Privacy policy

Last updated: 4 August 2026.

This policy explains what personal information Pashtun Palace (“we”, “us”) collects through this website, why we collect it, who else sees it, and the choices you have. We have written it in plain English on purpose.

1. Information you give us

• Order information: your name, email address, phone number, and — for delivery orders — your delivery address and any access notes you add.
• Catering enquiries: the event date, guest count, venue address, dish preferences, dietary and allergy notes, and anything else you type into the enquiry form.
• Account information: if you create an account, your email address and a hashed password. We never store your password itself, only a one-way hash of it.
• Messages: anything you send through the contact form or by email.

2. Information collected automatically

We run our own first-party page-view counter. It records the page visited, the referring website, the general device type and the date. It does not use third-party advertising cookies and does not follow you to other websites. The visitor identifier it stores is a one-way hash of your IP address and browser, salted with a value that changes every day, which means the same visitor cannot be linked across two different days. Raw page-view records are deleted automatically after the retention period set by the site owner; only anonymous daily totals are kept longer.

3. Cookies and similar technologies

• Session cookie: keeps you logged in and keeps your shopping cart together as you move between pages. Strictly necessary; the site cannot work without it.
• Cart token: lets you come back later and still find your cart.
• Security token: protects forms against cross-site request forgery.

Your payment provider may set its own cookies while you are on the payment step. We do not set advertising or cross-site tracking cookies.

4. Payments

We never see or store your full card number. Card payments are handled entirely by our payment processor — Stripe, PayPal or Square, depending on the method you choose — and are subject to that company’s own privacy policy. We receive only a transaction reference, the amount, the result, and a masked descriptor such as the last four digits and the card brand, which we keep so we can answer questions about the payment and issue refunds.

If you pay by bank transfer, we see the reference and the amount your bank sends us. If you pay cash, we record only that the order was paid in cash.

5. Why we use your information

To take, cook, pack and deliver your order; to send you order confirmations, status updates and receipts; to answer your catering enquiry and send you a quote; to keep records required for tax and accounting; to detect and prevent fraudulent orders; and — only if you have opted in — to send you occasional news about the menu. Every marketing email has an unsubscribe link and we honour it immediately.

6. Who else sees your information

Only the people and services that need to: our staff, our payment processor, our email delivery provider, and our web host. We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not give it to data brokers. We will disclose information if we are legally required to.

7. How long we keep it

Order records are kept for seven years, because tax law requires it. Catering enquiries that do not become bookings are kept for two years. Contact-form messages are kept for two years. Account records are kept until you ask us to delete them. Raw analytics page views are deleted automatically after the configured retention window.

8. Your rights

Wherever you live, you may ask us to tell you what personal information we hold about you, to correct it, or to delete it. If you are a resident of California, the California Consumer Privacy Act gives you specific rights to know, to delete, to correct, to opt out of sale or sharing (we do neither), and to be free from discrimination for exercising any of them. If you are a Washington resident, the My Health My Data Act gives you rights over health-related data — note that dietary and allergy information you send us for an event may be treated as such, and we use it only to cook your food safely.

To exercise any right, email us using the contact address on this site with the words “privacy request” in the subject line. We will verify who you are, usually by replying to the email address on your order, and respond within 45 days. There is no charge.

9. Children

This site is not directed at children under 13 and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

10. Security

The site is served over HTTPS. Passwords are stored as salted one-way hashes. Administrative access is restricted, rate-limited and logged. No system is perfect, but we take this seriously, and if a breach ever affects your information we will tell you.

11. Changes

If we change this policy we will update the date at the top. Material changes will be announced on the homepage.

12. Contact

Questions about this policy, or about your information, go to the contact details on our contact page.

Last updated September 23, 2026.