1. Scope
This Privacy Policy explains how The Heritage Co. handles personal information when you use theheritageco.in, join the newsletter, sign in (including with Google), or place an order.
It is written to meet the spirit of the Information Technology Act, 2000, the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023, as they apply to a small Indian food kitchen.
If you use Continue with Google, also read our Google Sign-In & User Data page. That page is the product-specific disclosure Google asks for on the same domain as this site.
2. What we collect
Newsletter and contact: name if you give it, email address, and any note you send.
Orders (when checkout opens): delivery name, phone, address, meal choices, and order history.
Payments: the payment gateway collects card, UPI, or net-banking details. We receive a payment status, a reference id, and the amount — not your full card number.
Google Sign-In: if you tap Continue with Google, Google sends us your name, email address, whether that email is verified, a Google account identifier, and your Google profile photo if you have one. We ask only the openid, email, and profile scopes. We do not ask for Gmail, Drive, Calendar, Contacts, or location.
Site use: basic device and log data (browser, pages opened, approximate location from IP) to keep the site working and to understand which meals people read.
3. Why we use it
To write you when the kitchen opens, to fulfil and deliver orders, to take and refund payments, to meet tax and food-safety records, and to answer complaints.
Google user data is used only to sign you in, keep your house or kitchen session, show your name and photo on the account, and recognise the same Google account on a later visit. We do not use Google user data for advertising, resale, or unrelated AI training.
We do not sell your list to other food brands. We do not use your email for a third-party ad network.
4. Who else sees it
Hosting and email: our website host and the SMTP service that sends newsletter notices and sign-in codes to our kitchen inboxes.
Google: if you choose Google Sign-In, Google is the identity provider. Their handling of your Google account is described in Google’s Privacy Policy.
Payments: the gateway and, if you choose EMI, the bank or NBFC they use.
Delivery: a rider or partner only gets the name, phone, and address needed for that drop.
Law: we may share data if a court, tax officer, or food-safety authority lawfully asks.
We do not sell Google user data. We do not transfer information received from Google APIs to another app, except as needed to run this site (for example storing your photo on our file host so the house account can show it).
5. Cookies and analytics
We may use a necessary cookie or local storage for the basket. If Google Analytics is switched on, it helps us see aggregate visits. You can block analytics cookies in your browser.
We do not run a cross-site advertising cookie on this brand site.
6. How long we keep it
Newsletter emails stay until you ask us to remove them or we close the list.
Paid-order records are kept as long as tax, accounting, and food-traceability rules require, then deleted or archived in a reduced form.
7. Your rights
You may ask to see, correct, or delete personal data we hold, or to withdraw newsletter consent, by writing to the email on this page. We will answer within the time the law allows.
You can disconnect Google from this site in your Google Account under Apps with access to your account. You can also ask us to delete your Heritage house account.
You may complain to the Data Protection Board of India or the authority that succeeds it, after you have written to our grievance officer.
8. Children
The site is not aimed at children under 18 placing paid orders alone. We do not knowingly store a child’s data for marketing.
9. Grievance officer
For privacy or data complaints, write to the Grievance Officer at the contact email published with our company details on this legal set. We will acknowledge and work through the issue.