Privacy Policy

Crosta Roma (“we”, “us”, “our”) operates a Roman-style pizza al taglio kitchen at 450 Mona Vale Road, St Ives NSW 2075, Australia. This Privacy Policy explains what personal information we collect through crostaroma.com.au (this website) and how we handle it, in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

We only collect what we need to bake, hand over, and remember your order:

• Order details — name, phone number, email address, notes, cart contents, order total.
• Payment — we do not store your card details. Payments are processed by Stripe; we only store the resulting transaction status and a Stripe session identifier.
• Waitlist ("the knock list") & birthday opt-in — email address, optional mobile number, and (only if you opt in) birthday month + day.
• Technical — a small session token stored in your browser to remember your cart. We do not use third-party analytics or advertising cookies.

• To take, prepare, and hand you your order.
• To send you order confirmations and status updates.
• To let you know when we open (Thu–Sat) if you joined the waitlist.
• To send you a birthday coupon in the month of your birthday, if you opted in.
• To keep records for tax and accounting purposes as required by law.

We do not sell your data. We do not send marketing to people who haven’t opted in.

• Stripe — processes card payments. See stripe.com/au/privacy.
• Uber Eats — if you order via Uber Eats (external service), that order is handled entirely by Uber and their privacy policy applies. We only see the summary Uber shares with us.
• Our hosting provider — infrastructure for the website and database (data residency: Australia region where available).

We do not share your data with anyone else without your consent or unless required by Australian law.

• Order records: 7 years, as required by Australian Taxation Office record-keeping rules.
• Waitlist entries: until you ask us to remove you, or until the account becomes inactive for 24 months.
• Payment records: as required by Stripe and Australian regulators.

Under the Australian Privacy Principles you have the right to:

• Ask us what personal information we hold about you.
• Ask us to correct any information that’s wrong.
• Ask us to delete your waitlist entry or your account.
• Withdraw consent for marketing / birthday emails at any time.
• Complain to the Office of the Australian Information Commissioner (oaic.gov.au) if you think we’ve mishandled your data.

Email luca.pizzakitchen@gmail.com and we’ll respond within 30 days.

The site runs over HTTPS. Passwords for staff accounts are hashed using bcrypt. Payment information never touches our servers — it’s handled directly by Stripe. No online service is 100% secure, but we take reasonable steps to protect your information.

If we update this policy we’ll change the “Effective” date at the top and, for material changes, we’ll flag it on the homepage before the change takes effect.