Who we are

Beef & Basil is a family-run restaurant at 188D-190D, St. 777, Borey Vimean Phnom Penh Project 12, Khan Russey Keo, Phnom Penh 12101, Cambodia. This page explains what we keep about you when you use our website or our app, order from us or book a table, and what we do with it. When it says “we”, it means the shop.

What you give us

When you order. Your name, your phone number, what you ordered, any note you add and, for dine in, your table. For a delivery, the address you type. You can also tap the button to share where you are, so the rider finds you: the website asks your browser for your location only when you tap it, and the address you typed is still needed. You can order without an account.
When you book a table. Your name, your phone number, your email if you give it, how many are coming, the date and time, and any note.
When you create an account. A username and a password. We keep only a scrambled form of the password (a hash), never the password itself. If you give them, your email address, your first and last name, your phone number and the language you read in.
Your birthday, only if it is on your account, and only to give you the birthday bonus on Leaves.
Leaves. Every Leaf you earn or spend is written down against your account, with the order or booking it came from, so your balance can always be checked.
How you paid. Our staff record which way you paid and how much. Nothing on the website or in the app takes a payment or asks for card details.

Signing in with Google, Apple or Telegram

If you choose one of these buttons, that service confirms who you are and hands us a little about you. We never see your password with them.

Google gives us a number that identifies your Google account, your email address (only if Google has confirmed it), your name and a link to your profile picture.
Apple gives us a number that identifies your Apple account and your email address, which may be a private address Apple forwards to you. The first time, it also gives your name if you choose to share it.
Telegram gives us your Telegram user number, your name and a link to your profile photo. It gives us no phone number and no email address.

If the email address Google or Apple confirms already belongs to an account here, we sign you in to that account rather than making a second one. To draw their buttons, the sign-in page loads a small piece of code from Google, Apple or Telegram, so they can see that the page was opened.

The app

Notifications. If you allow them, your phone gives the app a delivery address for notifications (a push token, issued by Expo). We keep it with your account, and whether the phone runs iOS or Android, and use it only to tell you how your order is going. Signing out removes it from your account. You can switch notifications off in your phone’s settings at any time.
On your phone. The app keeps your sign-in in the phone’s secure storage and your cart on the phone. The cart reaches us only when you send the order.

Cookies and what your browser keeps

Signed in. Two cookies hold your sign-in while you are signed in. Scripts on the page cannot read them, they last up to 30 days, and signing out removes them.
Your language. If you switch language, a cookie remembers your choice for a year.
In your browser only. Your cart, your light or dark choice, and the orders you placed without an account (the order and the phone number it was placed with, so the page can follow it for you) stay in your browser and are never sent to us for anything else.
The map. The map on our contact page comes from Google Maps, and Google may set its own cookies when it loads.

We use no advertising cookies and no analytics or tracking service of any kind, so there is nothing to agree to and no cookie banner.

What we use it for

To cook your order, bring it to your table or your door, and call you if something is wrong.
To hold your table and call you about your booking.
To keep your account, your order history and your Leaves.
To tell you in the app how your order is going, if you allowed notifications.
To keep the shop’s own records of what it sold.

We do not sell your details, we do not send you email or marketing messages, and we do not use your details for advertising.

Who else sees it

Our staff. The kitchen, the counter and, for a delivery, the rider see what they need to do their part: the rider sees your name, phone number, address and location.
Printed tickets. Kitchen tickets and receipts are printed on the shop’s own printers, in the shop, and can carry your name, phone number and delivery address.
The shop’s Telegram. When a sale is paid, the shop gets a message in its own Telegram chat with the order number, the kind of order, the table, the total and how it was paid. It never carries your name, phone number or address.
Expo, Apple and Google, for app notifications only: Expo’s service passes each notification to Apple or Google, who deliver it to your phone.
Google, Apple and Telegram, if you sign in with them, as described above.
Delivery apps. We are not connected to any. If you order through one, our staff type the order in, and that app’s own privacy policy covers what you gave it.

Nobody else, unless the law requires it. There is no payment company in between, because nothing here takes a payment.

Where it is kept

On a server the shop runs, reached only by staff who sign in with their own account. Your sign-in is protected with a hashed password and short-lived keys, and every page travels over an encrypted connection.

How long we keep it

Orders and bookings stay as the shop’s records of what it sold and who it expected.
Your account stays until you ask us to close it.
Leaves. If no Leaf is earned or spent on your account for 12 months, the balance goes back to zero. The record of what you earned and spent stays.
Sign-in cookies last up to 30 days, and your browser keeps its own storage until you clear it.

Seeing, correcting or deleting your details

Ask us, and we will show you what we hold about you, correct it, or close your account and delete its details. For an order placed without an account, tell us the order number and the phone number it was placed with. Once an account is deleted, past orders keep the name and phone number they were placed with, as the shop’s sales records, but nothing links them to you any more.

Children

Our website and app are for ordering food and booking tables, and are not meant for children under 13. If you think a child has given us their details, tell us and we will delete them.

Changes to this page

When what we keep or who sees it changes, we change this page first and put the new date at the top.

Talk to us

For anything on this page, reach Beef & Basil the way you would about an order: