Privacy Policy

Bon Gou Foods is a handcrafted bakery at 1297 Centennial Avenue, Suite 5-398, Piscataway, NJ 08854. This policy explains what personal information we collect when you use bongoufoods.com, why we collect it, who helps us handle it, and what you can ask us to do with it.

The short version: we collect only what we need to take and prepare your order, answer your messages, and send the updates you asked for. We don't sell your personal information and we don't use it to build advertising profiles. Payment happens in person at pickup, so this site never collects your card details.

What we collect depends on how you use the site.

• Orders: You can order as a guest or while signed in. We store your name, email address, phone number, preferred pickup date, the items you ordered, the order total, and any note you add. If you mention an allergy in your note, it becomes part of that order record.
• Accounts: Creating an account is optional. We store your name, email address, and password, plus a phone number if you choose to add one. Your password is stored only as a salted hash, never in plain text. Your account shows your order history.
• Contact form: Your name, email address, phone number, and message, which are emailed to the bakery.
• Pen Patat Club newsletter: Your email address.
• Technical information: Like most websites, our hosting and security providers see basic request details, such as your IP address. If you accept analytics on our cookie notice, we also use analytics tools to see page views and site performance in aggregate.

We use the information above only for the following purposes.

• Preparing your order, confirming your pickup time by phone or email, and contacting you if an item or date can't be fulfilled.
• Sending order emails, plus verification and password-reset emails for accounts.
• Showing your order history when you're signed in.
• Replying to messages sent through the contact form.
• Sending Pen Patat Club updates and coupons, if you subscribed.
• Keeping the site secure, preventing bots and abuse, and limiting repeated requests.
• Understanding how the site is used so we can improve it.
• Keeping business records for the bakery.

We don't sell your personal information. A few service providers process it on our behalf to run the site, and we share it with them only for that purpose. We may also disclose information when the law requires it.

These are the providers we use:

• Vercel: hosts the website.
• A managed PostgreSQL database provider: stores order and account data.
• Resend: sends transactional emails (order, verification, and password-reset emails) and newsletter emails.
• Upstash: rate limiting, which uses your IP address for a short time to slow down repeated requests.
• Arcjet: bot and abuse protection, which looks at request details such as your IP address.
• PostHog, Vercel Analytics, and Vercel Speed Insights: page-view and performance analytics, gathered in aggregate. They run only if you accept the cookie notice.

Cookies and local storage are small pieces of data kept in your browser. You can clear or block them in your browser settings, but the sign-in cookie and the cart are needed for accounts and ordering to work. Here's what this site uses:

• Sign-in session cookie: keeps you signed in. It's a secure, httpOnly cookie (page scripts can't read it) and is strictly necessary for accounts to work.
• Your cookie choice: remembers whether you accepted or declined the cookie notice, so we don't ask on every visit. You can change it anytime with "Cookie settings" in the site footer.
• Theme: remembers your light or dark display preference.
• Cart: your cart is kept in your browser's local storage until you place an order. We don't receive it until then.
• Analytics: PostHog, Vercel Analytics, and Vercel Speed Insights load and run only after you select Accept on the cookie notice. If you decline, or haven't chosen yet, none of them load and none of them store anything in your browser. If you accept, they may store their own cookies or identifiers to count visits and measure performance. If you later decline through "Cookie settings", they stop collecting right away and PostHog removes its identifiers from your browser.

How long we keep information depends on what it is. When you delete your account, we delete your account information, though we may keep order records as described here.

• Account information: until you delete your account, which you can do yourself from your account page, or by asking us.
• Order records: as long as we need them to fulfill the order, help you afterward, and keep proper business records. If you delete your account, your past orders stay on record with the name and contact details you gave for pickup, but they are no longer linked to an account.
• Newsletter email address: until you unsubscribe.
• Rate-limiting data (IP address): only for a short time.

Your password is stored only as a salted hash, and your sign-in session uses a secure, httpOnly cookie. We use bot and abuse protection and rate limiting to guard the site. Because you pay in person, we never receive or store your card details. No website can promise perfect security, but we handle the information you trust us with carefully.

You're in control of your information. If you have an account, you can delete it yourself: sign in, open your account page, and choose Delete account. For anything else, or if you'd rather not sign in, send a request to admin@bongoufoods.com at any time and we'll take care of it. If you live in New Jersey, you may have additional privacy rights under New Jersey law, and we will honor those requests too.

We may need to confirm it's really you before we act on a request, and we may keep information we need for business records, such as order records. Deleting your account removes your sign-in and saved details, and your past orders are no longer linked to it. Here's what you can ask us to do:

• Access the personal information we hold about you.
• Correct anything that's wrong or out of date.
• Delete your personal information or close your account. Signed-in customers can do this from the account page; otherwise, email us.
• Stop receiving Pen Patat Club emails. You can unsubscribe at any time.

This site is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we'll delete it.

We may update this policy from time to time. When we do, we'll change the effective date at the top of this page, and we'll announce material changes on the site.

Send questions about this policy, or requests about your information, to admin@bongoufoods.com. You can also call us at 732-669-5228 or write to Bon Gou Foods, 1297 Centennial Avenue, Suite 5-398, Piscataway, NJ 08854.