Privacy

The first kind is yours: your name, your email and phone number, your restaurant’s name and city, your billing details, and the account you sign in with. We are responsible for that.

The second kind is your customers’: the name and phone number a diner leaves when they order, their order history, their reviews. Under India’s Digital Personal Data Protection Act, your restaurant is the data fiduciary for those records — they are your relationship and your responsibility — and we process them on your instructions as the platform you chose to run them on. We do not market to your diners, and we do not sell or rent that data to anybody.

What you give us when you ask for a demo or sign up: name, email, phone, restaurant name and city, and anything else you type into the form.

What the product needs to work: your menu, your orders, your staff accounts, your stock, and the settings you configure.

What every website collects: pages visited, approximate location from your IP address, browser and device type. We use this to see which parts of the site are read and which are not.

Name and phone number where the ordering flow asks for them, the contents of the order, the table or channel it came from, any note or review they left, and the delivery address on a delivery order.

Nothing is collected from a diner that your own ordering flow does not ask them for. If you turn customer capture off, it is not captured.

Run the service: take orders, print tickets, settle bills, hold your stock, and produce your reports.

Reach you: order alerts, service notices, billing, and answering you when you write in.

Improve the product: aggregated, de-identified usage — how often a screen is opened, where a flow is abandoned. Not your customer records.

Meet legal obligations: tax records, GST invoicing, and anything a lawful request requires of us.

Our hosting and database providers, who store it. Our email and messaging providers, when a bill or a notification goes out. Your payment gateway, when you connect one — payments settle to your account, not through us. An AI provider, where a brain feature you have switched on sends it a question.

Each of those sees only what its job needs. None of them is permitted to use your data for their own purposes. We do not sell personal data to anyone, and there is no arrangement under which any advertiser receives it.

Operational records — orders, bills, stock movements — are kept for as long as your account is open, because your own reporting and your tax obligations depend on them.

If you close your account, export what you want first: menu, orders, customers and stock are all exportable at any time and they are yours. We remove your data within ninety days of closure except where we are required to retain financial records for longer.

You can ask us what we hold about you, correct it, or have it deleted where the law allows. Write in and a person will handle it — there is no form to find.

A diner who wants their record removed should ask the restaurant they gave it to. If they come to us, we will pass the request on to you and help you action it, because it is your record to remove.

Access to production data is limited to the people who need it to run the service. Third-party access tokens and payment credentials are encrypted at rest. Traffic between your browser and us is encrypted in transit.

No system is beyond compromise, and anyone who tells you otherwise is selling something. If we ever have a breach that affects you, you will hear it from us.

If this policy changes materially we will say so rather than quietly change the date. The date at the top is the last time the text below was edited.

For anything on this page, use the form on this site and say it is a privacy question. It reaches a person.