Privacy Policy
This policy explains what Niko’s Bakery & Cafe collects when you order from us online, whether on this website or in the Niko’s Bakery app for iPhone and Android, why we collect it, who else sees it, and the choices you have. We are a bakery, not a data company: we collect what it takes to make your order, hand it to the right person, and send you a receipt.
Who we are. Niko’s Bakery & Cafe, 601 Emory Dr, Owensboro, KY 42301. Phone (270) 478-4441. Email nikosbakeryandcafe@gmail.com. The ordering website and the app are built and operated for us by Tucker Shively (tucker@tuckershively.com), who handles the technical side under our instructions.
What we collect
When you place an order
- Your name, phone number and email address, so we can reach you about the order and send the receipt.
- What you ordered, your choices on each item, the pickup time you picked, and any notes you wrote for the kitchen.
- The card brand and the last four digits of the card used, which appear on your receipt. We never see or store your full card number. Card details are typed into fields hosted by Clover, our payment processor, and go directly to Clover.
When you create an account
- Your email address and a password. The password is stored as a salted hash, which means nobody, including us, can read it back.
- Your name and phone number, if you give them, so you do not have to type them on every order.
- Your order history, so you can see past orders and order them again.
Your answer about marketing email
When you create an account we ask one question: “Email me Niko’s news and specials. Unsubscribe any time.” The box starts unticked and you do not have to tick it to make an account. Whatever you answer, yes or no, we keep a record of the answer, the exact sentence you were shown, when and where you answered (website or app, at sign-up or on your account screen), and the internet address and device description at the time. That record is our proof of what you agreed to, and it is what we check before any marketing email is sent.
Technical information
- Ordinary server logs: the internet address a request came from, the time, and the page or action requested. We use these to keep the service running and to spot abuse.
- When you pay, your internet address is passed to Clover for fraud screening.
- In the app only, usage statistics through Google Analytics for Firebase: which screens and menu items are opened, what goes into a basket, how far checkout gets, searches, and the total of a paid order. These are tied to a random identifier for your installation of the app, not to your name, email or phone, along with your device model, operating system, app version and an approximate location worked out from your internet address. We use them to see which parts of the app work and which do not.
- The app never reads your phone’s advertising identifier, and nothing it collects is used for advertising. The website carries no analytics and no advertising trackers.
How we use it
- To prepare your order and hand it to the right person at the counter.
- To send your receipt by email, and to send a new-order alert to the bakery.
- To record the order on our Clover point-of-sale system, which is where every order, online or in person, lives.
- To show you your order history and let you reorder, if you have an account.
- To answer a question or fix a problem with an order.
- To send you news and specials by email, only if your newest answer to the marketing question was yes.
- To keep the service secure and to meet our tax and accounting obligations.
Who else sees it
| Who | What they receive | Why |
|---|---|---|
| Clover (Fiserv) | Your order, your name and contact details on the order note, and your card details (which go to Clover directly, never through us). | Our point-of-sale and payment processor. Clover’s own privacy policy applies to how it handles card data. |
| Mailgun | Your email address and the contents of receipts, password reset emails and, if you opted in, marketing emails. | Delivers our email. |
| Google (Firebase and Google Analytics) | The app usage statistics described above, tied to a random installation identifier. | Counts and reports how the app is used. Not used for advertising. |
| Tucker Shively | Access to the systems that hold the data above, under our instructions. | Builds and operates the ordering website and app for us. |
| Hosting providers | The servers the ordering system runs on. | Infrastructure only; they do not use the data. |
We do not sell your information, and we do not share it with anyone for their own marketing.
How long we keep it
- Orders are kept as long as our tax and accounting rules require, the same as an in-person sale.
- Accounts are kept until you delete them.
- Marketing answers are kept as evidence of consent. When you delete your account, we record a final “no” against your address so it is never emailed again, and we strip the internet address and device details from your earlier answers.
- Server logs are kept for a short period and then discarded.
- App usage statistics are kept by Google Analytics for no longer than 14 months.
Your choices
- Marketing email. Change your answer any time on your account screen in the app or on the website, use the unsubscribe link at the bottom of any marketing email (it works without signing in and takes effect straight away; receipts and order emails still come), or tell us in person or by email.
- Delete your account. In the app: open your orders, then Delete my account. On the website: sign in, open your account, then Delete my account. Your account, sessions and saved details go immediately. Records of completed orders stay for accounting, with your account removed from them.
- See or correct your information. Email nikosbakeryandcafe@gmail.com from the address on your account and we will send you what we hold or correct it.
- App usage statistics. Deleting the app deletes its installation identifier; a new install starts a new one.
- Order without an account. You can always order as a guest. We still need a name, a phone number and an email address for the receipt.
Children
Our ordering website and app are not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has given us information, email us and we will delete it.
Security
Every connection to the ordering system is encrypted. Passwords are hashed, sessions are random tokens stored hashed, and card numbers never touch our systems. Access to customer records is limited to the people who need it to run the bakery and the system.
Changes to this policy
If we change how we collect or use information, we will update this page and change the effective date at the top. Changes that matter to you will also be mentioned in the app or on the website.
Contact
Niko’s Bakery & Cafe, 601 Emory Dr, Owensboro, KY 42301. (270) 478-4441. nikosbakeryandcafe@gmail.com.