Privacy Policy — Oh Bombay

Effective date: October 29, 2026

This policy explains what information the Oh Bombay mobile app and online ordering service ("the app") collect, how it is used, and the choices you have. It is written to describe exactly what the app does — nothing more. It also covers the forms on our website, ohbombayrestaurant.com.

Oh Bombay ("we", "us") operates restaurants in Oakville, Burlington and London, Ontario, Canada. The app exists for one purpose: letting you browse our menu and place food orders for pickup or delivery.

Information you provide

On our website (ohbombayrestaurant.com)

• A job application sends us your name, email address and phone number, the role and location you are interested in, your availability and earliest start date, your experience, and what you tell us about yourself.
• A catering inquiry sends us your name, email address and phone number, and the details of your event: its type, date, number of guests, location, the style of service you want, the restaurant you prefer, and your message.
• A franchise inquiry sends us your name, email address and phone number, the market you are interested in, your business experience, your timeline, and your message.
• Booking a table sends us your name, email address and phone number, the date, time and size of your party, and any note you add. We email you a confirmation and, on the day, a reminder, which you can switch off from the link in it.

We use these details only to answer you and to arrange what you asked for. What you send through a form is emailed to our team and kept in our systems for six months, then deleted; a table booking is confirmed on the spot, can be cancelled from the link in its email, and is deleted six months after the visit.

A copy of each form and table booking you send through our website is also kept by The Giraffe Company, the agency that runs our website and marketing, so we can see how many inquiries and bookings we receive. With it goes the page you sent it from and your browser's name and version; only if you accept cookies does it also note how you reached our website (the page you arrived on, the website or Google ad that sent you, and the Google Analytics identifier). Their copy is deleted after six months too.

When you place an order

• Your name, so the kitchen and counter staff can identify your order.
• Your email address and/or phone number, if you choose to provide them — used for your receipt and to connect your orders to you if you return.
• A delivery address, only if you choose delivery.
• The contents of your order, any notes you add to it, and your tip.

You can order as a guest. An account is never required.

If you create an account (optional)

Sign-in uses a one-time code sent to your email — there are no passwords. An account stores your name, email, phone number, saved delivery address, order history, and (if you choose to save a card) a reference to your saved payment card. You can delete your account at any time inside the app (Account → Delete account), which removes this information.

If you use a gift card or loyalty

Checking a gift card balance uses the gift card number you enter. If you join our loyalty program, your phone number identifies your loyalty account.

Payment information

Card payments are processed by Square (Block, Inc.), our payment processor. When you enter a card, the card form is provided directly by Square: your full card number, expiry, and security code go to Square and never touch our systems. We receive only a one-time payment token and a masked reference (card brand and last four digits). If you save a card to your account, it is stored by Square, not by us. Square's handling of your payment data is described in Square's privacy policy.

Information collected automatically

• Order status notifications (optional): if you allow notifications, the app registers a push token for your device so we can tell you when your order is ready or your delivery is on the way. Decline or disable notifications any time in your device settings; ordering works fully without them.
• Diagnostics: if the app or our service encounters an error, technical details (device model, operating system version, app version, and what went wrong) are reported to our error-monitoring service so we can fix problems. These reports are not used for advertising or profiling.
• On your device: your cart, favourites, and recent orders are stored locally on your phone for convenience. They stay on the device.
• On our website: your basket and the restaurant you picked are remembered in your browser, so they are there when you come back. The restaurant is also kept in a cookie, `oh-bombay-location`, which holds only its name and lasts up to 400 days, or until you clear your browser's data.
• Website analytics (our websites only, and only if you accept): on ohbombayrestaurant.com and order.ohbombayrestaurant.com we use Google Analytics to understand how the site is used — which pages are opened, which dishes are looked at, and whether an order is completed — so we can make ordering better. If you accept cookies, Google Analytics stores two cookies in your browser, `_ga` and `_ga_RPZJB9EN97`, which hold a randomly generated identifier for the browser rather than anything about you. We have also turned on Google signals, one of Google's advertising features: if you are signed in to a Google account and allow Google to personalize ads, Google can connect your visits from different devices and add approximate age, gender and interests to our reports. We only ever see totals across many visitors, never who you are, and you can switch it off by turning off ad personalization in your Google account (My Ad Center). We do not use Google Analytics to show you ads, and we do not sell or share this information. The data is kept for 14 months and then deleted automatically. If you decline, no analytics cookie is stored; before you answer, measurement is anonymous and cookieless. Your answer is shared between our websites, so you are asked once (and once more if you accepted before we added the Google Ads measurement and PostHog below). The mobile app does not do this — this paragraph is about the websites alone.
• Google Ads measurement (ohbombayrestaurant.com only, and only if you accept): we advertise on Google Search. If you accept cookies, Google Ads stores cookies in your browser (`_gcl_au`, and `_gcl_aw` when you arrive from one of our ads) that note which ad, if any, brought you to the site, so we can count how many orders and table bookings our ads lead to. They are kept for 90 days. With an order we send Google its order number and its value before tax and tip; with a table booking, its booking number and the size of the party. We never send your name, email address, phone number or what you ordered. Our Google Analytics is linked to our Google Ads account so that each can report what the other measured, but we do not use either to show you personalized ads, and we do not sell or share this information. If you decline, Google Ads stores no cookie; before you answer, measurement is anonymous and cookieless.
• Visitor behaviour (ohbombayrestaurant.com only, and only if you accept): we use PostHog to see, across many visits, where visitors click, how far they scroll and read, where they leave a page, how quickly pages load and when a page shows an error, so that The Giraffe Company, the agency that runs our website, can find and fix the places where it makes ordering or booking harder. If you accept cookies, PostHog stores a cookie and an item in your browser's storage, both named after our PostHog project and beginning `ph_`, which hold a randomly generated identifier for the browser rather than anything about you. PostHog does not record your screen, never sees what you type into a form, and is never told your name, email address or phone number: when you send a form, book a table or place an order, it is told only that one happened, which kind it was and, for an order, its value before tax and tip. PostHog also works out from your IP address roughly where you are browsing from (the city, the province or state, the country and the postal area) and keeps that approximate location with each visit; the IP address itself is not stored. PostHog keeps this information in the United States for up to seven years, and we and The Giraffe Company only ever look at totals across many visitors. If you decline, PostHog is not loaded at all. The mobile app does not do this.

What we do NOT do

• We do not sell or rent your information to anyone.
• Our app and websites show no ads, and we never use your information to target advertising at you: our Google ads are shown to people searching Google, not chosen for you from what you did on our websites. The mobile app uses no advertising or cross-app tracking technology; Google signals and Google Ads measurement, described above, are used on our websites only.
• We do not access your device's location, contacts, photos, or microphone.
• We collect nothing for purposes unrelated to your orders and table bookings.

How we use your information

• To prepare, deliver, and hand over your orders, and to send your receipt.
• To tell you the status of an order you placed.
• To confirm your table booking, remind you of it on the day, and tell you if we have to change it.
• To process refunds and respond when you contact us about an order.
• To operate loyalty rewards and gift cards, if you use them.
• To keep the service secure and to meet legal obligations (for example, tax and bookkeeping records of sales).

Who we share it with

Only the service providers needed to run the app, and only for the purposes above:

We may also disclose information if required by law. If our business is ever sold or reorganized, order records may transfer as part of that business.

Data retention

Order and payment records are kept as required for business, tax, and accounting purposes. Account information is kept until you delete your account. Push tokens are kept only while notifications are enabled for your device. What you send through our website's forms is deleted from our systems after six months, and a table booking six months after the visit; the copy The Giraffe Company keeps of each is deleted after six months. PostHog's record of how visitors use ohbombayrestaurant.com is kept for up to seven years.

Your choices and rights

• Delete your account any time in the app: Account → Delete account.
• Order as a guest and provide only your name.
• Turn off notifications in your device settings.
• Decline cookies on the bar at the foot of our websites, or change your answer later by clearing the site's cookies. Declining turns off Google Analytics, Google Ads measurement and PostHog alike.
• Keep your visits out of Google signals by turning off ad personalization in your Google account (My Ad Center), or stop Google Analytics in your browser altogether with Google's opt-out add-on.
• Ask us to access, correct, or delete personal information we hold about you — contact us using the details below. We handle personal information in accordance with Canadian privacy law, including PIPEDA.

Security

All communication between the app and our servers is encrypted in transit. Payment card details are handled exclusively by Square's certified payment systems. Access credentials we hold are stored encrypted.

Children

The app is a food-ordering service intended for general audiences and is not directed at children under 13. We do not knowingly collect personal information from children.

Changes to this policy

If our practices change, we will update this page and its effective date. Material changes will be noted in the app.

Contact us

Questions or requests about your personal information:

• Oh Bombay Oakville — 376 Iroquois Shore Rd, Oakville, ON L6H 1M4 · +1 905-582-8444
• Oh Bombay Burlington — 671 Appleby Line, Burlington, ON L7L 2Y5 · +1 905-582-8444
• Oh Bombay London — 631 Commissioners Rd E, London, ON N6C 2V1 · +1 519-914-3139
• Or through the contact options at ohbombayrestaurant.com