Privacy Policy

1. Who this policy is about

This policy is issued by Swadishta ("we," "us"), the operator of Swadishta and the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 for the personal data described below. It covers two different groups of people, since we handle their data very differently: restaurant admins/staff who sign in to manage their restaurant, and guests who scan a table QR code to order. You can reach us at support@swadishta.app.

2. Guests ordering food

Guests never create an account and never log in. We don't collect a guest's name, phone number or any other personal identifier when they place an order — the order is linked only to the table it was placed from. We keep the order contents (items, quantities, prices, timestamps) so the restaurant can review its own order history. This data isn't personal data about an identifiable individual, so most of this policy's guest-facing rights don't apply to it — but sections 4 to 9 below still describe how we handle it.

3. Restaurant admins & staff

To sign in, we collect the email address you use to receive a one-time sign-in code — that's the only credential we store; we never ask for or store a password. We also store your restaurant's name, menu, table setup, and the UPI ID you provide for generating your payment QR. If you subscribe, our payment partner Razorpay separately collects and processes your payment details — we don't see or store your card or UPI credentials ourselves.

4. Why we process this data

We process admin/staff email addresses and restaurant data because it's necessary to provide the service you've signed up for — running your ordering system, billing your subscription, and letting your staff manage orders. We don't rely on this data for marketing or any purpose unrelated to running Swadishta for you.

5. What we don't do

• We don't sell your data, your restaurant's data, or your guests' order data to anyone.
• We don't see or touch guest payments — those go directly to your own UPI ID.
• We don't show ads to your guests or to you.
• We don't use your menu or order data to train third-party AI models.

6. Who we share data with

We use the following providers to run Swadishta. Each processes data only on our instructions, to provide their specific service to us — not for their own purposes:

• Turso — our database, storing restaurant, menu, table and order data.
• Upstash — a caching layer that temporarily holds copies of the same data for speed.
• Cloudflare — hosts the website and API.
• Resend — sends sign-in code emails to admins/staff.
• Cloudinary — hosts menu item and restaurant photos you upload.
• Razorpay — processes your subscription payment (RBI-regulated payment aggregator); it does not process guest order payments.

7. Where data is stored

Some of the providers above may store or process data on servers outside India as part of their global infrastructure. Where this happens, it's solely so they can provide their service to us, under their own security and data-handling commitments — we don't otherwise transfer your data internationally.

8. Data retention

We keep order and menu history for as long as your account is active, so you can review it in your dashboard. If you delete your restaurant, we remove your restaurant's menu, tables, orders and staff logins immediately — see our Terms for what this means for any active subscription. We keep billing records for as long as Indian tax law requires (currently up to 8 years) even after account deletion.

9. Security

Data in transit between your device and our servers is encrypted (HTTPS). Access to restaurant data in our systems is limited to what's needed to operate and support the service. No system is perfectly secure, and we can't guarantee absolute security, but we follow reasonable, industry-standard practices for a service of this size.

10. Your rights

As a restaurant admin, you can remove staff access, edit or delete menu items, and delete tables at any time from your dashboard. You can also ask us, at the contact details above, to:

• tell you what personal data we hold about you;
• correct inaccurate data;
• erase your account and associated data (subject to the billing-records exception above); or
• withdraw consent, where withdrawal doesn't affect processing already carried out.

We'll acknowledge requests within 7 working days.

11. Grievance Officer

If you have a complaint about how we've handled your data, contact our Grievance Officer: Swadishta, support@swadishta.app. We aim to acknowledge complaints within 7 working days and resolve them as soon as reasonably possible.

12. Children

Swadishta's admin and staff accounts are intended for adults running or working at a food business. We don't knowingly collect personal data from anyone under 18 through the admin side of the service.

13. Changes to this policy

We may update this policy as the product changes. We'll post the new version here with an updated date, and for a significant change, we'll try to also notify registered admins by email.