Last updated: 14 August 2026
Secret Kitchens ("we", "us") is operated by Hyperbolic Time Chamber Pty Ltd (ABN 79 537 581 568), a small Queensland-based service that builds and hosts menu pages for local food businesses. We collect as little personal information as possible, and we handle what we do collect in line with the Australian Privacy Principles. Here's the plain-English version.
1. What we collect, and when
- Order request forms (on kitchen pages): your name, phone number, email address, the items you select, your preferred date and any notes you type. This exists so the kitchen can fulfil your order.
- Card checkout (kitchens with card payment switched on): when you pay by card, Stripe collects your name, email, phone number and card details on its own secure checkout page. Stripe passes everything except your card details to us and the kitchen so the order can be fulfilled. If you choose delivery (where a kitchen offers it), the delivery address you enter on the kitchen's page travels with your payment and is passed to the kitchen so they know where to deliver.
- Kitchen registration form: your business and contact details, menu, story and links — everything you type into the form.
- Email: anything you send us by email, including photos you send us for your page.
Customers don't need accounts or logins to use the site. Kitchens that list with us create a seller dashboard account (email and password) to manage their page — see section 2. On most kitchen pages customers don't pay through this site at all. Where a kitchen has card payment switched on, payment happens on Stripe's secure checkout page — card details never touch our site and we never see or store them. Kitchens that subscribe to a paid plan also enter their card directly with Stripe — see section 2.
2. How form submissions travel
The site is hosted on Netlify, whose infrastructure may keep standard technical server logs (including IP addresses) for security and abuse prevention.
Order requests are sent to a Netlify serverless function, which looks up the kitchen's details and emails your request to that kitchen using Resend, an email delivery service. A copy is sent to you as confirmation, and we also receive a copy of each order request so we can help if something goes wrong between you and a kitchen. We store a short-lived record of request volume to prevent spam and abuse.
Card payments on kitchen pages (where switched on) are processed by Stripe through that kitchen's own Stripe account — the payment page is Stripe's, and the money goes straight to the kitchen. When a payment completes, Stripe sends us your name, email, phone number, order items, pickup or delivery details (including the delivery address for delivery orders) and the amount paid — never your card details. We store that as an order record in Supabase, our secure database provider, so the kitchen and we have a reliable record of paid orders — order records are permanently deleted 90 days after the order (see section 6) — and we email the order to the kitchen (with a copy to us) and a confirmation to you using Resend.
Kitchen registration and update forms are handled by Netlify Forms and delivered to us by email. The registration form uses Google reCAPTCHA to block automated submissions; Google's privacy policy applies to that check.
Kitchen business details, contact details and menus are stored in Supabase, which serves the live content on kitchen pages. Order requests sent through the free order form are not stored in our database; paid card orders are — see above.
Seller dashboard accounts are signed in with an email and password. Sign-in is handled by Supabase's authentication service; passwords are stored securely hashed and are never visible to us.
Kitchen plan billing is handled by Stripe. When a kitchen signs up for a paid plan, their name, email and card details go directly to Stripe through Stripe's own secure checkout — card numbers never touch our site and we never see or store them. Stripe shows us billing status and sends receipts. This covers kitchens paying for their page; customer card payments on kitchen pages are described above.
Location search on the homepage: if you type a suburb or city into the kitchen search, that search text is sent to OpenStreetMap's Nominatim service to find its map coordinates. If you use the “Use my location” button instead, your coordinates stay in your browser — they are never sent to us or anyone else.
Each of these providers has its own privacy policy covering their part of the process.
3. What we use information for
- Order details: passed to the relevant kitchen so they can contact you and fulfil your order. What the kitchen does with your details is between you and them — they are independent businesses.
- Registration details: used to contact you, build your page, and publish the content you asked us to publish.
- We don't sell personal information. We don't send marketing emails. We don't share information with anyone except as described above.
4. Cookies and analytics
We don't set tracking cookies of our own and don't run advertising trackers. The Google reCAPTCHA check on the registration form is governed by Google's policies (see section 2). If we add basic visitor analytics in future, we'll update this page to say so and name the tool.
5. What we publish
Kitchen pages display business information kitchens ask us to publish: business name, menu, photos, story, suburb/region and the contact links you ask us to include (Facebook, Instagram, phone, email and so on). If you're a kitchen and want anything changed or removed from your page, email us and we'll do it.
6. Keeping and deleting information
Order records from card payments are kept for 90 days from the order date so the kitchen and we can resolve any issue with an order, then permanently deleted. After that we retain only anonymous sales totals — order counts and dollar amounts per kitchen per day — which contain no personal information. Kitchens can take a copy of their own order records before deletion; what a kitchen does with that copy is covered by its own privacy obligations (see our Terms).
Order requests sent through the free order form aren't stored in our database at all — they live in email inboxes (the kitchen's and ours) and are kept only as long as needed for the order. Registration forms are delivered to us by email and kept the same way.
Kitchen business details and dashboard accounts are kept while a kitchen is listed with us.
Want something deleted sooner? Email us at info@secret-kitchens.com and we'll delete what we hold. For order details held by a kitchen, contact that kitchen directly.
7. Access and correction
You can ask us any time what information we hold about you, and ask us to correct or delete it: info@secret-kitchens.com.
8. Changes to this policy
If how the site works changes — for example, if we add analytics in future — we'll update this page before or when the change happens, with the date at the top.
9. Contact
Privacy questions or requests: info@secret-kitchens.com.