Privacy

Who this is about

This site and shop are run by NIRORN, Cambodia. When this document says “we”, it means the house. When it says “you”, it means anyone reading the site, buying from it, or scanning the code on a jar.

What we collect

• Your email address, when you sign in, place an order, or subscribe to the newsletter. Signing in sends a one-time code to that address; the code works once and expires.
• Your name, delivery address and phone number, when you place an order — because a parcel needs somewhere to go.
• What you ordered, and when. This is the record of a sale, and we keep it.
• What you write to us, when you use the contact form, the chef inquiry, or a “report a problem” link.

What we do not collect

We do not run advertising trackers, and we do not sell or trade anyone's details to anybody, ever.

We never see your card. Payment is taken by ABA PayWay or by Stripe on their own pages, and the card number is never sent to us or stored by us. We are told only whether the payment succeeded.

We do not sell, rent, or trade anyone's details. There is no circumstance in which we would.

How we count visits

We use Google Analytics to see which pages are read and which are not. It is set to record the page, the language it was read in, roughly where in the world the browser is, and a few things the site itself reports — a recipe opened, a jar's code scanned, something added to a basket.

It does not receive your name, your email address, your order, or anything you type into a form. It sets its own cookies in your browser to tell one visit from the next.

Cookies, and what the browser keeps

• A session cookie once you sign in, so the site knows it is still you. Signing out clears it.
• A short-lived cookie during sign-in with Google or Apple, which exists only to carry you back from their page to ours.
• Your basket, kept in your own browser's storage — on your device, not on our servers, until you check out.
• Google Analytics' own cookies, which tell one visit from the next. Clearing your browser's cookies clears them.

Who else touches it

Four companies handle parts of this on our behalf, and only for the purpose named:

• Mailgun sends our email — sign-in codes, order confirmations, the newsletter.
• ABA PayWay and Stripe take payment.
• SupportDock receives what you send through the contact and problem-report forms, so it reaches a person rather than an inbox nobody reads.
• Google Analytics counts visits, as described above.

How long we keep it

Order records are kept as long as the law asks a business to keep its books. A newsletter subscription is kept until you unsubscribe, which every letter has a link for. A sign-in code lasts ten minutes and is then useless.

What you can ask for

A copy of what we hold about you, a correction, or deletion. Ask, and we will do it — deletion excepting the sales records a business is required to keep.

Write to us through the contact page and mark it “Privacy”.

The jar's code

Scanning the code on a jar opens a public page about that batch. It needs no account, and we do not connect that page to you.

Changes

If this changes, the date at the top changes with it. We do not quietly rewrite what was already published.