Privacy Policy

This policy explains what happens to your personal data when you visit this website. It applies to this site and to anyone who browses the menu, generates a QR code, or gets in touch with us through it.

Last updated 16 August 2026

We have kept this short because, today, there is not much to tell. This is a static website: there are no accounts, no logins, and no forms anywhere on it. Almost everything below describes what happens automatically when a page loads, plus one section reserved for a feature we have not built yet.

Who is responsible for your data

This website is operated by CUC — Cafe Under Construction, 1st Floor, Kanneri Arcade, Opp. Traffic Enforcement Unit, East Ottapalam, Kerala. Under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act), that makes us the “Data Fiduciary” for any personal data this website processes — the DPDP Act’s term for who GDPR-style laws elsewhere call the “controller”.

For anything in this policy, including a question or request about your own data, contact us on WhatsApp or by phone — +91 89214 88787.

Our full registered business name and any applicable licence numbers (e.g. FSSAI) will be added here once confirmed. This does not change who you can contact in the meantime.

What this website collects today

Nothing you type, because there is nowhere on this site to type anything. There is no contact form, no newsletter signup and no way to create an account. The only things that happen automatically are:

Page requests: Loading any page on this site is a request to our host, Vercel — see Hosting below.
The table number in a menu link: Table QR codes point to a URL like /menu?t=4. That number is read by nobody: the menu page does not log it, store it, or send it anywhere. It exists so a future ordering feature can use it — see When you order or book below.
Anonymous, cookieless page-view counts: We use Plausible Analytics to see roughly how many people visit which pages — see Analytics below.

That is the complete list. We do not ask you to register, log in, or provide any personal detail to browse the menu, view directions, or generate a QR code.

Cookies

This website sets no cookies. There is no login to remember, no shopping cart, and no advertising or tracking script of any kind. Because nothing on this site sets a cookie, there is no cookie banner — a banner asking your permission for something we do not do would be its own kind of dishonesty.

Analytics

We use Plausible Analytics to understand which pages are visited and roughly how much traffic the site gets. Plausible is built to run without cookies and without tracking you individually: it counts visits in aggregate, does not build a profile of you across visits, does not share or sell data, and does not track you across other websites. It uses your IP address for the moment of the request only, to work out your rough country and device type, and does not store the IP address itself.

Because this analytics method does not identify you and sets no cookie or similar device storage, no separate consent banner is shown for it.

Hosting

This site is hosted on Vercel. Like any web host, Vercel keeps its own operational logs of the requests it serves, and those logs necessarily include visitors’ IP addresses — that is how the internet delivers a page to the right place, not something we ask for. Our own code never reads, stores or uses your IP address. Vercel serves this site from a global network and is based in the United States.

WhatsApp, phone and Instagram

The WhatsApp and phone links on this site do nothing until you tap them. Nothing is sent, opened or recorded on our side just because you loaded a page with one of these links on it.

If you tap WhatsApp Us, your phone opens a chat with our WhatsApp number and that conversation happens inside WhatsApp, on Meta’s own systems, governed by Meta’s terms and privacy policy rather than by this one. If you tap our phone number, your phone simply dials it.

The Instagram link in our footer and Visit section takes you to our Instagram profile on Instagram’s own site or app. We do not embed an Instagram feed on this website today, so nothing from Instagram loads or tracks you until you actually click through.

Google Maps

The map on this site does not load until you tap Tap to load interactive map. Before that tap, no request is made to Google. Once you tap it, an embedded Google Map loads in its place, and Google’s own privacy policy applies to that embed — Google Maps may set its own cookies and collect data in line with Google’s practices, which are outside our control.

When you order or book (coming in Phase 1 — not active yet)

This website does not yet offer ordering, table booking, or payments. This section is a placeholder for when that feature launches, so it is documented in advance rather than added quietly later. When it goes live, this section will be rewritten with the specifics of how that feature actually works, but we expect it to involve collecting:

your name, so staff know whose order it is;
your phone number, so we can reach you about your order or booking;
your order or booking details — items, quantities, a table or RC Play Zone session, and any special requests.

We expect to use this only to prepare and fulfil your order or booking, not for marketing, and not to sell or share it with anyone outside what is necessary to serve you (for example, a payment processor, if one is added). Until this feature exists, no such data is collected by this website in any form.

Your rights under the DPDP Act

As a “Data Principal” under the DPDP Act, you have rights over any personal data we do process about you, including to:

Access: Ask what personal data we hold about you and get a summary of it.
Correction and erasure: Ask us to correct inaccurate data, complete incomplete data, or erase data we no longer need it for.
Grievance redressal: Raise a complaint about how your data has been handled and have it looked into.
Nominate: Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity — a right specific to the DPDP Act.
Withdraw consent: Where we rely on your consent to process something, withdraw that consent at any time.

Today, this website does not collect personal data that these rights would typically act on — there is nothing to access, correct or erase because nothing is stored. We are listing them now so this policy is ready for Phase 1, and because the right to raise a grievance applies regardless. To exercise any of these rights, contact us on WhatsApp or by phone — +91 89214 88787.

If you are unhappy with how we have handled a request, you may escalate a complaint to the Data Protection Board of India, the statutory body established under the DPDP Act.

Children

This website is not directed at children, and today it does not knowingly collect personal data from anyone. If that changes under Phase 1 ordering, we will update this policy accordingly.

Security

This site is served over an encrypted (HTTPS) connection. The strongest protection today is structural: because the website itself stores nothing, there is no database of visitor data on it to be breached.

Changes to this policy

If what this website does with personal data changes — most notably, when ordering or booking launches — we will update this page and the date at the top of it. The date is the honest way to tell whether what you are reading is current.