Privacy Policy

This policy explains what personal data Shanti Technologies handles through BaithoBitao, why, and what you can do about it, under the Digital Personal Data Protection Act, 2023.

1. Two kinds of people, two roles

Restaurant owners and staff who use BaithoBitao: we decide how your account data is used, so we are its Data Fiduciary.

Customers of those restaurants (people who order, get bills or join a loyalty card): the restaurant decides what to collect and why, and is the Data Fiduciary; we process it for them as their Data Processor, only on their instructions.

2. What we collect

• Owners and staff: name, mobile number, email, the business's name, address and GSTIN, payment records (not your card or UPI details - Razorpay holds those), and sign-in records.
• Restaurant customers: what the restaurant records - usually a name and mobile number, orders and bills, loyalty stamps, feedback, and birthday or anniversary if given.
• Technical data: IP address, device and browser type, and logs needed to keep the service secure and working.

3. Why we use it

• to provide the service: sign-in, orders, bills, invoices, loyalty, messages;
• to bill you, send invoices and tell you about your account;
• to keep the service secure, prevent fraud and fix problems;
• to meet legal duties, such as keeping tax records.

We do not sell personal data, and we do not use a restaurant's customer list for anything except that restaurant's own use of BaithoBitao.

4. Who we share it with

Only the companies that help run the service, and only what each needs: hosting and database providers (servers in India), Razorpay for payments, SMS providers for sign-in codes, and email providers for invoices and account emails. Each is bound to protect it. We share data with authorities only when the law requires it.

5. How long we keep it

Account data is kept while the account is open. After a business closes its account, there are 30 days to change its mind; then personal data is erased. Bills and tax records are kept for six years as Indian tax law requires, then deleted.

6. Keeping it safe

Each business's data is kept separate from every other's, connections are encrypted, passwords and secrets are stored encrypted, and staff access depends on their role. No system is perfectly secure, but we take reasonable care and will tell affected people and the Data Protection Board if a breach puts their data at risk, as the law requires.

7. Your rights

You can ask to see, correct or erase your personal data, withdraw consent, and nominate someone to act for you. How to ask, and how long we take, is on Your personal data. Restaurant customers should ask the restaurant first; we will help it answer.

8. Cookies

We use only the cookies needed to keep you signed in, remember your cart and table, and keep the service secure. We do not use advertising cookies.

9. Contact and grievances

Shanti Technologies

If we do not resolve a grievance, you can complain to the Data Protection Board of India.