Privacy Policy

Diplaxmi Kitchen Store (registered as Deeplaxmi Kitchen Stores) is a kitchen-products store in Chandragiri 44600, Nepal. This website lets customers browse our products and order them for store pickup or delivery. In this policy, “we”, “us” and “our” mean Diplaxmi Kitchen Store.

You can contact us about this policy or your information at:

• Email: diplaxmikitchenstore@gmail.com
• Phone: +977 981-8579292
• Store address: Diplaxmi Kitchen Store, Chandragiri 44600, Nepal

• Account details: your full name, mobile number, email address and a password. Passwords are handled by Firebase Authentication and are not stored in our own database.
• Checkout details: your name, email address and mobile number, which are required to place an order and to send you its confirmation, invoice and updates. We also record whether you choose store pickup or delivery, and for delivery the address you select, its map location and any landmark. You can also add order notes.
• Order details: the products, quantities, prices, delivery fee, payment method, invoices, and the status of your order and payment.
• QR payment receipts: when you pay by QR, the receipt image you upload, the transaction reference number, the store account you paid into and any note you add.
• Cancellation and return requests: the reason you give and any photos or videos you upload. If a refund is paid by bank transfer or wallet, the account holder name and account or wallet number needed to send it. We never ask for your PIN, OTP, password or card security code for a refund.
• Reviews: your rating, review text and any photos you add.
• Messages: what you send us by WhatsApp, phone or email. Our contact form does not store your message on this website — it opens WhatsApp with your message filled in, and you choose whether to send it.

Accounts are managed with Firebase Authentication, a Google service. You can sign in in these ways:

• Mobile number and password. Your mobile number is your sign-in name, and Firebase Authentication checks your password. Behind the scenes this uses Firebase’s Email/Password sign-in method with an internal identifier made from your mobile number. That identifier is never used to send you email.
• Google Sign-In (“Continue with Google”). Google shares your basic profile with us: your name, your email address, whether Google has verified that email address, and an account identifier. We use this only to sign you in, to create or link your account, and to fill in your name and email address. We do not request any additional Google permissions, so we cannot see your Gmail, contacts, Drive, calendar or any other Google data, and we never post to your Google account. We do not store your Google profile photo. Google Sign-In is used only for authentication.
• Phone verification (one-time code). We verify mobile numbers with a one-time code sent by SMS through Firebase Authentication, which uses reCAPTCHA to block automated abuse. To prevent misuse we record each verification attempt — the mobile number, the result, the time and a one-way scrambled form of your IP address. The code itself is never stored.

When you give us an email address that has not already been verified by Google, we send a link to confirm it belongs to you. Some sign-in and verification requests are also checked with Firebase App Check, which uses Google reCAPTCHA Enterprise. reCAPTCHA looks at information about your device and browser, and its use is governed by Google’s Privacy Policy and Terms of Service.

• You can order without creating an account. A guest order needs your name, email address and a mobile number verified by a one-time code. Your verified details are remembered in that browser, so you are not asked to verify again there.
• An account lets you see your orders, request cancellations and returns, and sign in again later. To place an order, a registered customer needs a verified email address and a verified mobile number.
• If you later create an account and verify the same mobile number or email address you used as a guest, your guest details may be joined to that account.
• Your cart and wishlist are stored on our servers. If you are signed in they belong to your account. If you are not, they are linked to a random identifier stored in a cookie, and they are added to your account when you sign in.

We use your order information to prepare your order, arrange store pickup or delivery, issue invoices and keep you updated. We send emails about your account and orders, such as order confirmation, payment updates, invoices, cancellations, returns and refunds. These emails are sent through Brevo, an email delivery service. When you contact us, we use what you tell us to answer you and help with your order.

• When you search for a delivery address, the text you type is sent through our servers to Google Maps Platform, which suggests matching addresses in Nepal.
• The “use my current location” option only works if you press it and allow your browser to share your location. Your browser then shares your precise coordinates, and we send them to Google Maps Platform to find the matching address. We do not track your location in the background.
• To check whether we can deliver to an address, and to work out the delivery fee, we calculate the driving distance from our store with Google Maps Platform.
• The map location of the delivery point you choose is saved with the delivery quote and with your order.
• If you choose store pickup, you do not need to give an address.

If you pay by QR, you upload a picture of your payment receipt after placing your order. Receipts are checked automatically for file safety and then kept in private cloud storage. They are not public. Only authorised store staff can view them, through links that expire after a few minutes, to check your payment.

Staff either approve the receipt, which marks your order as paid, or reject it with a reason. We email you the result either way, and after a rejection you can upload a new receipt.

We use a small number of cookies of our own to keep the website working, plus Google Analytics cookies to understand how the website is used:

Firebase Authentication also keeps your sign-in state in your browser’s storage until you sign out, and our pages use short-lived browser storage so that one purchase is not counted twice.

Google Analytics records the pages and products you view, searches, cart and checkout steps and completed orders (the order number and amounts), along with information about your device and browser. Google may estimate your general location from your IP address. We do not send your name, email address, mobile number or delivery address to Google Analytics. You can block or delete cookies in your browser settings, or use Google’s Analytics opt-out browser add-on.

We also keep a record of searches made on the website to improve search results. If you are signed in, the search is linked to your account. Like most websites, our servers keep technical logs of requests and errors, and we remove passwords, codes and similar sensitive values from them.

• To create and manage your account, sign you in and verify your mobile number and email address.
• To take, prepare and fulfil your orders, work out delivery availability and fees, and issue invoices.
• To verify payments and to handle cancellations, returns and refunds.
• To send you emails about your account and orders.
• To answer your questions and give support.
• To publish reviews you submit.
• To understand how the website is used and improve it.
• To protect the website and our customers from fraud, abuse and security threats.
• To keep business, accounting and tax records.

We use these services to run the website. They receive only the information they need to do their job, and each has its own privacy policy:

• Google Firebase and Google Cloud: account sign-in and SMS verification codes (Firebase Authentication), website hosting (Firebase App Hosting), our database, private file storage for receipts and return photos, and security checks (App Check and reCAPTCHA). Our database and files are stored in Google Cloud’s Singapore region (asia-southeast1).
• Google Maps Platform: address suggestions, turning a location into an address, and delivery distance.
• Google Analytics: website usage measurement.
• Brevo: sending emails about your account and orders.
• WhatsApp: only when you choose to contact us through it.

We do not sell or rent your personal information. We share it only:

• With the service providers listed above, to run the website.
• With authorised store staff who handle orders, payments, pickup, delivery, returns and support. Staff access is limited by role.
• When the law requires it, or when it is needed to protect our customers, our business or others from fraud or harm.
• Publicly, only when you publish a review: approved reviews show your name, your review and any photos you added.

The website is served only over HTTPS. Sign-in cookies cannot be read by page scripts. Receipts and return photos are kept in private storage. Staff access depends on their role, and verification codes, uploads and searches are rate-limited to prevent abuse. No system is completely secure, but we work to protect your information and to limit who can see it.

We keep your information for as long as we need it to provide your account and orders and to support you, and to keep the business, accounting and tax records we are required to keep. Some technical records, such as verification-attempt and rate-limit logs, are deleted automatically after a shorter time.

• You can see your orders and account details under My Account when you are signed in.
• You can ask us for a copy of your information, or ask us to correct or delete it, by emailing diplaxmikitchenstore@gmail.com. We may need to confirm your identity first. We will delete or correct what we can, but we will keep records we are required to keep, such as order and invoice records.
• You can refuse location access and type your address instead, or choose store pickup.
• You can block or delete cookies in your browser. If you block our own cookies, sign-in, cart and checkout will not work.
• Signing out removes your sign-in from that browser.

This website is meant for adults placing orders for their households. It is not directed at children, and we do not knowingly collect information from children. If you believe a child has given us personal information, please contact us and we will help remove it.

We may update this policy when our website or services change. Please check back from time to time.

For questions or requests about your privacy, contact us:

• Email: diplaxmikitchenstore@gmail.com
• Phone: +977 981-8579292
• Store address: Diplaxmi Kitchen Store, Chandragiri 44600, Nepal