the current browsing session). Session storage is automatically cleared when you close the browser tab.
• Device and browser information — standard HTTP data including your IP address, browser type, operating system and referring URL is received by our web server and content delivery network as part of normal web traffic.

1.3 Information we do not collect

We do not collect payment card numbers, bank account details or any financial credentials. Payment is handled entirely through PayNow (Singapore's interbank transfer system) outside our website. We do not operate user accounts, so we do not store passwords or login credentials.

2. Third-Party Services

Our website uses several third-party services that may collect data about your visit. Each service operates under its own privacy policy. We load these services only on our live website (lahori.sg) and they are automatically disabled on our internal testing environments.

Service	Provider	Purpose	Data involved
Meta Pixel	Meta Platforms, Inc.	Measures the effectiveness of our Instagram and Facebook advertisements by tracking page views, cart additions and completed purchases.	Page URL, browser information, IP address, event type (e.g. PageView, Purchase). A cookie may be set by Meta in your browser.
Meta Conversions API	Meta Platforms, Inc.	Sends purchase events to Meta from our server (rather than your browser) to improve advertising measurement accuracy.	Hashed email address, hashed phone number, order value, event identifier. Raw personal data is cryptographically hashed before transmission so that Meta cannot read it in plain text.
Google Ads & GA4	Google LLC	Tracks ad conversions and provides basic website analytics so we can understand which advertising brings customers to our site.	Page URL, browser information, IP address, conversion events and their value. Cookies may be set by Google in your browser.
Microsoft Clarity	Microsoft Corporation	Records anonymised session replays, heatmaps and click data so we can identify usability problems on our website and improve the ordering experience.	Mouse movements, clicks, scroll behaviour, page content, browser information, IP address. Clarity masks sensitive input fields by default.
Jeeva AI	Jeeva AI, Inc.	Provides an on-site engagement assistant.	Page URL, browser information, interactions with the assistant widget.
Google Maps Platform	Google LLC	Powers the address autocomplete field in our checkout form so you can quickly find your delivery address.	The text you type into the address field is sent to Google to retrieve address suggestions. Google's standard terms apply.
Google Fonts	Google LLC	Delivers the typefaces (Poppins, Playfair Display, Noto Naskh Arabic) used on our website for consistent, readable text.	Your IP address and browser information are sent to Google's font servers when the fonts are loaded.
Bunny CDN & Bunny Stream	BunnyWay d.o.o.	Delivers menu images and product videos quickly from servers closer to you, improving page load speed.	Standard CDN access logs: IP address, browser information, files requested. No personal data is shared by us with Bunny.

You can limit or block many of these services using browser privacy settings, ad-blocking extensions (such as uBlock Origin) or by enabling your browser's "Do Not Track" signal. Blocking analytics services will not affect your ability to browse our menu or place an order.

3. How We Use Your Data

We use the personal data described above for the following purposes:

• Order fulfilment — to prepare your food, calculate your delivery fee, dispatch your order to the correct address, and send you a confirmation email.
• Delivery coordination — your name, phone number and delivery address are shared with our delivery rider via an internal notification channel (Telegram) so they can complete the delivery. The rider sees only the information needed for that specific delivery.
• Order confirmation — your order details are sent via WhatsApp to our restaurant line and, if you provided an email address, by email to you via our email delivery provider (Mailgun, operated by Sinch).
• Returning-customer recognition — we use your phone number (last eight digits) to detect whether you have ordered before, which may entitle you to returning-customer pricing or promotions in the future.
• Advertising measurement — purchase events (with hashed personal data) are sent to Meta and Google so we can measure whether our advertisements are effective. This helps us spend our advertising budget wisely and keep food prices fair.
• Website improvement — session recordings and analytics data help us find and fix usability issues, such as checkout bugs or confusing navigation, so that your next visit is smoother.
• Internal record-keeping — your order history is stored in our database for business operations including revenue tracking, stock management and kitchen planning.
• Contact management — your name and phone number may be added to our business contact list (via Google Contacts) to support order-related communication. We do not use this contact information for marketing outreach.

We do not sell, rent or trade your personal data to any third party. We do not use your contact information for unsolicited marketing messages, promotional emails or reactivation campaigns. Our principle is simple: we use your data to make your food and deliver it, measure whether our ads work, and fix our website — nothing more.

4. Cookies and Tracking Technologies

Lahori.SG itself does not set cookies. However, the third-party services loaded on our site (Meta Pixel, Google Ads, Google Analytics, Microsoft Clarity) may place their own cookies in your browser to track advertising effectiveness and website usage across sessions. These are known as third-party cookies.

In addition to cookies, we use your browser's local storage and session storage as described in Section 1.2. Unlike cookies, local storage data is not automatically sent with every HTTP request to our server — it remains in your browser until you clear it or until our website code reads it during checkout.

You can manage cookies and local storage through your browser's privacy settings. Most modern browsers allow you to block third-party cookies without affecting website functionality, clear local storage for specific websites, and use private or incognito browsing mode to prevent any persistent storage.

5. Data Storage and Security

5.1 Where your data is stored

Your order data is stored in Google Firebase (Realtime Database), which is hosted on Google Cloud infrastructure. A synchronised copy of order records is maintained on our web server (hosted by GoDaddy / cPanel shared hosting) for operational use by our admin dashboard. Transactional emails are processed through Mailgun (Sinch), which operates servers in the United States and European Union.

5.2 How we protect your data

We take reasonable measures to protect your personal data, including serving our entire website over HTTPS (encrypted connections), restricting access to order data files on our server via access-control rules so they are not publicly accessible, using server-side processing for sensitive operations such as advertising conversions (tokens and API keys are never exposed in your browser), and hashing personal data (email and phone number) before sending it to advertising platforms.

5.3 Data retention

Order records are retained indefinitely for business accounting and tax purposes. We do not currently offer an automated data-deletion mechanism. If you would like your personal data removed from our records, please contact us (see Section 9) and we will process your request within a reasonable timeframe, subject to any legal obligations that require us to retain certain records.

6. Data Shared with Third Parties

We share personal data with third parties only where necessary to fulfil your order or operate our business. The following table summarises what is shared and why:

Recipient	Data shared	Purpose
Meta (Facebook / Instagram)	Hashed email, hashed phone, order value, event ID	Advertising measurement and deduplication
Google (Ads / GA4)	Conversion value, page events	Advertising measurement
Microsoft (Clarity)	Session recordings, clicks, scroll data	Website usability analysis
Mailgun (Sinch)	Customer email, name, order summary	Sending order confirmation emails
Google (Firebase)	Full order record (name, phone, address, items)	Order data storage
Google (People API / Contacts)	Customer name, phone number	Business contact management
Delivery rider (via Telegram)	Customer name, delivery address, order items	Completing your delivery

We do not share your data with data brokers, do not participate in advertising data exchanges, and do not allow third parties to use your data for purposes unrelated to the services described above.

7. Your Rights Under the PDPA

Under Singapore's Personal Data Protection Act 2012, you have the following rights in relation to the personal data we hold about you:

• Access — you may request a copy of the personal data we hold about you.
• Correction — you may ask us to correct any personal data that is inaccurate or incomplete.
• Withdrawal of consent — you may withdraw your consent for us to collect, use or disclose your personal data. Please note that withdrawing consent for essential order-processing data will mean we cannot fulfil future orders for you.
• Deletion — you may request that we delete your personal data, subject to any legal or business obligations that require us to retain certain records (for example, tax and accounting requirements).

To exercise any of these rights, please contact us using the details in Section 9. We will respond to your request within 30 days.

8. Children's Privacy

Our website and ordering service are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data through our checkout process, please contact us and we will promptly delete the information.

9. Contact Us

If you have any questions about this privacy policy, wish to exercise your data-protection rights, or have concerns about how your personal data is handled, please reach out to us:

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Your continued use of our website after any changes constitutes acceptance of the updated policy.

© 2026 Fusion Food LLP — Lahori Desi Delivery Kitchen — Singapore