Legal

Privacy Policy

Version 1.1 · Last updated 6 September 2026

This Privacy Policy explains how FEELINGS&FLAVOURS (OPC) PRIVATE LIMITED (GSTIN 36AAGCF5256J1ZD, registered office at VILLA NO 21, LIBDOM VILLAS, GANDHAMGUDA, PERENCHERUVU, Hydershahkote, Golconda, Hyderabad - 500091, Telangana) ("Spattoo", "we", "us", "our") collects, uses, shares, and protects your personal data when you use the Spattoo platform, websites, baker storefronts, the 3D cake designer, and related services (the "Platform").

We are committed to handling personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and rules thereunder and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

By using the Platform, you consent to the practices described here. If you do not agree, please do not use the Platform.

1. Our Roles: Who Controls Your Data

Spattoo serves two kinds of users, and our role differs accordingly:

For Bakers and marketing-site visitors: For the account, subscription, billing, and website data we collect from Bakers and prospective Bakers, Spattoo is the Data Fiduciary (the entity that determines the purpose and means of processing).
For a Baker's End Customers: When a Customer uses a Baker's storefront and provides details to request or order a Cake, that data is collected to enable the Baker to serve the Customer. As between Spattoo and the Baker, the Baker is the Data Fiduciary for that Customer data, and Spattoo processes it on the Baker's behalf (as a Data Processor) to run the storefront, plus for Spattoo's own limited purposes of operating, securing, and improving the Platform and complying with law. The Baker is responsible for its own privacy notice and lawful basis toward its Customers.

This Policy describes the practices for all of the above. Where the Baker is the Data Fiduciary, requests about that data may also need to be directed to the relevant Baker.

2. Personal Data We Collect

2.1. From Bakers (and prospective Bakers)

Identity and contact details: business name, owner/contact name, email, phone number, business address.
Account and authentication data (managed via our auth provider).
Subscription and billing data: plan, billing address, GSTIN (optional), invoices, and payment status. Full card/bank details are handled by our payment processor (Razorpay), not stored by Spattoo.
Storefront and branding data you provide: logo, colours, gallery images, descriptions.
Lead-capture data from the marketing site (for example, name and city submitted in a waitlist or demo request).

2.2. From End Customers (via a Baker's storefront)

First name (required), last name (optional), and email and/or phone number (at least one required) used to send and manage a quote/order and to verify you via a one-time password (OTP).
Design data: the cake Design(s) you create, including saved versions, snapshots, and thumbnail images.
Order/quote data: your request details, messages/notes, quoted price, advance amount, and order status.
Optional images you upload (for example, a portrait/reference image), where the storefront offers that. Where a Baker uses an AI feature on an image, that image is sent to an AI provider outside India — see Sections 3.1 and 6.
Dietary and allergen requirements you choose to state on a quote or order (for example eggless, vegan, Jain, nut-free). These are optional, are recorded as your own statement and passed to the Baker so they can act on it, and are not verified by Spattoo (see Terms of Service Section 3.4). We use them to convey your request to that Baker, to show it on their order screens and production sheets, and — where you ask the Platform to help you choose a flavour — to filter out options that Baker has said they cannot make that way. That filtering uses the Baker's own information and is not a check by us; see Terms Section 3.8.
Details about the cake and the occasion, where you choose to give them: the occasion (for example birthday, wedding), roughly who the cake is for, an approximate age band where you tell us one, any number or wording you want on the cake, the size, and how many tiers. These are optional. They reach the Baker so they can make the right cake, and they help the Platform suggest a flavour.

We do not ask how old anybody is. Where the Platform helps you choose a flavour it asks what kind of celebration it is — for example "a first birthday" or "a children's party" — because that is what changes the cake, and we record that party type rather than any person's age. Where you type a number to go on the cake, we store it as decoration, not as anyone's age. We never ask for or store a date of birth.

Some of what you give us describes someone other than you — the person the cake is for. Please give only what you are comfortable sharing; all of it is optional.

2.3. Collected automatically (technical data)

Basic device and usage data (for example, IP address, browser/device type, approximate region, timestamps, pages/actions), and error/diagnostic logs used for security, fraud-prevention, debugging, and reliability.

2.4. Cookies and similar technologies

We use strictly necessary and functional cookies/local storage to keep you signed in, remember preferences, secure the Platform, and make it work. We also use error-monitoring tools (see Section 6) for diagnostics only.

Analytics. We use Google Analytics on our marketing website to understand how people find and use it — which pages are read, and which links are followed. It sets first-party cookies and reports to Google (see Section 6). We use it to improve the site, not to build a profile of you, and we do not use advertising or ad-retargeting cookies, and do not sell or share personal data with advertisers.

Where analytics does NOT run. A Baker's public storefront ({baker}.spattoo.com) carries no Google Analytics and no Google cookies. Visiting a Baker's shop, designing a cake, or placing an order sends nothing to Google. We count how many times each Baker's storefront was opened using our own systems, so the Baker can see whether their shop is being visited; that count records no information identifying you.

If this changes, we will update this Policy and, where required, seek consent.

We do not knowingly collect sensitive personal data (such as health, biometric, or financial account details beyond what a payment processor requires). Please do not submit such data through the Platform.

3. How We Use Personal Data

We use personal data to:

create and manage accounts, storefronts, and subscriptions;
operate the designer and store, display, and share your Designs;
verify identity via OTP and secure the Platform;
enable a Customer's quote/order request to reach the relevant Baker, and to send related transactional notifications (for example, order-status emails);
process Baker subscription payments and issue GST invoices;
provide support and respond to grievances;
detect, prevent, and address fraud, abuse, security, and technical issues;
suggest a flavour, size, or design when you ask the Platform to help you choose, using what you have told us about the cake and what the Baker offers — a suggestion is a convenience, not advice (see Terms of Service Section 3.8);
operate, analyse, and improve the Platform (including using aggregated or de-identified data) — this includes learning, across orders and in aggregate, which flavours suit which occasions, so that suggestions get better over time; and
comply with legal obligations and enforce our Terms.

3.1. Images and AI features

Some Baker features read an image with an AI model, and some draw a new image from one. Because these send your image outside India, they are set out here rather than left inside the list above.

Reading a photo. A Baker can ask the Platform to read a cake photo and describe what is on it — tiers, frosting, piping, colours — so it can produce a make-it guide. The whole photo is sent to our AI provider (Section 6) for that purpose. The model is instructed to describe the cake only: not to describe, name, or characterise anybody appearing in the image, and to ignore any person who is simply holding or standing near the cake.
Drawing a guide sheet. From a small crop of that photo, the Platform can generate an illustrated sheet showing how a decoration is built. A photograph printed on a cake is never used this way. The Platform detects a printed photo and refuses, because an edible print is printed rather than made by hand — so there is nothing to illustrate, and we will not send a person's face to an image generator.
What we do not do. We do not use these features to identify anyone, to recognise faces, to infer anything about a person, or to build a profile. No feature asks who somebody is.
Whose consent. If you upload a photograph of another person, the person who uploads it is responsible for having that person's consent — and, for a child, verifiable consent from a parent or guardian — before uploading, covering this processing. See Terms of Service Sections 6.3.1 and B5.6.
Printing a photo does not involve AI. Preparing a photo for an edible sheet is layout and printing only. No AI provider is involved and the image is not sent anywhere for that purpose.

4. Legal Basis and Consent (DPDP Act)

We process personal data on the basis of your consent and/or for legitimate uses permitted under the DPDP Act (including where you voluntarily provide data for a purpose, and for performing our services, legal compliance, and security). Where we rely on consent, you may withdraw it at any time (see Section 8); withdrawal does not affect processing already carried out and may limit your ability to use certain features.

5. How We Share Personal Data

We do not sell your personal data. We share it only as follows:

With the relevant Baker. A Customer's request/order details and Design are shared with the Baker whose storefront you used, so the Baker can respond to and fulfil your request. This is the core purpose of the Platform. Your dealings and any further communication or payment are then directly between you and the Baker.
With service providers (Data Processors) who host and run the Platform on our behalf under contractual safeguards (see Section 6).
For legal and safety reasons, where required by law, court order, or governmental request, or to protect the rights, safety, and property of Spattoo, our users, or the public, and to prevent fraud or abuse.
In a business transfer (merger, acquisition, or reorganisation), subject to this Policy.

6. Third-Party Processors and Cross-Border Transfer

We use reputable third-party providers to run the Platform. Some of them process or store data on servers outside India. By using the Platform you consent to such transfer, which we carry out with appropriate safeguards and in accordance with the DPDP Act and any restrictions notified by the Government of India.

Provider	Purpose	Location
Supabase	Database, authentication, storage	Outside India (region-dependent)
Cloudflare R2	File/object storage (images, designs, logos)	Global / outside India
Razorpay	Baker subscription payment processing	India
OpenAI	AI vision (reading a cake photo to identify decorations and colours) and AI image generation (drawing how-to-make-it guide sheets from a photo) — see Section 3.1	United States
Meshy.ai	Image-to-3D model generation	Outside India (US)
remove.bg	Image background removal	European Union (Germany)
Google Analytics	Website usage analytics — marketing website only, never a Baker's storefront (see Section 2.4)	United States
Sentry (or equivalent)	Error/diagnostic monitoring	United States (unless self-hosted)
Email/SMTP provider	Transactional email delivery	Provider-dependent
Cloud hosting (e.g. Render)	Application hosting	Global / outside India

This list may change as our providers evolve; we will keep it reasonably current.

7. Data Retention

We keep personal data only as long as necessary for the purposes above or as required by law (for example, tax and accounting records). In particular:

A Baker's account, storefront, designs and order records are retained while the account exists. A subscription that lapses or is cancelled takes the storefront offline — customers can no longer reach it — but does not by itself delete the account, so a Baker who comes back finds their work intact.
A Baker can request deletion at any time, from Privacy & Data — including after a subscription has lapsed, when it is offered on the sign-in screen alongside the option to resume. We notify before erasure, and then irreversibly erase or anonymise personal data, except records we are required to keep by law (for example GST invoices, which are kept for their statutory period).
Customer order/quote and Design data are retained to serve the order and for a reasonable period thereafter for records, disputes, and legal compliance, subject to the Baker's instructions where the Baker is the Data Fiduciary.

When no longer required, personal data is deleted or de-identified.

8. Your Rights

Subject to the DPDP Act and applicable law, you have the right to:

access a summary of the personal data we process about you and the processing activities;
request correction, completion, or updating of inaccurate or incomplete data;
request erasure of your personal data where it is no longer required and retention is not legally mandated;
withdraw consent previously given;
nominate another individual to exercise your rights in the event of death or incapacity; and
raise a grievance (see Section 12).

To exercise these rights, contact us at care@spattoo.com (or our Grievance Officer). We may need to verify your identity. Where a Baker is the Data Fiduciary for the relevant data, we may direct or forward your request to that Baker.

9. Data Security

We take reasonable technical and organisational measures to protect personal data, including access controls, encryption in transit, authentication, and use of reputable infrastructure providers. However, no method of transmission or storage is fully secure, and we cannot guarantee absolute security. You are responsible for keeping your account and OTP credentials confidential.

In the event of a personal-data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

10. Children

The Platform is intended for users 18 years and older and is not directed to children. We do not knowingly collect personal data from children without verifiable parental or guardian consent as required by the DPDP Act. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.

A photograph of a child is a child's personal data. Photo cakes are the one place this arises. Where a Customer or Baker uploads a photograph of a child, we process it to produce the cake that was asked for, and the person who uploads it must already hold verifiable consent from a parent or lawful guardian covering that use, including the AI processing in Section 3.1 (Terms Sections 6.3.1 and B5.6). We do not require that consent record to be sent to us — holding files about children who are not our users would create risk rather than reduce it — but we may ask for it if a complaint is made, and we will act on a parent's or guardian's request to delete the image. A photograph printed on a cake is never sent to an image generator (Section 3.1).

Cakes are often for children, and we have designed around that. A Customer ordering a child's birthday cake tells us about the occasion — for example that it is a first birthday or a children's party — and never the child's age or date of birth. We do not ask a child for anything, do not knowingly let a child use the Platform, and do not build a profile of, track, monitor, or direct advertising at any child. Where we use order information to improve our flavour suggestions, we use it in aggregate, across orders — not to profile any individual, adult or child.

11. Third-Party Links

The Platform and Baker storefronts may contain links to third-party sites or services not operated by Spattoo. We are not responsible for their privacy practices; please review their policies.

12. Grievance Officer and Contact

If you have questions, requests, or complaints about your personal data, contact our Grievance Officer as set out in Grievance & Contact. We will acknowledge and address grievances within the timelines required by law. You may also have the right to complain to the Data Protection Board of India.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified by posting the updated Policy with a new "Last updated" date and, where appropriate, other reasonable notice. Continued use after changes take effect constitutes acceptance.

Summary in plain terms: We collect only what we need to run the storefronts and the designer, we share a Customer's request with the Baker they chose (that's the point), we never sell your data, some of our tech providers are outside India, and you can ask us to access, correct, or delete your data at care@spattoo.com.

Document History

Version	Effective	Changes
1.1	6 September 2026	Added Google Analytics on the marketing website — Section 2.4 now describes it, and Google is named in the Section 6 processor table. Section 2.4 also states plainly where analytics does not run: a Baker's storefront carries no Google Analytics and no Google cookies, and storefront visits are counted using our own systems with no information identifying the visitor.
1.0	13 August 2026	Initial version.

Every published version of this document is retained and timestamped. The version currently in force is shown at the top of this page.