The short version
CurryCook runs this site and the kitchen behind it at 25958 South Knollwood, Chesterfield, MI 48051. To take an order and get food to your door, we need a few details about you. This page explains which ones, why, and what you can ask us to do with them.
- We collect what an order needs: a name, a way to contact you, and somewhere to deliver to.
- We don’t sell your personal information, and we don’t share it for advertising.
- We never see your card details. We take cash on delivery only, so there’s no payment data to lose.
- We run no advertising trackers and no third-party analytics on this site.
What we collect and why
Everything we hold about you falls into one of four buckets:
| Category | What it includes | Why we need it | How long we keep it |
|---|---|---|---|
| Account details | Name, email address, password (stored only as an argon2 hash), and optionally a phone number, address and profile picture | To create your account, sign you in and pre-fill checkout | Until you ask us to close your account |
| Order details | Delivery name, phone number, address, delivery instructions, the items ordered, the total and the payment method | To cook, deliver and account for your order | 7 years, for tax and accounting records |
| Contact messages | Your name, email and whatever you write to us | To answer you | 2 years from the last message |
| Technical logs | IP address, browser type and timestamps of requests to our servers | Security, rate limiting and diagnosing faults | Up to 90 days |
Your cart lives in your own browser until you check out, so we don’t see what you’re considering, only what you order. See our Cookie Policy for how that works.
How we use your information
We use what we collect to:
- take, prepare and deliver your order, and take payment at the door;
- contact you about an order in progress, such as a substitution, a delay, or a driver who can’t find the address;
- keep your order history available to you in My Orders;
- answer your questions and handle refunds or complaints;
- keep the accounting records we’re required to keep as a business in Michigan;
- protect the site and our customers by spotting fraudulent orders, limiting repeated failed logins, and investigating abuse.
We don’t use your information to build advertising profiles, and we don’t make automated decisions about you that have a legal or similarly significant effect.
Marketing emails
We only send you email about the running of your order: a confirmation, a problem, an answer to a question you asked. If we ever start sending offers or news, it will be because you opted in, and every one of those emails will have a one-click unsubscribe. Unsubscribing never affects your ability to order.
Payment information
We accept cash on delivery only. This site has no card form, no payment processor, and no stored card numbers, expiry dates or security codes. We couldn’t leak them because we never hold them. If we add card payments in future, we’ll use a PCI-compliant processor that handles card data directly, and we’ll update this page before it goes live.
How we protect it
On this site today:
- Passwords are hashed with argon2 before storage. Nobody at CurryCook can read your password, including us.
- Traffic between your browser and our servers is encrypted in transit.
- Sign-in sessions are held in a signed, HTTP-only cookie that JavaScript on the page can’t read, and they expire after 30 days.
- Repeated failed logins for an account are rate limited, which blunts password-guessing attacks without locking out other people on your network.
- Admin tools are behind a separate role check, so staff access is limited to staff accounts.
No system is perfectly secure. If a breach ever affects your personal information, we’ll notify you and the relevant authorities as the law requires, and tell you what happened.
Your choices and rights
Whatever state you’re in, you can ask us to:
- Show you what we hold, as a copy of your account and order data.
- Correct it. You can edit most of it yourself under Account Settings.
- Delete your account. We close it and remove your profile. We keep the minimum order records tax law requires us to keep, and nothing more.
- Stop marketing email, instantly, and without affecting your orders.
Depending on where you live, you may have additional rights, for example under the California Consumer Privacy Act. Those include the right to know what’s collected, to have it deleted, to correct it, and not to be discriminated against for exercising any of them. We extend all of the above to every customer regardless of state.
To make a request, email contact@currycook.com from the address on your account, or send us a message. We’ll respond within 45 days and won’t charge you for a reasonable request. We may need to confirm it’s really you before acting.
Children’s privacy
This site isn’t for children. You must be 18 or older to open an account, and we don’t knowingly collect personal information from anyone under 13. If you believe a child has given us their details, contact us and we’ll delete the account and the data.
Where your information is held
We’re a single-location restaurant serving Chesterfield, MI, and your information is stored on servers in the United States. We don’t routinely transfer customer data outside the US. If that ever changes, we’ll say so here first.
Changes to this policy
We’ll update this page when what we do with your information changes: a new payment method, a new delivery partner, a new legal requirement. The date at the top always reflects the current version. If a change materially affects your rights, we’ll tell you directly rather than relying on you to check back.
How to reach us about privacy
Questions, requests or complaints about how we handle your information go to:
- Email: contact@currycook.com
- Phone: (123) 456-7890
- Post: CurryCook, 25958 South Knollwood, Chesterfield, MI 48051
If we can’t resolve something to your satisfaction, you can raise it with the Michigan Attorney General’s Consumer Protection team or the Federal Trade Commission.