Privacy Policy

RestaurantOS is business software used by restaurants, so responsibility is split into two cases:

• Restaurant accounts. When a restaurant signs up and its staff create logins, we decide how that account information is handled. We are the data controller for it.
• Diner and employee records. When a restaurant enters details about its guests or its staff into RestaurantOS, the restaurant decides what to collect and why. The restaurant is the controller and we act as its processor, handling the data only to run the service on its behalf and under its instructions.

If you are a diner or an employee of a restaurant that uses RestaurantOS and you want your information changed or removed, the fastest route is to contact that restaurant directly. You may also contact us and we will pass the request on.

Account and sign-in information. Name, email address, an encrypted (hashed) password, the assigned role, and the restaurant the account belongs to. We never store passwords in readable form.

Information from Facebook Login. If you choose to sign in with Facebook, we receive only what you approve in the Facebook permission dialog, which is your name, email address, Facebook user ID and profile picture. See section 4.

Restaurant business information. Restaurant name, address, phone number, GSTIN, logo, and configuration such as billing, tax, printer and loyalty settings.

Diner information entered by the restaurant. Name, phone number, email address, birthday, dietary preferences, allergies, free-text notes, and derived history such as number of visits, total spend, last visit date, loyalty points, loyalty tier and referrals.

Order and transaction information. Items ordered, quantities, prices, taxes, discounts, payment method, amount received, order and settlement timestamps, and table or order source.

Employee information entered by the restaurant. Name, contact details, job title, department, wage or salary, attendance and payroll records, and documents uploaded by the restaurant. Those documents may include government identity documents, health certificates and employment contracts, which are sensitive. Restaurants should upload them only where they have a lawful basis and the consent of the individual.

Technical information. Server and application logs, including IP address, browser and device type, pages or endpoints accessed, timestamps and error diagnostics.

• To create accounts, authenticate sign-in and control who can see what.
• To provide the core service: taking orders, printing bills and kitchen tickets, tracking inventory, and producing financial and tax reports.
• To run loyalty programmes and customer relationship features, such as points, tiers and campaigns, where the restaurant has enabled them.
• To send transactional and service messages, for example bills or account notices.
• To provide support, investigate issues and keep the platform reliable.
• To detect, prevent and investigate fraud, abuse and security incidents.
• To meet legal, tax and accounting obligations.

We do not use personal information to build advertising profiles, and we do not sell personal information.

RestaurantOS may offer Facebook Login as a way to sign in. Using it is entirely optional, and you can always sign in with an email address and password instead.

What we receive. Only the information you approve in the Facebook permission dialog, which is your name, email address, Facebook user ID and profile picture.

Why we use it. Solely to create and identify your RestaurantOS account, sign you in, and show your name and picture inside the application.

What we do not do. We do not post anything to Facebook on your behalf. We do not access your friends list, messages, photos or timeline. We do not use Facebook data for advertising, and we do not sell or share it with third parties for their own purposes.

Disconnecting. You can revoke access at any time in Facebook under Settings and Privacy, then Settings, then Apps and Websites. Revoking access stops any future sharing from Facebook, but it does not by itself delete the information we already hold. To have that deleted, follow section 8.

We do not sell personal information. We share it only in these situations:

• Hosting and storage providers. Amazon Web Services stores uploaded files and images, including logos and documents, in the Asia Pacific (Mumbai) region.
• Artificial intelligence features. Where a restaurant uses AI-assisted features such as menu suggestions or report summaries, the relevant content is sent to Google Generative AI to produce the result.
• Point-of-sale integrations. If a restaurant connects an external point-of-sale system such as PetPooja, order and customer data is exchanged with that system on the instruction of the restaurant.
• Messaging providers. If a restaurant runs WhatsApp, SMS or email campaigns, the recipient contact details and message content are passed to the provider that delivers them.
• Legal and safety. Where we are required to by law, court order or a valid request from a public authority, or where it is necessary to protect our rights, users or the public.
• Business transfers. If the business is sold, merged or reorganised, information may transfer to the successor under this policy.

We keep personal information for as long as the account is active and for as long as we need it to provide the service.

Orders and financial records are retained after deletion requests where tax and accounting law requires it. Orders are never erased outright by ordinary use of the software: they are marked as deleted and kept for audit and statutory reporting.

When information is no longer needed and no legal obligation requires us to keep it, we delete it or render it anonymous.

• Traffic between your browser and our servers is encrypted using HTTPS.
• Passwords are stored only as salted hashes, never in readable form.
• Access is controlled by authenticated sessions and role-based permissions, so staff only reach what their role allows.
• Each restaurant's data is separated from other restaurants on the platform.
• Access to production systems is restricted to authorised personnel.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

If you used Facebook Login. Deleting your data involves two independent steps:

• In Facebook, go to Settings and Privacy, then Settings, then Apps and Websites, select RestaurantOS and remove it. This stops Facebook from sharing anything further with us.
• Email us as described above so that the information already stored in RestaurantOS is deleted. Removing the app in Facebook does not delete it on its own.

If you are a diner or an employee of a restaurant. Your records belong to that restaurant, so please contact the restaurant directly. You can also write to us and we will forward your request to them.

What is deleted and what is retained. We delete your profile, contact details, login credentials, any information received from Facebook, loyalty balances and marketing preferences. We may retain completed order, billing and tax records where law requires it, and where we do, they are kept only for that purpose and detached from your contact details wherever possible. We may also retain limited records needed to resolve disputes or enforce our agreements.

Subject to applicable law, you may ask us to:

• Confirm what personal information we hold about you and give you a copy.
• Correct information that is inaccurate or incomplete.
• Delete your information, as described in section 8.
• Withdraw consent you previously gave, without affecting processing already carried out.
• Object to or restrict certain processing.

To exercise any of these, email privacy@dinemine.in. We may need to verify your identity before we act. If we hold the information on behalf of a restaurant, we will refer the request to that restaurant and support them in answering it.

If you are in India, you have rights under the Digital Personal Data Protection Act, 2023, including the right to raise a grievance. If you are unhappy with our response, you may escalate to the competent authority in your jurisdiction.

RestaurantOS is business software intended for restaurant operators and their staff. It is not directed at children, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy as the platform or the law changes. When we do, we will revise the date at the top of this page. If the change is significant, we will give notice inside the application or by email. Continuing to use RestaurantOS after an update means you accept the revised policy.

For any question about this policy, about how your information is handled, or to make a privacy or deletion request:

RestaurantOS
Email: privacy@dinemine.in
Website: https://dinemine.in