Privacy
policy.
HĒVA Chocolaterie makes handcrafted chocolate and sweets to order. This notice explains what happens to your information when you browse this website or place an order with us.
It is written to be read, not to be skimmed past. If anything here is unclear, message us and we will explain it in plain words.
Last updated 20 October 2026
The short version
- We use limited PostHog analytics automatically to understand visits, product interest and how people move through the ordering steps, for our own website metrics. You can disable this using Analytics preferences in the footer. We do not run advertising trackers. Masked recordings and click heatmaps are optional and require a separate choice in Analytics preferences.
- The order form keeps your details in browser memory. We receive them when you press Send in WhatsApp.
- We only hold the details you send us in conversation: what you would like, where it is going, and how to reach you.
- We do not sell your information, rent it, or share it for marketing.
- You can ask us what we hold, ask us to correct it, or ask us to delete it at any time.
The rest of this notice sets out the same thing in full.
Who we are
HĒVA Chocolaterie is a small-batch chocolate maker operating in Pakistan. We are the data controller for the information described in this notice, which means we decide how it is used and we are responsible for looking after it.
You can reach us about anything in this notice on WhatsApp. WhatsApp is the only channel we use, so every message and reply stays in one place.
What this website collects
This site is a set of static pages with a browser-based order builder. It has no accounts, no login, no newsletter sign-up, and no online payment processing. Details entered in the order builder are not stored on our website.
- Limited analytics starts automatically without a confirmation banner, unless you previously opted out or your browser sends Do Not Track or Global Privacy Control. PostHog keeps its analytics identifier in page memory rather than analytics cookies or persistent browser storage; refreshing or opening another page can create a new identifier, so returning-visitor measurements are approximate. You can disable or enable analytics using Analytics preferences in the footer. Only your preference is saved locally. We do not identify visitors by name or phone number.
- We measure page visits, opening the order form, choosing a date, product quantity changes, completing the details step and opening WhatsApp. Product identifiers, quantities, step names and validation field keys may accompany these events. These events do not confirm that an order was placed.
- Analytics excludes names, phone numbers, addresses, gift messages, notes, exact requested dates and the contents of WhatsApp links. Automatic DOM event capture and advertising tracking are disabled. Masked session recordings and coordinate-only click, movement, rage-click and dead-click heatmaps are off by default and run only if you separately enable them in Analytics preferences. Recordings mask page text and input values and exclude the entire checkout, including the review and generated message. We do not record console logs, network bodies or headers, canvases or embedded frames. You can switch these visual tools off in the same footer controls; rejecting analytics or browser privacy signals also stops them. PostHog recordings use a 30-day project retention setting. Page URLs are stripped of query strings and fragments before being sent. Separately, restricted campaign labels (UTM parameters) help measure where visits originate. Never include personal details in campaign labels.
- Fonts and images are served from our own site. Limited usage analytics is sent to our PostHog project in the United States. PostHog's privacy information is available at https://posthog.com/privacy. PostHog processes your IP address for approximate country and city estimates and bot detection, then discards it rather than storing it with new events. Network providers also process technical information when delivering requests.
- Your light or dark appearance and reduced-motion settings follow your device preferences. We do not send them as custom analytics properties. If you enable masked recordings, the recorded public-page layout can reflect its appearance.
The order form assembles a WhatsApp message entirely inside your browser. We receive the customer details in that message when you follow the link and press Send in WhatsApp. Anonymous ordering-step events are measured separately as described above; they do not include the message or your contact details.
Information our hosting provider handles
Like any website, this one is delivered by a hosting provider. To serve a page and to protect the site from abuse, the provider processes standard technical request data such as your IP address, the type of browser and device you are using, the page requested, and the time of the request.
We use this only to keep the site online, fast, and secure. We do not use it to build a profile of you or to identify you.
What you share when you order
When you contact us, you choose what to tell us. To prepare and deliver an order, we will usually end up holding:
- Your name, the WhatsApp profile name shown to us, and your phone number.
- Your delivery address, area, and any instructions for finding you.
- What you have asked for: collections, flavours, quantities, gift sizes, and the occasion.
- Anything you tell us about allergies, intolerances, or dietary preferences, so that we can advise you correctly and prepare your order safely.
- Gift details you ask us to include, such as a message card and the recipient's name, and where relevant the recipient's delivery address and phone number.
- A payment reference or a screenshot of a transfer, where you send one as proof of payment.
- The conversation itself, which records what was agreed.
Information about allergies and health is sensitive, and we treat it that way. We use it only to prepare and advise on your order, and we ask you to share only what is relevant.
Please do not send us full payment card numbers, card security codes, banking passwords or one-time codes, or images of your CNIC. We will never ask you for them.
If you give us someone else's details so we can deliver a gift, please make sure they are happy for you to share them with us. We use those details only to deliver that gift.
Why we use it
We use your information to do the things you have asked us to do, and for nothing else:
- To answer your questions and give you a current menu and price.
- To prepare, pack, and deliver your order correctly and safely.
- To advise you about ingredients and allergens for the items you have chosen.
- To take payment and to keep a record of what was ordered and paid.
- To handle a problem, a replacement, or a refund if something goes wrong.
- To meet our legal, tax, and food-safety obligations.
We do not send marketing messages to people who have not asked for them. If we ever do start a broadcast list, it will be something you opt into, and every message will tell you how to leave.
A note about WhatsApp
Choosing to order on WhatsApp means your conversation with us is also governed by WhatsApp's own privacy policy and terms. We have no control over how WhatsApp handles message metadata, backups, or your account.
WhatsApp is the only channel we take orders and enquiries on, so if you would rather not use it, we are not able to take your order another way.
You can read WhatsApp's privacy policy at https://www.whatsapp.com/legal/privacy-policy.
How long we keep it
We keep order information for as long as we need it to complete your order, to deal with any question or claim that follows, and to meet our record-keeping and tax obligations. After that we delete it or stop being able to link it to you.
Our chat history with you stays in WhatsApp until one of us deletes it. You can clear your side of the conversation at any time from within the app, and you can ask us to clear ours.
How we keep it safe
Order information is held on a small number of devices that are kept locked and up to date, and access is limited to the people preparing and delivering your order.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If something goes wrong in a way that affects you, we will tell you and tell you what to do about it.
Children
This site and our products are intended for adults. We do not knowingly collect information from children. If you believe a child has sent us personal information, message us and we will delete it.
Your choices and your rights
Your information belongs to you. At any time you can ask us to:
- Tell you what information about you we hold.
- Correct anything that is wrong or out of date.
- Delete information we no longer need to keep.
- Stop contacting you, other than to complete an order already in progress.
Message us on WhatsApp and we will deal with your request promptly. We may ask a question or two to confirm we are speaking to the right person before we act on it.
Consumer and data protection law in Pakistan, including the provincial Consumer Protection Acts, gives you rights that this notice does not take away.
Links to other places
Our site links out to WhatsApp and may link to other services. Once you leave this site, the privacy practices of that service apply, and we are not responsible for them. It is worth reading their notices too.
Changes to this notice
If how we work changes, we will update this notice and change the date at the top of the page. Material changes will be described here rather than slipped in quietly.
Talk to us
Questions, corrections, or a request to delete something: message us on WhatsApp. A real person reads it.