Data & privacy

regional-privacy-2026-11-13-v1 · 13 November 2026

The operational marketplace stores authenticated account records on its server. It does not import the fictional records or local accounts from the separate review website. Public registration and payments are not open.

Information used

When account access is enabled, contact verification, names, addresses, cooking preferences and consent records support account and order functions. Kitchen applications include contact details, a location pin and privately uploaded eligibility evidence. Do not include medical histories, card numbers, CVV, UPI PINs, bank passwords or unnecessary identity information in free-text fields or uploads.

Access and storage

Hostinger hosts the operational service and its dedicated database. Your authenticated session uses an HttpOnly cookie lasting up to 14 days; signing out removes that session. Profile data is scoped to the signed-in account and selected country. Kitchen eligibility documents are accessible only to that kitchen's account and the platform owner. The database records changes and operational events. The owner must complete the operator identity, retention schedule and country-specific privacy disclosures before opening public registration.

Contact verification and payments

Email verification uses the configured mailbox provider. If mobile verification is enabled, Twilio Verify receives the mobile number and code verification request. These services are currently awaiting configuration. Payment-provider connections are not active; this portal cannot collect money, register a reusable payment mandate or make host payouts.

Maps and location

Map tiles are supplied by OpenStreetMap infrastructure. Tile requests disclose the map area being viewed and ordinary connection information. A kitchen or recipient pin is selected by a deliberate map click or the optional location button. Device location requires browser permission. Precise kitchen details are not included in the public discovery response; authorised collection and fulfilment workflows use the necessary location/address details. Location is not used to send unsolicited invitations or marketing.

Choices and contact

You can browse without signing in and decline device-location permission. Authenticated users can correct their account details and sign out on a shared device. Changing a profile does not rewrite historical order snapshots. Contact info@bay-leaf.eu about access, correction, deletion or privacy questions. Server records cannot be deleted by clearing browser storage. Public launch requires the responsible legal entities, lawful processing arrangements, retention periods and applicable rights procedures to be identified and reviewed.