maampomaaData and privacy
This page explains how your data is processed when you browse, create an account or order. It also lists the cookies. None of this is targeted advertising.
Who is responsible
The controller is the publisher of the maampomaa website. Order data is also available to the bakery preparing it.
To use your rights, write to the bakery that recorded your order, from the email address of the account or the order.
Which data
- Account: email address. If you choose Google, Apple or Facebook, that service sends the email and, when it provides one, the name. A password typed here is handled by authentication: the shop never sees it in clear text, and it never receives the password of those services.
- Order: name, email, phone, bakery, the delivery option and the payment option you choose (address if you give one), products and amount. No card number.
- Reviews: the overall rating, the headline, the comment, the theme scores (flavor, texture, freshness, value for money, quality), the first name (or “Customer”) and whether you have ordered that product. A helpful vote records who voted and on which review; only the count is public. The star summary is on the homepage; the detail is on the product page. The review stays public until you delete it or the bakery removes it.
- Sign-ins: date, device (browser) and IP address of each sign-in to an account, to spot an unusual access. Kept for 90 days.
- Technical: the cookies listed below, and the approximate country provided by the host to show euros or pounds for this visit. That country is not stored in a cookie until you pick a currency.
Why
- Prepare the order and keep the account. Basis: the contract.
- Show reviews on products. Basis: legitimate interest. You can delete your own.
- Protect the site (rate limits, session, two-factor authentication for staff). Basis: legitimate interest.
- Count visits and page speed, only if you accept it in the banner. Basis: consent, which you can withdraw.
- Keep order records for accounting duties. Basis: legal obligation.
Who can see it
Staff at the bakery concerned (and the network administrator). Hosting and the database are at Vercel and Supabase. Audience measurement, if you accept it, is done by Vercel. The bakery map loads Google Maps only if you ask to show it. Data is not sold.
For how long
The account stays until you ask for it to be deleted. Orders are kept long enough to fulfil them, then up to 10 years for accounting records. A review stays public until you delete it, or the bakery removes it. A helpful vote goes away with the review, or as soon as you remove it. A stock reservation lasts 15 minutes. The cookie choice is asked again after 6 months. Security logs are kept long enough to detect abuse.
How it is protected
- The site is served over HTTPS: traffic is encrypted.
- Passwords are handled by Supabase Auth. The application does not store them. A Google, Apple or Facebook sign-in does not give the shop that service's password.
- Each staff member only sees the bakeries assigned to them. The back office requires two-factor authentication.
- Session and order cookies are httpOnly (unreadable by a page script) and SameSite.
- No sale of data and no ad network. Signing in with Google, Apple or Facebook only sends that service the sign-in you started. The order is not shared with them.
Warning
maampomaa will never ask, by email or by phone, for your password, a card number or a code received by text to confirm an order. If someone does, it is a fraud: do not reply and do not click.
Your rights
You can ask for access to your data, correction, deletion, restriction, object to processing based on legitimate interest, and ask for a portable copy of what you provided. Withdrawing audience-measurement consent does not undo orders already placed.