Rull it!

Privacy

This page explains what data we collect when you order or leave feedback, why, and how long we keep it.

Who is responsible

Rull it!, a home bakery in Tartu. Contact: rullittartu@gmail.com. The seller’s details are in the terms of sale.

What we collect and why

  • Orders – name, email, phone, delivery address and your optional note, to fulfil the order. The same applies to orders placed via Instagram, phone or email.
  • Bookkeeping – order date and amounts, kept without personal details.
  • Feedback – name, rating and text, published after review. You can withdraw it any time by emailing us.
  • Spam and abuse prevention – a code derived from your IP address that can’t be turned back into the address, kept for up to 24 hours.

Marketing

We don’t send newsletters or adverts, and we never sell or share your data for marketing.

How long we keep it

Personal order data is deleted automatically 12 months after the baking day. Encrypted backups are kept for up to 90 days, so deleted data also disappears from them within that time. Feedback stays until you ask us to remove it. You can ask us to delete your data earlier at any time.

Who else processes it

  • Vercel (website hosting, servers in Frankfurt; Vercel Inc. is a US company)
  • Supabase (database, EU data centre in Frankfurt)
  • Resend (sending emails; Resend Inc. is a US company)
  • GitHub (encrypted weekly backups; GitHub Inc. is a US company owned by Microsoft)
  • Estonian Land and Spatial Development Board (address search – only the address text you type is sent)

If you contact us on Instagram, Meta’s own privacy policy also applies to that conversation.

Transfers outside the EU

Where a provider is based in the US, the data transfer relies on the EU–US Data Privacy Framework and/or the EU standard contractual clauses in the provider’s data processing agreement.

Security

The site works only over an encrypted connection (HTTPS), only we have access to your data, and backups are encrypted.

Your rights

You can ask for a copy of your data, a correction, deletion, restriction, data portability, object to processing or withdraw consent – just email rullittartu@gmail.com. We reply within 30 days.

Cookies

We don’t use cookies for visitors to this site, so there is no cookie banner.

Last updated 28.10.2026