Privacy Policy

TinBela (“TinBela”, “we”, “us”) operates a corporate meal-delivery service for workplaces in Dhaka, Bangladesh, available at tinbela.com and as an installable app. This policy applies to everyone who uses the service — individual customers, members of a corporate plan, and visitors to our website — and TinBela is responsible for the personal information it describes.

You can create an account and sign in with your Google account. When you do, Google asks your permission to share your basic profile with TinBela, and the only personal information we receive from your Google account is your name, email address and profile picture:

• Name — to address you and to identify your account, orders and wallet transactions.
• Email address — your sign-in identity, and where we send verification codes and service notices about your account.
• Profile picture — included in the basic profile Google shares. It is stored with your account record and used for nothing else.

Alongside these, Google confirms that your email address is verified, provides an account identifier — which is how we recognise you the next time you sign in — and, for Google Workspace accounts, names the organisation domain your address belongs to. We request only Google's basic sign-in permissions, without offline access. We never see your Google password, we have no access to your Gmail, Contacts, Drive, Calendar or any other Google data, and we never act or post on your behalf.

One-tap sign-in. While you are signed out, our pages load Google's sign-in service (accounts.google.com) to offer to sign you in with one tap, unless you have declined cookies. Loading it gives Google standard technical information, such as your IP address and the page you are on, and Google sets a cookie on our site that remembers if you closed the prompt so it does not keep asking. Nothing is shared with TinBela unless you choose an account.

You can remove TinBela's access at any time from your Google Account permissions. Doing so stops Google sign-in; it does not delete your TinBela account — for that, see Your rights and choices.

To deliver your meals, we ask for — or you choose to give us — the following:

• Account details — if you register with an email address instead of Google: your name, email address and a password. Passwords are stored only as a one-way hash that no one at TinBela can read.
• Mobile number — which our team uses to confirm orders and coordinate delivery.
• Delivery addresses — the company, building, floor and desk or reception you ask us to deliver to.
• Orders and meal plans — what you order and for which days, your subscriptions, and the dietary and spice preferences you set.
• Wallet and deposits — your wallet balance and ledger, and the deposit you file each time you add funds: the amount, the number you paid from and the transaction reference.
• Gifts and transfers — when you send a meal or wallet funds to a colleague, the recipient you choose and the name you send it under.
• Corporate membership — if your employer enrolls you, your company, department and meal allowance.
• Order notes — anything you choose to write in the note on an order.
• Messages — your name, email address and message when you contact us.
• Partner kitchen staff — if you use the Partner portal: your account, your kitchen's contact details, and the compliance documents your kitchen uploads.

• Activity and security log — while you are signed in, we record the pages you open and security-relevant actions such as signing in, filing a deposit or changing account settings, together with your IP address, your browser type and, for sign-in and verification events, the email address involved. Only authorised Operations staff can see this log, and it exists to keep your account and the service secure.
• Abuse protection — counters of requests and failed sign-in attempts, used to rate-limit and block automated attacks.
• Essential cookies and app storage — described in Cookies and similar technologies.
• Anonymous usage statistics — Vercel Web Analytics counts page views so we can see which pages are useful. It uses no cookies and does not identify you: it receives the page address (with any query details removed), the referring site, your country, and your device and browser type, and counts visitors with a value that resets every day. If you decline cookies, nothing is sent at all.

Beyond that cookie-free measurement, we use no analytics, advertising trackers or cross-site tracking.

We use personal information strictly to provide and protect the service, and for no other purpose:

• Account creation and authentication — creating your account, signing you in and keeping your session secure.
• Orders and ledger transactions — identifying you on every order, deposit, wallet entry and invoice, so each is attributed to the right person and can be reconciled.
• Providing our corporate lunch service — preparing and delivering your meals, confirming orders by phone, running your subscriptions, and billing corporate plans to your employer.
• Service communications — verification codes, notices about your orders and deposits, and replies to your messages. We do not send marketing email.
• Security and fraud prevention — detecting abuse, protecting the wallet and deposit system, and investigating problems you report.
• Legal obligations — keeping the financial records the law requires.

We do not use your information for advertising, we do not build marketing profiles, and we do not sell it.

Information we receive from Google is used only to create your account, authenticate you, and identify you on your orders and ledger transactions. In particular:

• We do not sell Google user data, or share it with data brokers, advertisers or information resellers.
• We do not use it for advertising, retargeting or interest-based profiling.
• We do not use it to develop, improve or train generalised artificial-intelligence or machine-learning models.
• Within TinBela it is visible only to the authorised staff who need it to fulfil your orders and support your account, and it leaves TinBela only as described in How we share information.

TinBela's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell, rent or trade your personal information, and we never share it with data brokers or advertisers. We disclose it only in the circumstances below, and only what each recipient needs:

• Partner kitchens — what to cook, how many, for which sitting, and the building, floor and desk it goes to, together with any note you add to the order. They do not receive your name, phone number or email address. If a partner kitchen also delivers your order, it receives what the delivery team receives.
• Our delivery team — your name, delivery address and contact number for the orders they carry.
• Your employer — for corporate plans only: your allowance, usage and the billing records needed to invoice the company.
• People you send to — when you send a meal or wallet funds, the recipient sees the name it is sent under.
• Service providers — companies that host and operate parts of TinBela on our behalf, under contract and only on our instructions: Supabase (database, authentication and file storage), Vercel (website hosting and anonymous usage statistics), Brevo (delivery of transactional email) and Google (sign-in).
• Legal and safety — where required by law, regulation or valid legal process, or where necessary to protect the rights, property or safety of our customers, our staff or the public.
• Business transfers — if TinBela is involved in a merger, acquisition or sale of assets, your information would remain protected by this policy, and we would notify you before it became subject to a different one.

• Encryption — all traffic is encrypted in transit over HTTPS, and our database provider encrypts data at rest.
• Access control at the database — row-level security means one customer can never read another's records. Staff access is role-based, and sensitive details such as addresses, phone numbers and IP addresses are limited to the staff who need them.
• Protected sessions — your session cookie is HTTP-only, so scripts in the browser cannot read it. Passwords are stored only as one-way hashes, and one-time codes are hashed and expire within minutes.
• Accountability — money movements and administrative actions are recorded in an append-only audit log that cannot be edited.
• Abuse protection — sign-in, deposits and public forms are rate-limited against automated attacks.

No system can be guaranteed perfectly secure. If a breach ever affects your personal information, we will notify you and the relevant authorities as the law requires.

• Account information — for as long as your account is open. When you ask us to delete it, we remove it as described in Your rights and choices.
• Financial records — orders, deposits, wallet ledger entries and invoices are kept for as long as accounting, tax and dispute-resolution obligations require, even after an account is closed.
• Activity and security log — kept for 60 days, then deleted automatically.
• Messages to us — kept while we resolve your enquiry and for a reasonable period afterwards, in case you follow up.

• Access and correction — view and update your name, mobile number, delivery addresses and preferences at any time from your account.
• A copy of your data — ask us for a copy of the personal information we hold about you.
• Account and data deletion — ask us to delete your account. Once we have verified the request, within 7 days we close the account, stop all use of your information, and remove your name, contact details, delivery addresses, preferences and sign-in identity, then confirm by email. Orders, deposits, wallet ledger entries and invoices that accounting and tax law require us to keep are retained for that obligation only, and used for nothing else.
• Withdrawing Google access — remove TinBela from your Google Account at any time, as described in Signing in with Google.
• Objection and restriction — ask us to stop or limit a particular use of your information, where the law gives you that right.

To exercise any of these rights, email hamzahossain3842@gmail.com from the address on your account, or use our contact page. We verify every request against your account before acting on it, and we never charge for it.

• Session cookies — keep you signed in and complete Google sign-in securely. They are HTTP-only and set for TinBela alone.
• Session preference — remembers whether you chose “Remember me”, which sets how long you stay signed in. If you decline cookies, “Remember me” is switched off and you stay signed in only for the standard, shorter period.
• Device storage — remembers your light or dark theme and your cookie choice on this device, and keeps short-lived keys in the open tab that stop a payment or order from being submitted twice.
• Installed app — if you install TinBela, your device keeps the app's offline page and design assets so it opens quickly. It never stores your personal information or account pages.

All of these are strictly necessary or remember a preference you set. We do not use advertising, analytics or cross-site tracking cookies.

TinBela is a workplace service for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

TinBela serves customers in Bangladesh. Our infrastructure providers operate data centres outside Bangladesh, so your information may be stored and processed in other countries. We choose providers with strong security and contractual data-protection commitments, and this policy applies wherever your information is processed.

We will update this policy as the service evolves, and the effective date at the top always shows the current version. If we make a material change — in particular to how we use information received from Google — we will tell you by email or in the app before it takes effect.

For questions about this policy, or to exercise any of your rights, contact TinBela:

• Email — hamzahossain3842@gmail.com
• Online — our contact page
• Location — Dhaka, Bangladesh

A real person reads every message and replies by email.