Privacy Policy

1. Who we are

Mandai Smoke Co. is a Singapore home-based BBQ delivery business. Our customer database and ordering systems are hosted in Singapore on Amazon Web Services (AWS), in the Asia Pacific (Singapore) region. We are the data controller for any personal data we collect through our website, email, SMS, WhatsApp, and direct customer messages.

2. What we collect

We collect only what we need to take your order, deliver it, and keep you informed. Specifically:

• Contact details — your name, email address, mobile number, and (when you order) delivery address.
• Order history — what you ordered, when, and any delivery instructions you gave us.
• Loyalty data — Embers points, streak progress, and rewards you’ve redeemed (only if you sign up for our loyalty program).
• Communication preferences — whether you’ve opted in or out of marketing emails, SMS, or WhatsApp, and your unsubscribe history.
• Sign-in identifiers — if you log in via Google or Facebook, we store the unique account ID those providers give us so we can recognise you on return visits. We do not store your social media password.
• Payment information — processed entirely by our payment provider (see section 8). We never see or store your full card number.
• Website usage data — basic analytics like pages viewed, browser type, and approximate location (city-level), described in section 7.

3. How we use your information

We use the data above to:

• Process your order, prepare your food, and deliver it to you.
• Send you order confirmations, delivery ETAs, and receipts.
• Reply when you write to us with a question, request, or feedback.
• Run our loyalty program — track points, streaks, and tier progression, and tell you when you’ve unlocked something.
• Send you marketing emails about new menu items and weekend specials, but only if you’ve opted in (see section 4).
• Improve our website, menu, and delivery service based on aggregated, non-identifying patterns.
• Comply with our legal and tax obligations (e.g., keeping order records for IRAS).

We do not use your data for automated decision-making that has a legal or significant effect on you.

4. Email communications

When you place an order, sign up for our newsletter, or join our loyalty program, we collect your email address so we can:

• Send order confirmations, delivery updates, and receipts
• Tell you about new menu items, weekend specials, and small-batch drops
• Share loyalty milestone rewards and referral credits
• Reply to you when you write to us at hello@mandaismokeco.com

You’re in control.Every email we send (apart from one-off order confirmations) includes a one-click unsubscribe link in the footer and the same option natively in Gmail and Apple Mail. When you unsubscribe, we stop sending you marketing emails immediately and add your address to our internal suppression list so it doesn’t slip back in.

You can also email us directly at hello@mandaismokeco.com to:

• Ask what data we hold about you
• Correct any details that are wrong
• Withdraw consent for any communications
• Have your data deleted entirely

We’ll respond within 30 days — usually much faster.

5. How your email data is handled

Your email address is stored in our customer database (FLAME) hosted in Singapore (AWS Asia Pacific region). Marketing emails are sent through Amazon Web Services Simple Email Service (AWS SES), our email infrastructure provider. AWS processes your email address solely to deliver the email — they don’t use it for their own purposes. AWS’s privacy commitments are at https://aws.amazon.com/privacy/.

When emails bounce (e.g., the inbox is full or the address doesn’t exist) or when you mark them as spam, AWS notifies us so we can stop sending. Our suppression list is permanent unless you ask us to remove your address from it.

We do not:

• Sell, rent, or share your email address with anyone
• Send your details to advertisers
• Use your data for purposes outside what’s described in this policy

6. SMS and WhatsApp messages

We use SMS and WhatsApp for two distinct purposes, and we treat them differently:

• Operational messages— order confirmations, delivery-day reminders and ETAs (e.g., “your driver is 10 minutes away”), and one-time passwords when you log in. These are tied to an active order or sign-in and are necessary to provide the service you asked for.
• Marketing messages— occasional offers, new menu drops and weekend specials, and reminders about an order you started but didn’t finish. If you’ve given us your mobile number (for example, when placing an order or creating an account), we may send you these on WhatsApp unless you tell us to stop. You can opt out at any time — see below.

SMS and WhatsApp are sent via Twilio and, for WhatsApp, the Meta WhatsApp Business Platform. These providers process your phone number solely to deliver the message. Their privacy notices are at twilio.com/legal/privacy and whatsapp.com/legal/business-policy.

You’re in control. Reply STOPto any marketing WhatsApp or SMS to opt out of all marketing messages immediately — we record this against your contact record and check it before every marketing send, so you won’t receive another. Reply START to opt back in. You can also opt out by emailing hello@mandaismokeco.com.

Operational messages continue regardless. Even after you opt out of marketing, we’ll still send the messages that are necessary to fulfil an active order — order confirmations, delivery updates, and login codes — because you need them to receive what you ordered.

7. Cookies and tracking

Our website uses cookies and similar technologies for the following purposes:

• Strictly necessary cookies — keep you signed in, remember items in your cart, and enable secure checkout. These cannot be turned off.
• Analytics cookies — we use Google Analytics, loaded through Google Tag Manager, to understand how visitors use the site (which pages are popular, how customers find us). The data is aggregated and does not identify individuals personally.
• Marketing & advertising cookies — we use the Meta (Facebook) Pixel and Google Ads conversion tracking, also loaded through Google Tag Manager, to measure how our ads perform and to show relevant ads to people who have visited our site. To do this, your browsing and purchase events on our site are shared with Meta and Google for measurement. When we send purchase events to Meta from our servers (Meta’s “Conversions API”), identifiers like your email address and phone number are first converted into an irreversible cryptographic code (“hashed”) before they leave our systems — Meta uses the code only to match the purchase to an ad and then discards it. We never share your details with any platform in readable form.

Custom audiences. We may also use our customer list (your email address and phone number, hashed as described above) to ask Meta and Google to show our ads to existing customers, to stopshowing acquisition ads to people who are already customers, or to reach new people with similar interests (“lookalike audiences”). The platforms use the hashed identifiers solely for this matching and cannot read them. If you’d rather not be included, email hello@mandaismokeco.com with “remove me from ad audiences” and we’ll take you out of every uploaded audience within 10 business days. This doesn’t affect your orders, account, or loyalty points in any way.

You can clear or block cookies through your browser settings — doing so may break parts of the site (e.g., your cart or sign-in). You can also opt out of personalised advertising directly with the platforms: Meta at facebook.com/adpreferences, Google at adssettings.google.com, and Google Analytics via the browser opt-out add-on.

8. Payment processing

Payments on our website are processed by Airwallex, our payment provider. When you pay, your card details are sent directly to Airwallex over an encrypted connection — they never touch our servers. We receive a confirmation that the payment succeeded along with a transaction reference, but not your card number, CVV, or expiry date.

Airwallex’s privacy practices are described at https://www.airwallex.com/legal/privacy-policy.

9. Third parties we work with

To run our business, we share specific data with the following processors. Each is contractually limited to processing your data only for the purpose listed:

• Amazon Web Services (AWS) — hosts our customer database and sends our emails. Singapore region.
• Airwallex — processes card payments.
• Twilio — sends SMS and WhatsApp messages (delivery updates, OTP, and marketing).
• Meta Platforms (WhatsApp Business Platform) — delivers our WhatsApp messages, including operational updates and marketing you haven’t opted out of.
• Google — verifies your identity if you sign in with Google, and provides our website analytics and advertising measurement (Google Tag Manager, Google Analytics, Google Ads).
• Meta (Facebook) — provides advertising measurement via the Meta Pixel and Conversions API, and audience matching using hashed identifiers (see section 7).

We do not share your data with anyone else. We do not sell, rent, or trade personal data under any circumstances. If our processors change, we’ll update this list.

10. Data security and retention

Your data is stored on encrypted databases in AWS Asia Pacific (Singapore). Access is restricted to a small number of authorised staff and administrative tools, all protected by strong authentication. We use TLS encryption for every connection between your browser and our servers.

We retain personal data only for as long as we need it:

• Order records: 7 years (required for Singapore tax compliance).
• Marketing email consent and unsubscribes: kept indefinitely so we honour your unsubscribe forever.
• Loyalty data: retained while your account is active; archived 12 months after your last order or interaction.
• Inactive accounts: deleted on request, or after 5 years of complete inactivity.

11. Your rights

Under Singapore’s Personal Data Protection Act 2012 (PDPA), you have the right to:

• Access the personal data we hold about you (PDPA s.21).
• Correct inaccurate or incomplete data (PDPA s.22).
• Withdraw consent for any processing where consent was the legal basis (PDPA s.16).
• Request deletion of your data, subject to legal retention requirements above.
• Lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

If you’re an EU/UK resident, you have equivalent rights under GDPR including the right to data portability and the right to object to processing. To exercise any of these rights, email hello@mandaismokeco.com. We’ll respond within 30 days.

12. Children’s privacy

Mandai Smoke Co.is intended for adult customers placing food orders. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with data, please contact us and we’ll delete it.

13. Changes to this policy

We may update this policy as our business changes (new features, new processors, new legal requirements). When we make material changes, we’ll update the “Last updated” date at the top of this page and — if the change is significant — notify you via email. Your continued use of our website after a change constitutes acceptance of the updated policy.

14. Contact us · PDPA Data Protection Officer

Mandai Smoke Co. complies with the Singapore Personal Data Protection Act 2012. For data protection enquiries, please contact our Data Protection Officer:

• Mandai Smoke Co.
• Email: hello@mandaismokeco.com
• WhatsApp: 8085 1405
• Singapore