Privacy Policy

1. Who we are

Pastry Corner Cafe & Lounge is a restaurant and bakery located at 14027 Lee Jackson Memorial Hwy, Chantilly, VA 20151. When this Policy refers to “we,” “us,” or “our,” we mean Pastry Corner Cafe & Lounge. The website https://pastrycornercafe.com is operated on our behalf by JSVV SOLS LLC, acting as our data processor for hosting and technical operations.

2. Information we collect

We only collect information that's necessary to fulfill your order or respond to your enquiry. Categories include:

• Order information: the items you order, special instructions, spice level, pickup or delivery selection, and pickup time.
• Contact information: your name, phone number, email address, and (for delivery) your delivery address.
• Payment information: handled directly by Stripe. We never see your full card number, CVV, or bank credentials. Stripe shares only a transaction reference and the last four digits with us.
• Custom-cake and catering enquiries: the details you provide in the enquiry form (event date, guest count, preferences, dietary needs, photo references).
• Account information (if you choose to create one): your email, hashed password, and order history.
• Technical information: aggregated, anonymised data about how you use the site (pages visited, device type, approximate location at city level). See § 5.

3. How we use your information

• To prepare, fulfill, and deliver your order.
• To contact you about order status (ready for pickup, delivery on its way, item out of stock).
• To respond to custom-cake or catering enquiries with quotes and follow-ups.
• To process payments and issue refunds when needed.
• To improve the menu, the website, and the ordering experience based on what works and what doesn't.
• To send you occasional offers or seasonal updates — only if you've explicitly opted in. You can unsubscribe at any time using the link in any email.
• To comply with applicable law, tax reporting, and food-safety recordkeeping requirements.

We do not sell your personal information. We don't share it with advertising networks, data brokers, or third parties for their independent marketing.

4. Service providers we share data with

To run the ordering and delivery experience, we share the minimum data needed with the following trusted vendors. Each processes your information only on our instructions and under their own published privacy commitments:

• Stripe — payment processing. stripe.com/privacy
• Clover — in-restaurant Point of Sale. Web orders are forwarded to our Clover system so the kitchen can prepare them and print receipts. clover.com/privacy-policy
• DoorDash Drive — last-mile delivery dispatch for delivery orders. We share the delivery name, address, phone, and order details with the driver. doordash.com/privacy
• Google Business Profile — if you leave us a public review, Google's privacy practices apply to that content.
• Neon — managed PostgreSQL database provider that hosts our order records. neon.tech/privacy-policy
• Umami Analytics — self-hosted, privacy-friendly analytics. No cookies, no cross-site tracking, no personal identifiers.
• JSVV SOLS LLC — agency of record that builds, hosts, and maintains this website as our data processor.

5. Cookies & analytics

We use a small number of strictly-necessary cookies to keep your cart together while you browse, keep you signed in (if you have an account), and remember your delivery preferences. We don't use third-party advertising cookies or cross-site tracking pixels.

For traffic analytics we use Umami, a privacy-friendly analytics tool that doesn't set cookies and doesn't identify individual visitors. Aggregated counts (page views, referrers, browser type) help us improve the site.

6. Your rights

Regardless of which state you live in, you have the right to:

• Ask what personal information we hold about you.
• Ask us to correct any inaccurate information.
• Ask us to delete your information (subject to legitimate recordkeeping needs, e.g., tax or food-safety records).
• Opt out of marketing emails at any time.
• Request a portable copy of your information in a common format.

California, Virginia, Colorado, Connecticut, and Utah residents have additional rights under their respective state privacy laws, including the right to opt out of the sale or sharing of personal information — which we don't do. To exercise any right, email us at [email protected].

7. Children's privacy

This website is intended for adults. We don't knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

8. Data security

All traffic to and from this site is encrypted (HTTPS). Payment card data is tokenised by Stripe and never stored on our servers. Account passwords are stored as one-way hashes. Order records are kept on managed PostgreSQL infrastructure with continuous encrypted backups. We work to follow industry best-practices, though no system on the internet is 100% secure.

9. Data retention

Order records are retained for at least 4 years to comply with Virginia tax and recordkeeping rules. Account profiles are retained until you ask us to delete them. Analytics data is aggregated and retained indefinitely in non-identifiable form.

10. Changes to this policy

We may update this Policy from time to time. Material changes will be announced at the top of this page with a new effective date. Continued use of the site after a change means you accept the updated Policy.

11. Contact us

Questions, complaints, or rights requests:

• Email: [email protected]
• Phone: (703) 263-1466
• Mailing address: 14027 Lee Jackson Memorial Hwy, Chantilly, VA 20151