privacy policy

who we are

sayummy's is a café at swyambhu, kathmandu, nepal. we run sayummys.com and look after the details you give us there and at the counter. we follow nepal's individual privacy act, 2075 (2018): we collect personal information only with your consent, use it only for the reason we gave, and keep it safe.

questions or requests: trysayummys@gmail.com, +977 9803904546, or ask at the counter.

what we collect, and why

• the newsletter: your name, email and phone number. we use the email to send the menu'spaper and your 10% off code. we use the phone only to find your code at the counter and to stop one person collecting many codes. we keep the exact sign-up wording you agreed to and when you agreed, so we can show you said yes. if staff sign you up at the counter, they do it only after you say yes.
• limited-offer bookings: your name, phone, arrival time, what you ordered, how you paid the deposit and the transaction code you type in. we use them to hold your order, check the deposit reached us and contact you about that booking. we never see your esewa, khalti or bank login, pin or card.
• the stamp card: your phone number and how many stamps you have, entered by staff at the counter.
• the clubhouse vote: a random id in a cookie, so each browser votes once, and a scrambled copy of your network address for one hour, to stop ballot stuffing. neither is linked to your name.
• share buttons: we count how many times each story or offer is shared each day. the count holds nothing about you.
• visiting the site: we use vercel web analytics to count page views. it sets no cookies, doesn't follow you to other sites and never records your screen. to block spam, we keep a scrambled copy of your network address for 10 minutes when you sign up, book or share. our host keeps short-lived server logs for security.
• emails: our email service tells us whether an email was delivered, bounced or marked as spam, so we stop writing to addresses that don't work or don't want us. our emails load our fonts from google fonts, so google may see your device's address when you open one.
• photos you share: when you tag us with #getprinted, you're asking us to consider your post for the paper. we message you before we print it, credit your handle, and take it down if you, or anyone in the photo, ask.
• whatsapp and instagram: if you message us there, the message goes through meta's apps and their own privacy policies apply. we only use what you send to answer you.

what we never do

• sell, rent or trade your details.
• use advertising networks, tracking pixels or session-recording tools.
• send marketing by sms or add you to whatsapp broadcast lists.
• use your details for anything other than the reasons above without asking you first.

who helps us

a few companies run parts of the site for us. they handle your details only to do that job, under their own security and privacy terms:

• vercel hosts the website and counts page views.
• supabase stores our database and photos.
• resend sends our emails and keeps the mailing list in step with ours.
• github keeps encrypted backups of the database.

their servers are outside nepal, so your details may be stored abroad. we choose providers that encrypt data and limit who can reach it. we may share details if nepali law or a court requires it.

how long we keep it

• newsletter details: until you unsubscribe or ask us to delete them. after you unsubscribe we keep your email marked “no”, so we never write to you again by mistake.
• bookings and deposits: as long as nepal's accounting and tax rules require us to keep records of money we received.
• scrambled network addresses: 10 minutes (sign-ups, bookings, shares) or 1 hour (votes).
• the vote cookie: one year, and only if you vote.
• database backups: encrypted, kept up to 30 days.

cookies and your browser

we only use what the site needs to work. there are no advertising or tracking cookies, so there is nothing to opt out of.

• sy-voter (cookie): your random voter id, set only when you vote.
• sy-theme, sy-print, sy-intro (stored only in your browser): your night edition choice, print size, and whether you've seen the intro.
• login cookies: only for the owner and staff, on the newsroom and staff pages.

your choices and rights

• stop the emails: use the unsubscribe link in any newsletter, reply “stop” to any of our emails, or tell us at the counter.
• see, fix or delete what we hold about you: email or call us, or ask at the counter. we answer within 15 days, and may first check it's really you.
• complain: talk to us first and we'll put it right. under the individual privacy act you can also complain to your district court.

under 18?

please get a parent or guardian's ok before you sign up or book. if we learn someone under 18 signed up without it, we'll delete their details.

keeping it safe

the site only works over https. only the owner can read the mailing list and bookings, and only after logging in with a password and an authenticator code. the public can't read our database, and the parts the site uses are rate-limited. if something ever goes wrong with your details, we'll fix it, tell you, and tell you what we're doing about it.

changes

when this policy changes, we'll update the date at the top. if we change how we use details you've already given us, we'll email newsletter subscribers first. back to the front page →