Legal

Privacy Policy

Last updated: October 12, 2026

This policy explains what information Diana’s Cuisine collects when you use dianascuisine.com or place an order, why we collect it, who we share it with, and the choices you have. It’s written for customers, not lawyers, so we’ve kept it in plain language. It covers the site and ordering process as actually built today, not a generic template.

Diana’s Cuisine is a home-based Nigerian food business serving Scarborough and the Greater Toronto Area by pickup and delivery only, on a preorder basis, with pickup or delivery on whichever days we currently have open. We are the “controller” of the personal information described below.

Information we collect

We collect information you give us directly when you place an order or contact us:

• Contact details: your name, phone number and email address.
• Delivery or pickup information: your delivery address and any delivery instructions, if you choose delivery.
• Gift order details: if you send a gift, the recipient’s name, phone number and address, kept separate from your own account of the order and used only to fulfil that gift.
• Order details: the dishes, sizes and add-ons you choose, your spice/pepper level preference, any allergy or dietary notes you tell us, order notes, and whether someone else will collect on your behalf.
• Payment-related information: when card payment is live, payment is processed by Stripe. We do not see or store your full card number. Stripe handles that and shares back only what we need to confirm and reconcile the order (such as a payment status and a partial card reference).
• Marketing consent: whether you’ve opted in to weekend-menu emails and/or texts. These are two separate checkboxes at checkout, off by default, and never assumed just because you placed an order.
• Messages you send us: if you contact us directly (phone, email, or a custom-order enquiry), whatever you tell us in that message.

We also collect some information automatically:

• Technical information: standard web request information (such as IP address and browser type) that our hosting provider and bot-protection service see as part of serving the site securely. We also keep a copy of this alongside a few specific records where it serves a clear security or accountability purpose: keeping your My Orders sign-in secure, protecting our sign-in process from abuse, and keeping a record of when marketing consent was given or withdrawn.
• Cart data: the items in your cart are stored in your browser’s local storage so it’s still there if you navigate around the site. This stays on your device, and we don’t receive it until you actually submit an order.
• How you found the site, and visit counts: if you arrive from somewhere like a social media link, a search engine, or one of our own campaign or influencer links, we note that (such as the referring site, or a campaign tag in the link you clicked) so we can understand what’s bringing people to the site. We also use a short-lived marker stored in your browser so that browsing several pages in one visit counts as one visit, not several. If you go on to place an order, how you found us (and, separately, what brought you back for that particular order, if different) is kept as part of that order’s own information, the same way we keep your delivery address or order notes.

We use this first-party, privacy-conscious visit and attribution measurement described above. We do not use Google Analytics, Meta Pixel, TikTok Pixel, or any similar outside analytics or advertising tool. We do not use cookies or any other method to track you across other websites, we do not build a browser or device fingerprint, and we do not try to recognize the same visitor across different devices or browsers. This measurement does not store your IP address or full browser details; that is a separate, narrower use covered above under “Technical information.” Before you place an order, none of this is tied to your name; it is only ever linked to you once you actually place an order, in the same way the rest of that order’s information is.

Why we collect it

• To fulfil your order: preparing, packaging, and getting your food to you by pickup or delivery, on the day agreed.
• To communicate with you about your order: order confirmation, your verification PIN, pickup/delivery updates, and responding if something needs clarifying (like an unclear address or an allergy note).
• Transactional email: your order confirmation and receipt are sent regardless of any marketing consent, because they’re part of fulfilling the order you placed, not marketing.
• Fraud and security: bot protection at checkout, and reviewing payments for signs of fraud or abuse.
• Customer support: if you contact us with a question or an issue with an order.
• Legal and business record-keeping: Canadian tax and accounting rules require us to keep order and payment records for a minimum period (see “How long we keep it” below).
• Marketing, only if you opt in: the separate email/SMS checkboxes at checkout. You can withdraw this at any time; see “Your choices” below.

Diana’s Rewards, our points, referral and gift program, is live. If you order, refer a friend, or receive a gift through it, we keep a record of your points balance and the history behind it (such as which order earned points, and any referral or gift bonus), tied to your customer record. This is used only to run the rewards program itself, such as showing you your balance and letting you apply a reward you choose to a future order.

Who we share it with

We don’t sell your information, and we only share what’s needed to run the business, with these categories of service provider:

• Payment processing: Stripe. Handles card, Apple Pay and Google Pay payments. Stripe has its own privacy policy governing what it collects.
• Transactional email: Resend. Sends order confirmations and related emails on our behalf.
• Database and hosting: Supabase and Render. Where order and menu data is stored and the site is run.
• Bot protection: Cloudflare (Turnstile). Helps us tell real customers from automated spam/abuse at checkout.
• Delivery distance calculation: OpenStreetMap. If you choose delivery, the address you enter is used to calculate distance and delivery fee via OpenStreetMap’s open mapping services.

Some of the technical pieces above (Stripe live payments, Resend live email, a connected Supabase project) are still being switched on as the site moves toward launch; this section names the providers we use as we do connect them, not providers we’ve merely considered. We’ll keep this list accurate as that rolls out.

We may also disclose information if required by law, or to protect the rights, property or safety of Diana’s Cuisine, our customers, or others.

How long we keep it

Order and payment records are kept for at least as long as Canadian tax law requires business records to be retained (generally a minimum of six years from the end of the relevant tax year), and may be kept longer for legitimate accounting or legal reasons. Marketing consent is kept until you withdraw it. The exact retention schedule for other data (such as custom-order enquiries that don’t become an order) is still being finalized as the business grows; until then, we keep it only as long as reasonably needed for the purpose it was collected for.

How we protect it

Your order verification PIN is never stored in plain text: it’s hashed the same way a password would be. Data in transit is encrypted (HTTPS). Access to order and customer data is restricted to what’s needed to run the business. No method of storing or transmitting information is 100% secure, so while we take reasonable, industry-standard measures to protect your information, we can’t guarantee absolute security, and we’ll never claim otherwise.

Your choices

• Marketing emails/texts: opt in or out any time. Every marketing message includes an unsubscribe/opt-out option, and you can also just tell us directly.
• Access or correction: you can ask us what information we hold about you, and ask us to correct anything that’s wrong.
• Deletion: you can ask us to delete your information, though we may need to keep order and payment records for the legal retention period described above even after a deletion request.

To exercise any of these, contact us using the details below. We’ll respond within a reasonable time.

Children’s privacy

Diana’s Cuisine is not directed at children, and we don’t knowingly collect information from anyone under 16. If you believe a child has given us personal information, contact us and we’ll remove it.

Changes to this policy

We may update this policy as the site and business evolve, for example when a new payment or email provider is connected, or when a new feature changes what we collect. The “last updated” date at the top will always reflect the latest version, and material changes will be called out clearly rather than buried in a rewrite.

Contact us

Questions about this policy or your information? Text (416) 529-8636.