Privacy Policy

1. Who handles your information

JUNHENG CHEN operates Grandma's Chinese Kitchen and is responsible for personal information processed to operate this website, customer accounts and digital delivery.

Contact address: Unit 2, Building 10, Xingfu Yuan, Longshan District, Liaoyuan, Jilin, China.

Privacy contact: chinese_kitchen@163.com

Dodo Payments separately handles personal information for its Merchant of Record activities under its applicable privacy notice.

2. Information we process

• Account information: your email address, account creation record, login challenges, verification attempts and session records.
• Purchase information: selected products, order references, payment references, amounts, payment status and customer details received from the payment provider.
• Purchase permissions and any recorded checkout choices, including the wording and version of terms presented, consent times and delivery or confirmation events.
• Security information: request information, technical logs and rate-limit records. Our login rate limits use hashed email and IP identifiers. Hashing does not necessarily make this information anonymous.
• Support information: messages and information you provide when asking for assistance.

Information comes from you, your interaction with the service, and payment or delivery providers. We do not directly store your full payment card number or card security code.

3. Purposes and legal grounds

Where EU or UK data protection law applies, we process information on the following grounds:

• Contract and steps requested before a contract: creating your account, enabling checkout, verifying purchases, providing My Kitchen access and handling support.
• Legitimate interests: protecting accounts, preventing fraud and abuse, maintaining service security and establishing or defending legal claims, subject to your rights and interests.
• Legal obligations: retaining or providing records where an applicable legal obligation requires it.
• Consent: optional activities where consent is required. You can withdraw that consent without affecting the lawfulness of earlier processing.

Agreement to immediate digital delivery is separate from privacy consent and does not authorise unrelated marketing or tracking. Without information necessary for account access or delivery, we may be unable to provide those services.

4. Providers and disclosures

Providers used for the service include Dodo Payments for transactions, Vercel for hosting, Neon for database services, Cloudflare R2 for file storage and delivery, and Resend for sending account and purchase emails.

Providers receive information needed for their functions. Their role and responsibilities depend on the service and applicable agreements. We may also disclose information where legally required or necessary to establish, exercise or defend legal rights.

Do not include passwords, verification codes, full card details or identity documents in ordinary support emails.

5. Cookies and browser storage

We use essential authentication cookies:

• kitchen_login: identifies a login challenge and expires after 10 minutes.
• kitchen_session: maintains your signed-in session for up to 30 days, unless you sign out or the session is revoked.

Signing out removes these cookies and deletes the current session record. It does not delete your account or orders, or sign out other devices.

Cookie settings in your browser can block or remove cookies, but blocking essential cookies may prevent sign-in and access to your collection.

Non-essential analytics or advertising technologies, if introduced, require separate information and any consent required by applicable law. Acceptance of website terms does not provide that consent.

6. Retention

Login codes are valid for 10 minutes and become unusable after successful use. Sessions expire after 30 days. These validity periods do not mean the underlying database records are automatically deleted at expiry.

Retention is determined by the purpose of the record: account and purchase entitlement information supports continued access; transaction records may be needed for applicable legal obligations and disputes; security records are needed only for relevant security purposes; support records are retained as needed to resolve the request and related claims.

Contact us for an account deletion or retention enquiry. Some records may need to be retained where permitted or required by law. We will explain any applicable restriction.

7. International processing

The website operator is based in China. Information may be accessed there and processed in other countries by our service providers. Those countries may have different data protection laws from your country.

International processing remains subject to applicable data protection requirements. Acceptance of this policy is not consent to an international transfer. Contact us for information about the locations and arrangements relevant to your data.

8. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction of processing or data portability; object to processing based on legitimate interests; and withdraw consent where processing relies on consent.

Send requests to chinese_kitchen@163.com. We may need proportionate information to verify your identity and will respond within the applicable legal time limit. Rights are subject to legally permitted conditions and exceptions.

You may complain to the data protection authority competent for your situation, including the authority in your EU country or the UK Information Commissioner. You do not have to contact us before making a complaint.

9. Security and policy changes

Authentication cookies are HttpOnly, use SameSite=Lax and use Secure in production. Session tokens are stored in hashed form in our database. No system can guarantee absolute security.

Updates to this notice will display a new revision date. Where required, we will provide additional notice or obtain consent before introducing a new processing activity.

See our Terms and Refund & Cancellation Policy.