Privacy Policy

Privacy Policy

Dhaka Street Food · Last updated September 19, 2026

This policy explains what Dhaka Street Food ("Dhaka Street Food", "we") collects when you use dhakastreetfoods.com, why, who sees it, how long we keep it and what you can ask us to do with it. In short: we collect what an order, an account or a message needs, we use it to serve you and to keep the business safe, we never sell it, and you can download or delete what we hold from your account.

1. What we collect

What you give us. Your name, mobile number and email when you order or sign up; a password, which is stored only as a hash; the note you leave for the kitchen and any allergy note; your address, photo, birthday and preferences if you add them to your account; what you write in the contact, catering and newsletter forms; and the boxes you tick (terms, texts, offers), with the date and time.

What the site records on its own. The internet address (IP) and browser of the device that places an order, a random device id kept in a cookie, and the times of orders and sign-ins. We use no advertising trackers and no analytics service.

What payment providers tell us. When you pay online, Square (or PayPal) tells us the card brand and last four digits, a payment id, and a card fingerprint, which is a code that identifies a card without revealing its number. Your card number never reaches us. If a cardholder disputes a charge, the provider tells us about the dispute.

2. Why we use it

• To prepare your order and hand it to the right person, and to send the receipt and updates about it.
• To run your account: sign-in, points, referral rewards, order history.
• To keep the business safe: we compare the phone number, email, internet address, device and card of a new order with recent orders to spot stolen cards and abuse, and we may hold an order for a quick check. A lost dispute or repeated refunds can flag an account or block a phone number from online payment.
• To answer messages and prepare catering quotes.
• To keep the records that tax and accounting law require, and to answer a payment dispute with the facts of the order.
• To send offers, only if you asked for them, by email or by text.

3. Who we share it with

Only with the companies that do the work with us, and only what they need: Square and PayPal to take payment and to handle refunds and disputes; our email provider and, when texts are switched on, our text message provider (Twilio) to deliver messages; the company that hosts this website; the provider of the chat assistant on the site, if one is running, for what you type into it. We share data with the authorities when the law requires it, and it would pass to a new owner if the business is sold. We do not sell personal data, we do not share it for targeted advertising, and we make no decisions about you by profiling.

4. Cookies

The site sets a small number of cookies, all needed to sign you in, keep your basket and protect against fraud. The Cookie Notice lists them.

5. How long we keep it

• Orders: the name, phone, email, notes, internet address and device of a guest order are removed 18 months after the order. The amounts, items and status stay as an accounting record without anything personal in them. A member's orders stay with the account while the account exists.
• Accounts: as long as you keep the account. When you delete it, your profile, sign-in, photo, address and preferences are wiped at once, your points are forfeited, and your orders are treated like guest orders (personal details removed 18 months after each order).
• Consent records: the record of the boxes you ticked is kept for 48 months, because the law lets a message be questioned for that long.
• Messages sent through the contact and catering forms: 18 months.
• Fraud records: a blocked phone number, email, device or card stays blocked for as long as it is needed to prevent fraud.
• Technical logs: up to 12 months.

6. Your choices and rights

From your account you can edit your details, switch offers on or off, download everything we hold about you as one file, and delete the account. Without an account, or for anything else, email booking@dhakastreetfoods.com. You may ask us to confirm what we hold, correct it, delete it, give you a copy, or stop marketing to you; we answer within 45 days and we may first check that the request really comes from you. We honor these rights for everyone, whether or not the Maryland Online Data Privacy Act applies to a business of our size. If you think we have not handled your data properly you can complain to the Maryland Attorney General.

7. Security

The site runs over HTTPS, passwords are stored as hashes, card numbers never touch our servers, and only the staff who need it can see order details, each with their own login. No system is perfectly safe; if a breach ever affects your data we will tell you as the law requires.

8. Children

The site is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.

9. Changes

When this policy changes, the date at the top changes and the consent records from then on carry the new version. Big changes are announced on the site.

10. Contact

• Email: booking@dhakastreetfoods.com
• Phone: +1 (240) 262-4646
• Mail: Dhaka Street Food, 13207 Ailesbury Ct, Upper Marlboro, MD 20772, USA