Privacy Policy

FLUFFY LAB STUDIO LTD (פלאפי לאב סטודיו בע"מ), an Israeli limited liability company registered with the Registrar of Companies under company number 517300349, incorporated 15 February 2026 (collectively "FluffyLab", "we", "us"), is the data controller. We operate a café at Herzl 27, Tel Aviv and the FluffyLab web app, Telegram Mini App, and related ordering services (the "Service"). Director on record: Vladimir Gomberg. Contact: fluffylab.official@gmail.com.

• Account data: name, phone, email, Telegram ID (when you sign in via Telegram), birthday if you choose to share it.
• Order data: items ordered, totals, pickup time, payment status, notes.
• Loyalty data: points, tier, redemption history.
• Device & usage: IP, browser, pages visited, performance/error logs.
• Optional analytics (only after you accept cookies): Google Analytics 4, Meta Pixel, Microsoft Clarity. We never sell your data.

• To process orders, payments, and pickups.
• To send order status updates via push, Telegram, or WhatsApp.
• To run our loyalty program and birthday rewards.
• To prevent fraud and abuse.
• To improve our menu, service, and app (only with your consent for analytics).

We process your data based on (a) performance of contract (your order), (b) legitimate interest (security, service improvement), (c) consent (marketing, optional analytics), and (d) compliance with Israeli tax & accounting law.

We share data only with:

• Payment processors (when online payments are enabled).
• Telegram (for Mini App authentication and order notifications).
• Hosting & database providers (Lovable Cloud / Supabase) under DPA terms.
• Analytics providers — only with your consent.
• Authorities, when legally required.

Order records: 7 years (Israeli accounting requirements). Account data: until you delete your account. Marketing data: until you unsubscribe. Analytics: 26 months max.

You may access, correct, export, or delete your personal data, withdraw consent at any time, and lodge a complaint with the Israeli Privacy Protection Authority (PPA). Email fluffylab.official@gmail.com and we will respond within 30 days.

Data is encrypted in transit (HTTPS) and at rest. Access is limited to staff with a need to know. We use row-level security in our database and protect admin actions with role-based access control.

The Service is not directed to children under 16. We do not knowingly collect their data.

We may update this policy. Material changes will be announced in the app. The "Last updated" date above reflects the current version.