Your personal data

Who holds what

If you are a customer of a cafe or restaurant that uses this software — your name and mobile number are on their loyalty list or their bills — then that business decides what to collect and why. Under the Act it is the Data Fiduciary and we are its Data Processor. Ask them first; if you cannot reach them, write to us at the address below and we will pass it on and chase it.

If you are an owner or a member of staff at a business that uses this software, we hold your name, mobile number and email to run your account, and we are the Data Fiduciary for that. Owners can act on all of this from Your data and account inside the admin.

What you can ask for

A summary of what we hold — section 11

What personal data we are processing about you, what we are doing with it, and who else has been given it.

Correction or completion — section 12(1)

Anything wrong, out of date or half-finished, put right.

Erasure — section 12(3)

Your personal data deleted, unless a law requires us to keep it. Where a law does, we will tell you which one and for how long.

To withdraw consent — section 6(4) to 6(6)

As easily as you gave it. Replying STOP to a marketing message is enough to stop marketing messages; it does not stop the bill for what you just bought.

To raise a grievance — section 13

About any of the above, whether or not you have asked us for anything else first.

To nominate someone — section 14

A person who can exercise these rights for you if you die or become unable to act.

How to ask

Write to the grievance officer using the contact details below. Say which of the things above you want, and quote the mobile number you gave the business so that we can find the right record — that number is the identifier we hold you under, as Rule 14(1)(b) of the DPDP Rules, 2025 puts it. We may ask you to prove the number is yours with a code, because handing somebody else's data to whoever asks for it would be the worse failure.

We answer within 30 days. The law allows up to 90; we do not intend to use them.

When we cannot delete something

Tax law beats a deletion request, and it is better to say so plainly. Section 36 of the CGST Act, 2017 requires a registered business to keep its books and invoices for seventy-two months from the due date of its annual return. So when a business closes its account here:

• Personal data is erased after 30 days — names, mobile numbers, email addresses, birthdays, notes, message history and every sign-in. You are told at least 48 hours before it happens, which is what Rule 8 of the DPDP Rules, 2025 requires.
• Invoices are kept for 6 years — the number, the date, the total and the tax on it. After the erasure none of them names anybody. They are destroyed in full when the 6 years are up.

Contact

This server has not published a data protection contact yet. Rule 9 of the DPDP Rules, 2025 requires one before it takes anybody's personal data.

If we do not deal with a grievance properly, you can complain to the Data Protection Board of India.