Privacy Policy

This Privacy Policy describes how goldenBox, a product of Hustle Ventures, registered at 17, Indira nagar, Bengaluru 560037 (referred to as "we", "us", or "goldenBox"), collects, uses, and protects your personal information.

We respect your privacy. This policy explains what data we collect, why we collect it, how we use it, and your rights under Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Who We Are

Product: goldenBox (goldenboxmenu.com)
Legal Entity: Hustle Ventures
Address: 17, Indira nagar, Bengaluru 560037
Support Email: [email protected]
Sales Email: [email protected]
Data Protection & Grievance Officer: Arul ([email protected])

2. What Data We Collect and Why

2.1 Website Visitors (goldenboxmenu.com)

When you visit our marketing website, we collect:

• Analytics data via Google Analytics 4, loaded through Google Tag Manager, and Cloudflare Web Analytics (cookieless): pages viewed, buttons clicked, referrer, campaign tags, device and browser type, and approximate location (country, city). This helps us understand which pages are useful. Google Analytics does not store your full IP address, and we do not send names, emails or phone numbers to it.
• Security logs from Cloudflare (IP address, user agent, request data) to protect the site from attacks and abuse.
• Third-party requests: Images load from images.unsplash.com, which may see your IP address. Our booking link goes to tidycal.com, which operates under its own privacy policy.
• Browser storage: Your browser's localStorage stores your chosen language (gb_language), currency (gb_currency), and your demo plan (cp:goldenbox-demo:plan). This data stays on your device; we do not read it from our servers.

Cookies: Google Analytics sets first-party cookies (_ga and _ga_<id>) to count returning visits. They are kept for up to 14 months. We do not use advertising cookies, ad trackers or ad networks. To stop Google Analytics, block cookies for this site in your browser or use the Google Analytics opt-out add-on.

2.2 Live Demo Planner (embedded on goldenboxmenu.com and demo.goldenboxmenu.com)

The live demo planner at app.goldenboxmenu.com is a demonstration tool. Please do not enter real customer data. If you fill step 1 of the demo, we collect:

• Your name, phone number, and optional email and company name
• Event type, date, guest count, and the menu items you selected

Purpose: To show you how goldenBox works.
Storage: Demo submissions are stored in a Cloudflare D1 database and a Google Sheet that goldenBox controls. An alert email is sent internally. The plan also stays in your browser's localStorage for 30 days.
Bot protection: Cloudflare Turnstile checks whether you are a bot before you submit.
Retention: Demo submissions are deleted after 90 days, or immediately on request (email [email protected]).

2.3 Business Outreach (B2B prospecting)

We collect publicly available business contact data to offer goldenBox to bakeries and caterers:

• What we collect: Business name, contact person's name, business email and phone, city, and public brand assets (logo, colours, menu items).
• Sources: The business's public website, Google Maps / Google Business Profile, social media pages (e.g., Instagram, Facebook), and business directories.
• Purpose: To send a personalised demo of goldenBox that shows how it would look on the business's own website.
• Retention: We keep prospect data for 12 months if there is no reply. If you opt out (reply "STOP" to our sales email at [email protected] or email [email protected]), we delete your data and add your email address to a suppression list (email + opt-out date only) so we never contact you again.
• Your rights (wherever you are): You may ask to see, correct, or delete your data, or object to further contact. Email [email protected]. We honour these requests within 30 days.

2.4 Customers (caterers and bakeries who buy goldenBox)

When you buy goldenBox, we collect:

• Your contact details (name, email, phone)
• Your business name and billing address
• Payment is offline (bank transfer or invoice); we do not process card payments or store card details.

Your planner and data: Your live planner runs in your own Google Sheets and your own Cloudflare account. Your customers' enquiries are stored there, not by us. You decide what is collected and you need your own privacy notice on your planner page. We only access your data during initial setup and, on the optional paid maintenance model, to maintain it. You own your data.

3. Service Providers and Data Transfers

We use the following services to operate goldenBox:

• Cloudflare (USA): Hosting, Workers, D1 database, Turnstile, analytics, DNS
• Google (USA): Workspace (email), Sheets, Drive, Apps Script, Gmail (alert emails), Google Analytics and Google Tag Manager (website analytics)
• Resend (USA, optional): Alert emails
• Telegram (optional): Alert messages
• TidyCal (USA): Booking calendar (link on our site; their privacy policy applies)

Data may be processed outside India. We use providers with standard contractual safeguards.

4. Your Rights

Under the DPDP Act 2023 and IT (SPDI) Rules 2011, you have the right to:

• Access: Ask what personal data we hold about you.
• Correction: Ask us to correct inaccurate data.
• Deletion: Ask us to delete your data (subject to legal obligations).
• Opt-out: Stop receiving business outreach emails (reply "STOP" or email us).
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
• Grievance: Raise a complaint with our Grievance Officer.

How to exercise your rights: Email [email protected] with your request. We will respond within 30 days.

5. Security

We protect your data with industry-standard security measures:

• HTTPS encryption for all website traffic
• Access controls and authentication for backend systems
• Regular security monitoring via Cloudflare

No system is 100% secure. If we detect a data breach that affects you, we will notify you and the relevant authorities as required by the DPDP Act.

6. Children's Privacy

goldenBox is not intended for children under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.

7. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top shows when it was last changed. If we make material changes, we will notify you by email or a notice on goldenboxmenu.com.

8. Contact and Grievances

For privacy questions, data requests, or grievances, contact:

Arul (Data Protection & Grievance Officer)
Email: [email protected]
Address: 17, Indira nagar, Bengaluru 560037

We aim to respond within 30 days.

9. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes are subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka, India.

Language: This Privacy Policy is available in English. If translated into other languages, the English version prevails in case of conflict.