Privacy Policy

1. Two kinds of data — an important distinction

• Your account data — data about you and your restaurant (below). We are the data fiduciary for this.
• Data you put into the Service — your menu, orders, staff logins, and the personal data of your customers (for example the name and phone number a diner gives when ordering online). For this, you are the data fiduciary and we act as your data processor, handling it only on your instructions to run the Service for you.

2. What we collect (account data)

• Your name, email address, restaurant name, and chosen subdomain.
• Your password, stored only as a secure one-way hash — we never store it in readable form.
• Basic usage and technical data (log entries, IP address, timestamps) needed to operate and secure the Service.

3. How we use it and our lawful basis

We use account data to create and run your account, verify your email, provide support, keep the Service secure, and comply with law. Our basis is the consent you give at sign-up and the necessity of processing to provide the Service you asked for. You can withdraw consent by closing your account (which may mean we can no longer provide the Service).

4. Who we share it with

We do not sell personal data. We share it only with service providers who help us run the Service, under confidentiality obligations, including our cloud hosting provider, our transactional email provider (Resend), and — only if you use the AI menu-scan feature — our AI provider for that request. We may disclose data where required by law.

5. Storage, security & retention

Each restaurant’s data is kept in a separate database, isolated from other restaurants. Connections are encrypted in transit (HTTPS), passwords are hashed, and we take reasonable technical and organisational measures to protect data. We keep account data while your account is active and for a reasonable period afterwards, then delete or anonymise it, unless a longer period is required by law.

6. Your rights

Subject to the DPDP Act, you may request access to, correction of, or erasure of your account data, and may raise a grievance. To exercise these rights, contact us at the address below. If you are a diner whose data a restaurant collected through the Service, please contact that restaurant, which is the fiduciary for your data; we will assist the restaurant as its processor.

7. Cookies

We use only essential cookies needed to log you in and keep your session secure. We do not use advertising or third-party tracking cookies.

8. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect data from children.

9. Changes

We may update this policy and will update the “Last updated” date above. Material changes will be notified by reasonable means.

10. Contact & grievances

For privacy questions or to exercise your rights, contact our grievance officer at privacy@billing.smartmade.site. We will respond within the timelines required by law.