Privacy Policy

1. Introduction

KB2 (“we”, “us”, or “our”) operates the website kb2.in, including its online store, restaurant, and catering services. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the choices you have. By creating an account or placing an order, you consent to the practices described here.

2. Data We Collect

2.1 Account Registration

When you create an account, we collect your full name, email address, and a password. Your password is hashed by our authentication provider (Supabase) and is never stored in readable form.

2.2 Profile Information

You may optionally add a phone number to your profile for delivery contact purposes. You can update or remove this at any time from your account settings.

2.3 Shipping Addresses

When you save an address or place an order, we collect the recipient’s name, phone number, address line, city, state, and pincode. This is used to deliver your order and calculate applicable taxes (CGST/SGST or IGST). Your pincode is also sent to the Indian Government Postal API (api.postalpincode.in) to auto-fill city and state information.

2.4 Payment Information

We do not collect or store your card number, CVV, UPI PIN, or netbanking credentials. All payment instrument data is collected directly by our payment gateway, Razorpay, within their PCI-DSS compliant checkout interface. After a successful payment, we store the following metadata returned by Razorpay: payment method (UPI/card/netbanking/wallet), card last four digits, card network, UPI VPA, bank name, bank reference number (RRN), and Razorpay transaction IDs. This metadata is used for order records, refunds, and dispute resolution.

2.5 Catering & Restaurant Inquiries

When you submit a catering or restaurant inquiry, we collect your name, email, phone number, and event details (date, number of guests, event type, and any message you provide). This information is used to respond to your inquiry and plan the requested service.

2.6 Product Reviews

If you submit a product review, we store your rating, review title and body, and any photos you upload (up to 3 images). Your display name (from your profile) is shown publicly alongside approved reviews. Reviews are moderated before they appear on the site.

2.7 Browsing Data

Your shopping cart contents are stored in your browser’s local storage and are not sent to our servers until you proceed to checkout. We do not use third-party analytics or tracking cookies.

3. How We Use Your Data

• To process and deliver your orders
• To send order confirmation, shipping, and refund notifications via email
• To calculate applicable GST based on your shipping state
• To respond to catering and restaurant inquiries
• To display your reviews on product pages (with your name)
• To maintain order records for tax and legal compliance
• To prevent fraud and verify payments

4. Data Sharing & Third Parties

We share data with the following third-party service providers only as necessary to operate our business:

• Razorpay — Payment processing. Your name, email, and phone are pre-filled into the Razorpay checkout form. Razorpay collects and processes your payment instrument data independently under their own privacy policy.
• Supabase — Authentication and database hosting. Your email and hashed password are managed by Supabase Auth.
• Indian Postal API — Pincode lookup to auto-fill city and state. Only your pincode is sent.
• SMTP Email Provider — Transactional emails (order confirmations, refund notifications). Your email address and order details are sent to deliver these emails.

We do not sell, rent, or trade your personal data to any third party.

5. Data Security

All data is stored in a Supabase PostgreSQL database with Row Level Security enabled, meaning you can only access and modify your own data. Passwords are hashed using bcrypt. Payment instrument data never touches our servers. Access to admin functions is restricted to authorized personnel.

6. Data Retention

We retain your account data for as long as your account is active. Order records (including payment metadata) are retained indefinitely for tax and legal record-keeping. Saved addresses, favorites, and reviews are retained until you delete them. Catering and restaurant inquiries are retained for business records.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or outdated information
• Delete your saved addresses, favorites, and reviews
• Request deletion of your account (order records may be retained for legal compliance)
• Withdraw consent for data processing (by contacting us)

To exercise any of these rights, please contact us using the information provided on our Contact page.

8. Children’s Privacy

Our services are not directed to children under 18. We do not knowingly collect personal data from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a new effective date.

10. Contact

If you have questions about this Privacy Policy or your personal data, please reach out via the Contact page on our website.