Privacy Policy

Last updated: April 19, 2026

We respect your privacy. This policy explains what personal data we collect through the CurryHouse app and website, how we use it, and your rights under the General Data Protection Regulation (GDPR).

1. Who We Are

CurryHouse operates the online ordering service at curryhousejar.no and the mobile apps on Google Play and the Apple App Store. For GDPR purposes we are the data controller. Contact: orders@curryhousejar.no

2. Data We Collect

We collect only what is necessary to provide our ordering service:

Account information: Full name, email address, phone number, and password (stored hashed).
Order information: Items ordered, special instructions, timestamps, and order status.
Device data (mobile only): Push notification token for order status updates only.

We do not collect payment data (orders are paid at pickup). We do not use analytics SDKs, advertising networks, or third-party tracking.

3. How We Use Your Data

To create and manage your account.
To process and fulfil your food orders.
To send push notifications about your order status — only if you grant permission.
To send an email receipt if you provide your email at checkout.

Legal basis: performance of a contract (your order) and legitimate interest (order notifications).

4. Push Notifications

The mobile app requests permission to send push notifications solely for order status updates. You can withdraw permission at any time in your device Settings → Notifications → CurryHouse.

5. Data Sharing

We do not sell or rent your personal data. We share data only with:

Firebase Cloud Messaging (Google): Your push token is transmitted solely to deliver order notifications.
Our hosting providers, under data processing agreements.

6. Data Retention

We retain your data while your account is active. When you delete your account, personal data is removed within 30 days, except records required for legal purposes.

7. Your Rights (GDPR)

You have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing. To delete your account immediately, use Delete Account (sign in required). For other requests email orders@curryhousejar.no — we respond within 30 days.

You may also lodge a complaint with Datatilsynet (Norwegian Data Protection Authority).

8. Security

All data is transmitted over HTTPS. Passwords are hashed and never stored in plain text. Production data access is restricted to authorised personnel.

9. Children's Privacy

Our service is not directed at children under 16. Contact us at orders@curryhousejar.no if you believe we have inadvertently collected such data.

10. Changes & Contact

We may update this policy and will notify you of material changes by updating the date above. Questions? Email orders@curryhousejar.no.