Privacy Policy

1. Who processes your data

The data controller is Kitchen Hub LLC (identification code 405881782), which operates Brasco. Address: 49 B. Zhgenti St, apt. 20, Vake district, Tbilisi, Georgia. For data questions: hello@eatbrasco.com, +995 511 26 86 55.

We process data in accordance with the Law of Georgia on Personal Data Protection.

2. What data we collect

• Contact details: phone number (required) and name (optional).
• For delivery: address, entrance, floor, apartment, comment for the courier; if you tap “Use my location” — your device coordinates.
• Orders: dishes, comment, totals, discounts, promo code, bonus transactions, order history and payment status. Card data is processed by Flitt — we never receive the full card number.
• Profile: the phone number confirmed by SMS code and your sign-in session. SMS codes are stored only in hashed form and are valid for 5 minutes.
• Technical data: page views, taps on interface elements (without text or coordinates), site speed metrics, a visit identifier, device type, language and traffic source (for example, utm_source or a blogger link).
• Only with your consent: an anonymous device identifier and, to measure advertising, browser data (user agent), IP address and Meta cookies (_fbp, _fbc) linked to the order.

IP addresses are also processed temporarily for spam protection and in hosting technical logs.

3. Purposes and legal basis

• Fulfilling your order — cooking, handover, delivery, contacting you, payment and refunds: performance of a contract.
• Profile, order history and bonuses: performance of a contract.
• Security and abuse prevention (SMS and order limits): our legitimate interest.
• Accounting and tax records: legal obligation.
• Anonymous website statistics to improve the service: our legitimate interest.
• Extended analytics and advertising measurement (Meta Pixel, Conversions API): your consent.

We do not sell data and do not send marketing SMS without your consent.

4. Who receives the data

Data is processed by our service providers, only to the extent necessary:

• Vercel — website hosting (servers in Frankfurt, EU);
• Supabase — database (EU region);
• Flitt (TBC group) — online payments and refunds;
• SMS provider — sending sign-in codes (phone number and code);
• courier partner (currently Wolt Drive) — for delivery: name, phone, address and comment for the courier;
• PostHog (EU Cloud) — website statistics, if enabled; without consent the data is anonymous, with no user profile;
• Meta Platforms — only with your consent, to measure advertising.

Some providers are established outside Georgia (in the EU or the US). Such transfers take place with the safeguards required by law. Data may also be disclosed to public authorities where the law requires it.

5. Retention

• Orders and related data — as long as needed to provide the service and to meet tax and accounting requirements.
• Profile — until you ask us to delete it (order records we must keep by law are retained).
• Technical events — taps and speed metrics for 90 days, everything else for 400 days; then deleted automatically.
• Sign-in session — up to 90 days; SMS code — 5 minutes.

6. Cookies and browser storage

• brasco_session and brasco_signed_in — sign-in session (up to 90 days);
• brasco_promo — a promo code from a partner link (until the promotion ends);
• brasco-cart (localStorage) — your cart and the contact details you entered, so you do not have to type them again;
• brasco-consent (localStorage) — your analytics choice;
• brasco-session and brasco-source (sessionStorage) — the current visit and its source;
• only with consent: brasco-anon and brasco-source (localStorage) — an anonymous device identifier and the source of the first visit; Meta Pixel cookies _fbp and _fbc.

On your first visit the site asks for consent: “Allow” or “Essential only”. To change your choice, clear this site’s data in your browser — the notice will appear again — or write to us.

7. Your rights

You have the right to: obtain information about and a copy of your data; request its correction, deletion or restriction of processing; object to processing; and withdraw consent at any time (this does not affect processing carried out before withdrawal).

Send your request to hello@eatbrasco.com or call +995 511 26 86 55. We will reply within the time limit set by law. You can also contact the Personal Data Protection Service of Georgia (personaldata.ge).

8. Security

The website works only over a secure connection (HTTPS). Only staff who need access for their work can see the data, and staff actions are logged.

9. Changes

We may update this policy; the current version is published on this page with the date of the update.