Privacy
Privacy policy
The short version: we collect as little as possible, never sell it, use no advertising or tracking cookies, and you can see or delete your data at any time from Your data.
Last updated 15 October 2026
Who we are
themintandmill.com (“The Mint & Mill”, “we”) is run by The Mint & Mill, who decides how your personal data is used (the “data controller” or “data fiduciary”). Contact for anything privacy-related: the Your data page.
What we collect, why, and for how long
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Name and email when you book a class | To reserve your seat, send confirmation and joining details | Needed to provide the class you asked for (contract) | Until 90 days after the class, then deleted automatically |
| Email when you join the newsletter | To send the Sunday email | Your consent, confirmed by clicking the link we email you | Until you unsubscribe. Unconfirmed sign-ups are deleted after 7 days |
| Page-view counts: the page address and the name of the site that linked to it (e.g. instagram.com) | To see which recipes people read | Legitimate interest; contains no personal data | Daily totals for about 13 months |
| Error reports: error message, page and technical details from your browser | To find and fix broken pages | Legitimate interest; we don't include personal data | 30 days |
| Your IP address | Briefly held in memory to stop spam and abuse (rate limiting). Our hosting providers also keep short-lived server logs for security | Legitimate interest (security) | Not stored by us; provider logs are kept for days to weeks |
We don't use cookies. The site remembers your light/dark choice in your own browser (local storage); it never leaves your device. We don't use advertising, social-media pixels, fingerprinting or third-party analytics, and we don't sell or “share” personal information as defined by California law. If your browser sends a Global Privacy Control or Do Not Track signal, we don't even count your page views.
Who processes it for us
We use these service providers to run the site. They only process data on our instructions:
- Vercel (website hosting, USA/global)
- Render (bookings and newsletter service, USA)
- Neon (database, USA)
- Sanity (recipes, images and media, EU/USA). Holds no visitor data
- Google Gmail or Brevo (sending emails)
Some of these are outside India and the European Economic Area. Where the law requires it, transfers rely on the providers' Standard Contractual Clauses or equivalent safeguards.
Your rights
Wherever you live, you can:
- See and download what we hold about you
- Correct it
- Delete it (this also cancels any class bookings)
- Withdraw consent for the newsletter at any time, using the link in every email
- Object to or restrict how we use it, and nominate someone to act for you
Use Your data to see, download or delete everything instantly, or contact the Your data page. We answer other requests within 30 days and never charge for them.
If you're unhappy with how we handled your data, please tell us first. You can also complain to your regulator: in India, the Data Protection Board of India; in the EU/UK, your local data protection authority (e.g. the ICO in the UK); in California, the California Privacy Protection Agency.
Children
The site is for adults. Class bookings and the newsletter are for people aged 18 or over. If you're under 18, please ask a parent or guardian to book for you. If we learn we hold a child's data without a parent's consent, we delete it.
Security
Everything travels over HTTPS. Data is stored with providers that encrypt it at rest. Access is limited to the site owner, protected by long random keys. Email links are signed so they can't be forged, and expire where it matters. Backups are encrypted. If a breach ever affected your data, we'd tell you and the relevant authority as the law requires.
Changes
If this policy changes in a way that matters, we'll update the date above and, for big changes, tell newsletter subscribers.