We are a restaurant, not an advertising business. We ask for the few things needed to cook your food and bring it to you, and nothing else.
We do not sell your information, we do not share it with advertisers, and there are no tracking or analytics scripts on this website.
Who we are
Goreto, a restaurant at Siliguri, West Bengal, India, operating the website at goreto.in. In this policy “we” and “us” mean Goreto, and “you” means anyone using the site.
What we collect
When you sign in
Signing in is handled by Google. We never see or store your Google password. What Google passes to us is your name, your email address and your profile picture, and we keep the name and email so we can recognise you on your next visit and attach your orders to you.
When you place an order
- The name and phone number you type, so the kitchen and the rider can reach you
- Your delivery address, when you choose delivery rather than pickup
- An optional map pin of where you are, only if you tap the button asking for it and then allow your browser’s location prompt. It is genuinely optional — addresses in Siliguri are often hard to find, and a pin saves a phone call. Refusing it does not stop your order.
- The dishes, quantities and total, and the times the order changed status
When you book a table
Your name, phone number, the date and time you want, how many people are coming, and any note you add.
What we never collect
No payment details of any kind. Goreto is pay-on-delivery, so there is no card number, no UPI handle and no bank information anywhere on this site — there is nothing of that sort for anyone to steal from us.
What your browser stores
A few things are kept on your own device rather than sent to us. They stay in your browser and clearing your browser data removes them:
- Your cart, so it survives if you close the tab mid-order
- Your phone and address from your last order, so you do not retype them
- Your sign-in session, so you are not asked to sign in on every visit
We set no advertising cookies and run no analytics, so there is no cookie banner on this site. There is nothing to consent to.
Why we are allowed to hold it
Because you asked us to do something that requires it. We cannot deliver food to an address we do not have, and we cannot hold a table for a name we do not know. We keep the record of a completed order because both of us may need it later if something went wrong with it.
Who can see it
- Our kitchen and counter staff, to cook and pack the order
- The rider assigned to your delivery, who is shown your name, phone, address and pin — and only for the orders given to them, not for anyone else’s
- Supabase, the company whose servers hold our database. They store it on our behalf and do not use it for anything of their own.
- Google, which handles the sign-in itself and therefore knows you signed in to Goreto
That is the whole list. We do not sell your information, rent it, trade it, or hand it to advertisers or data brokers. We would disclose it if a court or the police lawfully required us to, and not otherwise.
Our database is hosted outside India, so your information is stored and processed abroad.
How long we keep it
- Orders and bookings: up to two years, then deleted
- Your account: until you ask us to remove it
- Location pins: deleted with the order they belong to
How it is protected
The site is served over HTTPS. The rules deciding who may read which row are enforced by the database itself, not merely by the screens you see — a rider cannot read another rider’s deliveries, and one customer cannot read another’s orders, even if they went looking. Back-office access is limited to staff accounts we add by hand.
No system is perfect, and we will not pretend otherwise. If we ever discover a breach affecting you, we will tell you.
What you can ask for
Write to us and we will do any of the following, free of charge:
- Tell you everything we hold about you
- Correct anything that is wrong
- Delete your account and your order history
- Send you a copy of your data in a readable file
We will reply within 30 days. To delete your account, email us from the address you signed in with, or message the WhatsApp number below.
Children
This site is not aimed at children under 13, and we do not knowingly keep their information. If a child has given us something, tell us and we will remove it.
Changes
If we change this policy we will change the date at the top. If a change matters — a new recipient of your data, say — we will say so plainly on the site rather than quietly editing this page.