Who we are
RestroDOS is operated by RestroDOS ("we", "us"). This policy explains how we handle personal data when you use the RestroDOS website, restaurant storefronts, the restaurant workspace and the rider app. We follow the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000.
We have two roles:
- For your RestroDOS account and the restaurant directory, we decide how your data is used.
- For orders, bookings, customer lists and staff records inside a restaurant's workspace, the restaurant decides how the data is used, and we process it on the restaurant's behalf. For those records, the restaurant's own privacy practices also apply, and you can contact the restaurant directly.
What we collect
Information you give us
- Account: name, email address, mobile number and password. We store the password only in hashed form.
- Orders and bookings: what you order, notes for the kitchen, table, pickup or delivery choice, delivery addresses with their map location, booking date, time and party size.
- Reviews and favourites: ratings, review text, and the restaurants and dishes you save.
- Restaurants: business and legal details, GST and licence numbers, address, menus, images, and payment gateway credentials.
- Staff: details a restaurant adds about its team, such as role, branch, employee code, shifts, attendance and check-in times, leave, salary and payroll records.
Information collected as you use the platform
- Payments: the payment gateway processes your card, UPI or wallet details. We receive and keep only the payment reference, amount, method and status. We never see or store full card numbers.
- Location: if you tap "Near me" in the restaurant directory, your browser shares your approximate location to sort results by distance. We do not save it to your account. Riders share their live location while they are on a delivery, so that the restaurant and the customer can follow it.
- Device and security data: IP address, browser type, sign-in times, and records of important actions (audit logs) to keep accounts secure and investigate problems.
How we use it
- To run your account, and to send email verification, password reset, one-time passwords and security alerts.
- To pass your order or booking to the restaurant, take payment through its gateway, show order status, and coordinate pickup and delivery.
- To send order updates by email, SMS or WhatsApp.
- To let restaurants run their business: kitchen tickets, reports, inventory, attendance and payroll.
- To rank and recommend restaurants in the directory, using overall order volume and ratings.
- To prevent fraud and abuse, enforce our Terms, and meet legal, tax and accounting obligations.
- To provide support and to improve the platform, using aggregated statistics where possible.
We use your data on the basis of your consent, to provide the service you asked for, or where the law requires or permits it. We do not sell personal data, and we do not use third-party advertising trackers.
How long we keep it
- Account data: while your account is active. When you ask us to delete it, we delete or anonymise it, except what we must keep by law.
- Orders, invoices and payment records: for as long as tax and accounting laws require (often six to eight years), even after an account is closed. We never delete them earlier.
- Unfinished carts: deleted after 14 days without activity.
- Security and audit logs: for as long as needed to investigate incidents and meet legal requirements.
- Data held for a restaurant: for as long as the restaurant keeps its workspace, subject to the legal periods above.
How we protect it
- Encrypted connections (HTTPS) between your device and our servers.
- Hashed passwords. Payment gateway secrets are encrypted in the database and never shown in full again.
- Passwords, one-time passwords and gateway secrets are never written to our logs.
- Role-based permissions for staff, and strict separation between restaurants.
- Rate limits on sign-in and other sensitive actions, and audit logs of important changes.
No system is perfectly secure. If a breach affects your personal data, we will inform you and the authorities as the law requires.
Your rights
Under the Digital Personal Data Protection Act, 2023, you can:
- get a summary of the personal data we hold about you and how we use it;
- correct or update inaccurate or incomplete data;
- ask us to erase your data, except where we must keep it by law;
- withdraw consent you have given, without affecting what was done before;
- nominate someone to exercise these rights for you if you die or become unable to;
- raise a grievance with us and, if not resolved, with the Data Protection Board of India.
You can update most account details yourself after signing in. For anything else, email hello@foodplatform.test from the address on your account. For data a restaurant holds about you, such as staff records, you can also ask that restaurant. We will help it respond.
Children
RestroDOS is not meant for children under 18 without a parent's or guardian's consent. We do not knowingly collect children's data without it, and we do not track children or target advertising at them. If you think a child has given us data without consent, contact us and we will delete it.
Where data is stored
Your data is stored on servers run by our hosting providers. If data is processed outside India, we do so only as permitted under Indian law and with safeguards to protect it.
Changes to this policy
We may update this policy as the platform or the law changes. The date at the top of this page shows when it last changed. If a change is significant, we will tell you by email or in the app before it takes effect.
Contact and Grievance Officer
RestroDOS
Email: hello@foodplatform.test
Grievance Officer
Email: hello@foodplatform.test
We acknowledge complaints within 24 hours and aim to resolve them within 15 days.