Privacy Policy

1. What we collect

Ordering at your table (dine-in QR)

You do not need an account to order from your table. When you scan the QR code we store the order itself: the table, the items, any notes you add and the order's status. If you choose to pay online, we ask for your name and phone number so the payment can be processed and matched to your order. Your browser may remember that name and phone so you don't have to type them again next time.

Delivery accounts

To order for delivery you need an account. You can create one in either of two ways:

• Phone and password: your name, your phone number and a password. We never store the password itself, only a secure one-way hash of it.
• Sign in with Google: Google shares your name, email address and profile picture with us. We never receive your Google password.

Whichever way you sign up, we need a phone number so the cafe or the delivery rider can call you about your order.

Delivery addresses and map location

We store the addresses you save, including the pin you place on the map (its latitude and longitude). We use them to deliver your order and to work out the distance-based delivery fee. We only read your device's location when you tap “use my location”, and only to help place the pin; we do not track your location in the background.

Order history

We keep a record of your orders (items, prices, delivery fee, address, payment method and status) so you can see them in your account and so the cafe can handle questions, refunds and accounting.

Payments

Online payments are processed by Cashfree Payments. You enter your card, UPI or bank details on Cashfree's secure checkout, not ours. We never see or store your card number, UPI PIN or bank login. We keep only the payment reference, the amount and the payment status. Cash and counter payments are recorded the same way, without any card or bank details.

2. How we use your information

• To take, prepare and deliver your order, and to contact you about it.
• To calculate delivery fees and check that an address is within our delivery area.
• To process payments and issue refunds.
• To show you your order history and saved addresses.
• To keep accounts and records we are required to keep for tax purposes.
• To keep the service secure and prevent misuse.

We do not sell your personal data, and we do not use it for advertising.

3. Service providers we share data with

We use a small number of trusted providers to run the service. They process data on our behalf and only as needed to provide their service:

• Google: Google Sign-In (if you choose it), and Google Maps, Places and Routes to search addresses, show the map and calculate the delivery distance.
• Cashfree Payments: to process online payments and refunds.
• Vercel: to host the website and app.
• Supabase: to host our database, where orders, accounts and addresses are stored.

Your order details are also visible to our own staff (kitchen, counter and delivery riders) as needed to serve you. We may disclose information if required by law or by a valid request from a government authority.

4. Cookies and local storage

We use a few small, essential pieces of browser storage:

• Login session cookies that keep you signed in to your account.
• Your cart, so the items you add are still there if you reload the page.
• Small preferences, such as remembering that you dismissed the “install the app” prompt, or the name and phone you used to pay.

We do not use advertising or cross-site tracking cookies. Clearing your browser data removes this information from your device and signs you out.

5. How long we keep it

We keep your account details, saved addresses and order history for as long as your account is active. Order, payment and billing records are kept for as long as Indian tax and accounting law requires, even after an account is deleted. Dine-in orders placed without an account are kept as part of the cafe's sales records.

6. Your rights and choices

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct details that are wrong or out of date;
• delete your saved addresses, or delete your account altogether.

To make a request, contact the cafe using the details below. We will honour account deletion requests, except for the order and payment records we must keep for accounting and tax purposes. We may need to confirm your identity first, for example by calling the phone number on your account. If you signed in with Google, you can also remove our access from your Google Account settings at any time.

We aim to handle personal data in line with India's Digital Personal Data Protection Act, 2023, and the rules made under it. If you are unhappy with how we have handled your data, please contact us first so we can try to put it right.

7. Security

The website is served only over encrypted HTTPS connections. Passwords are stored as hashes, access to staff screens is restricted by role, and payments are handled by Cashfree rather than by us. No system is perfectly secure, but we take reasonable steps to protect your information and will act promptly if something goes wrong.

8. Children

Our service is not directed at children under 13, and we do not knowingly collect personal data from them. Accounts and delivery orders should be placed by an adult. If you believe a child has given us personal data, contact us and we will delete it.

9. Changes to this policy

We may update this policy when our service or the law changes. We will post the new version on this page and change the “Last updated” date above. If a change is significant, we will also let account holders know in the app or by phone before it takes effect.

10. Contact us

For any privacy question or request, contact:

• Banarsi Lassi & Cafe, Jaipur, Rajasthan, India
• Website: banarsilassiandcafe.com
• Phone: call the cafe on the number shown in the app (for example under “Forgot password” on the sign-in screen)
• In person: speak to the staff at the counter during opening hours

Please also read our Terms of Service.