Privacy Policy

This food ordering service is operated by [CHURCH LEGAL NAME](“we,” “us,” or “our”), the church community behind Descent Of The Holy Ghost. We prepare food for scheduled pickup days and take orders through this website. This policy explains what information we collect when you use the service, how we use it, and the choices you have.

We collect only what the service needs to work:

• Account information. Your first name, last name, and email address when you create an account. We use passwordless sign-in (magic links), so we never collect or store a password.
• Optional profile details. You may add a phone number and address to your profile. Both are optional; the service works without them.
• Order information. The items you order, quantities, prices, your chosen pickup date, payment status, and order history.
• Technical information. Essential cookies that keep you signed in, and standard server logs (such as IP address and browser type) generated by our hosting provider.

We do not collect precise location data, and we do not use any analytics, advertising, or tracking services.

We use your information to:

• Create and manage your account and sign you in.
• Process your orders, take payment, and prepare your food for pickup.
• Send transactional emails only: sign-in magic links, and payment receipts sent by our payment processor. We do not send marketing email, and we will not add you to any mailing list without your separate consent.
• Contact you about a specific order if something changes (for example, a cancelled pickup day).

We do not sell your personal information, and we do not share it with anyone except the service providers described below.

Card payments are handled entirely by Stripe. When you check out, you are taken to Stripe’s secure payment page. Your card number never touches our servers and we never see or store it — we receive only confirmation that payment succeeded, the amount, and a reference we use to issue refunds. Stripe’s handling of your payment details is governed by Stripe’s own privacy policy.

If we offer Zelle as a payment option, your Zelle transfer is handled by your bank and Zelle; we see only the payment confirmation, not your banking details.

We use a small number of providers to run the service. Each receives only the information needed to do its job:

• Supabase — hosts our database and handles sign-in (your account, profile, and order data).
• Stripe — processes card payments and issues receipts and refunds.
• Vercel — hosts the website and generates standard server logs.
• Email delivery provider — delivers our sign-in magic-link emails to your address.

We use only essential cookies — the ones that keep you signed in. There are no advertising, analytics, or third-party tracking cookies, which is why you won’t see a cookie consent banner here.

Your shopping cart is stored in your own browser’s local storage, not on our servers, until you place an order.

We keep your account and profile information for as long as your account is active. If you ask us to delete your account, we delete your profile and sign-in data, but we retain records of completed orders and payments for as long as bookkeeping, tax, and financial-reporting obligations require.

Orders that are never paid are automatically cancelled after 24 hours.

We protect your information with industry-standard measures: all traffic is encrypted in transit (HTTPS), database access is restricted so that each account can only read its own data, and payment card details are never stored on our systems.

No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you and the relevant authorities as required by applicable state law.

We extend these rights to everyone who uses the service, regardless of where you live:

• Access. Ask us for a copy of the personal information we hold about you.
• Correction. Update your name, phone, and address anytime on your profile page, or ask us to correct anything else.
• Deletion. Email us at [CONTACT EMAIL] and we will delete your account and personal information within 30 days, subject to the retention of order records described above.

Because this is a small, US-only community service, regulations such as the EU’s GDPR and California’s CCPA generally do not apply to it. We honor the rights above for all users anyway.

The service is not directed at children under 13, and we do not knowingly collect personal information from them. You must be 18 or older to create an account and place orders. If you believe a child has provided us personal information, contact us and we will delete it.

The service is offered only within the United States, and your information is stored on servers located in the United States.

If we change this policy, we will update the effective date at the top of this page. For significant changes, we will also let you know by email or with a notice on the site before the change takes effect.

Questions about this policy or your information? Email us at [CONTACT EMAIL].