Privacy
Policy

What The Pho operates Vietnamese restaurants in Canberra, ACT, and this website at www.whatthepho.com.au. This notice explains what we collect when you use the site, why, and who we share it with. It is written for our customers rather than for lawyers, and we will update it whenever what we collect changes.

When you send a catering enquiry, place a catering order, contact us, or apply for a job, we collect what that form asks for - typically your name, email address, phone number, and the details of your request. We use it to answer you, to fulfil your order, and to keep a record of the booking. Catering orders are paid through Stripe, which handles your card details directly; we never see or store your card number.

Like most websites, we record how the site is used: the pages you visit, the links you click, the device and browser you are on, your approximate location from your IP address, and where you arrived from. This tells us which dishes people look at, which pages are worth keeping, and whether our advertising is working.

Google Analytics 4 and Google Tag Manager measure how the site is used. Google Ads records which advertisements lead to enquiries and orders. The Meta pixel and Meta's Conversions API do the same for our Facebook and Instagram advertising. Microsoft Clarity records anonymised session replays so we can see where the site is confusing. Vercel Analytics and Speed Insights measure page performance. Each of these is operated by the company named, under its own privacy policy.

When you submit an enquiry or complete an order, we send Google and Meta a scrambled version of your email address and phone number - a one-way SHA-256 hash. It cannot be turned back into your details. It lets those platforms tell us that an advertisement led to a booking without us handing over your contact details, and without them learning anything about you they did not already hold. We also send the order value and, where we have it, the advertisement click that brought you to the site.

Our catering enquiries and orders are stored with Supabase, our site runs on Vercel, our transactional email is sent through Resend, and payments are processed by Stripe. The advertising and analytics providers named above receive the usage data described. We do not sell your personal information, and we do not share it with anyone else except where the law requires it.

Catering enquiries and orders are kept for as long as we need them for our records and our tax obligations. Analytics data is kept for the retention period each platform allows, which is currently fourteen months for Google Analytics. Job applications are kept for twelve months unless you ask us to delete them sooner.

You can turn off analytics and advertising cookies in your browser settings, or install Google's opt-out browser add-on. You can adjust what Meta uses to show you advertisements in your Facebook or Instagram ad preferences. Blocking these does not affect your ability to browse the menu, send an enquiry, or place an order. You can also ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it.

If you have a question about this notice, or you want to see, correct, or delete the information we hold about you, email us and we will respond within a reasonable time. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.