Privacy Policy

From Restaurant Owners and Staff

• Owner name, email, mobile number, login ID and password (stored only as a secure hash), manager PIN (hashed).
• Business details: restaurant and branch names, addresses, location, GSTIN or tax number, FSSAI or licence numbers, bank or UPI details shown on bills.
• Staff names, roles, logins, attendance and rosters, and an audit trail of actions such as voids, discounts and refunds.
• Subscription and payment records (amount, period, method, reference) and support tickets.
• Keys you enter to connect third parties (payment gateway, delivery platforms, messaging providers). These are stored encrypted.

From Guests

• Name and mobile number, used to verify orders (OTP, WhatsApp or missed call) and to send order or booking updates.
• Orders, table number, bills, preferences and loyalty points at that restaurant.
• Table booking details: name, mobile number, party size, date, time and notes.
• Payment status for online takeaway orders. Card, UPI and bank details are entered directly with the payment gateway (e.g. Razorpay); RestroBeat never sees or stores them.

Automatically

• Device and log data: IP address, browser type, timestamps and error logs, used for security, rate limiting and fixing problems.
• Browser storage (localStorage) to keep you signed in, remember a kiosk or counter device, hold offline bills until they sync, and remember finder choices. We do not use advertising or tracking cookies.

• To provide the Service: take orders, send them to the kitchen, print bills and KOTs, take bookings, run loyalty, inventory and reports.
• To verify Guests and prevent fake or abusive orders.
• To manage subscriptions, trials and invoices, and to give support.
• To keep the Service secure: detect fraud, enforce limits and keep audit logs.
• To meet legal obligations, such as tax and accounting record keeping, and lawful requests from authorities.
• To send service messages (trial ending, payment due, important changes). Marketing messages are sent only with consent, and you can opt out at any time.

We process personal data on the basis of consent given when you register, sign in, order or book, and for the legitimate uses allowed by Section 7 of the DPDP Act — such as providing a service you asked for, meeting legal obligations, and responding to emergencies.

You may withdraw consent at any time by contacting us (or, for Guests, the restaurant). Withdrawing consent does not affect processing already done, and some features — such as placing verified orders — may no longer work.

For restaurants and guests outside India, where laws such as the EU/UK GDPR apply, our bases are contract performance, legitimate interests, legal obligation and consent.

We do not sell personal data. We share it only as needed to run the Service:

• The restaurant a Guest orders from or books with.
• Hosting and infrastructure providers that run our servers and database (for example Cloudflare and our managed PostgreSQL provider).
• Services a restaurant chooses to connect — payment gateways (e.g. Razorpay), delivery platforms (e.g. Swiggy, Zomato), WhatsApp, SMS or missed-call providers, Tally — under that restaurant's own account.
• Authorities when required by law, court order or to protect rights and safety.
• A buyer or successor if our business is merged or sold, under the same protections.

Our service providers may process data outside India. When they do, we use providers bound by contract to protect it, and we follow any restrictions notified by the Government of India under the DPDP Act.

• Account and Restaurant Data: while the account is active, and up to 30 days after closure so you can request an export.
• Bills, invoices, subscription payments and audit logs: as long as tax and accounting laws require (generally 6 to 8 years in India under the GST and Companies laws).
• Guest verification codes: minutes only. Guest profiles and bookings: as long as the restaurant keeps its account, or until the Guest asks for deletion where the law allows.
• Server logs: up to 180 days, as required by CERT-In directions.

• Encrypted connections (HTTPS) for all traffic.
• Passwords and PINs stored only as hashes; third-party keys and secrets encrypted at rest.
• Each restaurant's data kept separate, with role-based access for staff and manager approvals for sensitive actions.
• Rate limits, audit trails and regular backups.

If a personal data breach happens, we will inform affected Restaurant Owners and, as required, the Data Protection Board of India and CERT-In, and take steps to contain it. Where we act as a processor, we will help the restaurant notify its Guests.

Under the DPDP Act you have the right to:

• Get a summary of the personal data we hold about you and how it is processed.
• Have inaccurate or incomplete data corrected and updated.
• Have data erased when it is no longer needed, unless the law requires us to keep it.
• Withdraw consent.
• Nominate another person to exercise your rights in case of death or incapacity.
• Raise a grievance with us, and if unresolved, complain to the Data Protection Board of India.

Where the GDPR or similar laws apply, you also have rights to data portability, to object to and to restrict processing, and to complain to your local supervisory authority.

To use a right, email [support@your-domain]. We may need to verify your identity. We respond within 30 days.

Restaurant and staff accounts are for adults only. Guests under 18 should order with a parent or guardian. We do not knowingly collect children's data without verifiable parental consent, and do not track or target advertising at children.

We may update this policy as the Service or the law changes. The "Last updated" date shows the current version; material changes are notified to Restaurant Owners by email or in the app. See also our Terms & Conditions.

For privacy questions or complaints, contact our Grievance Officer:

• Name: [Grievance Officer name]
• Email: [grievance@your-domain]

• Business: [Registered business name] (operating RestroBeat)
• Address: [Registered office address, City, State, PIN, India]
• Email: [support@your-domain]
• Phone: [+91 XXXXX XXXXX]

We acknowledge grievances within 48 hours and aim to resolve them within 30 days.