Privacy Policy

1. Scope & Commitment

This Privacy Policy explains how we collect, process, store, and safeguard data when you use our mobile applications and cloud platform. We are committed to absolute transparency and full compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and Google Play Developer Data Safety Policies.

2. Information We Collect

We collect only the minimum information necessary to deliver high-performance restaurant billing and kitchen coordination:

• Account & Profile Data: Full name, mobile phone number, email address, password hash (salted via bcrypt), designated staff role (Owner, Manager, Captain, Cashier), and assigned restaurant branch UUID.
• Restaurant Operational Data: Legal restaurant name, trade name, GSTIN, FSSAI license number, outlet address, menu catalogs, dining table identifiers, kitchen orders (KOT), bills, and discount ledgers.
• Device & Diagnostic Telemetry: Device model, operating system version, app version code, network connectivity status, and crash analytics collected via Sentry for bug triage and runtime stability.
• Push Notification Tokens: Firebase Cloud Messaging (FCM) or Expo Push Tokens utilized strictly for real-time order alerts, urgent kitchen order notifications, and fraud alerts.
• Biometric Authentications: When you enable App Lock in our mobile apps, biometric validation (fingerprint/face recognition) is processed entirely on-device by your operating system’s secure hardware enclave (Android BiometricPrompt). RestroMithra never collects or stores biometric data.

3. Purpose of Processing

We process your data strictly for legitimate operational purposes:

• Authenticating staff and preventing unauthorized access to restaurant financials.
• Routing real-time Kitchen Order Tickets (KOT) to appropriate kitchen prep stations.
• Calculating Goods and Services Tax (CGST, SGST, IGST) and rendering compliant tax invoices.
• Syncing offline billing data once network connectivity is restored.
• Preventing internal POS theft, unauthorized discounts, and cash drawer discrepancies.

4. Data Sharing & Third-Party Processors

We do not sell, rent, or monetize your data. We share data only with verified cloud infrastructure providers essential for app operation under strict data processing agreements:

• Cloud Hosting & DB: Amazon Web Services (AWS) Asia Pacific (Mumbai region, ap-south-1).
• Edge Security & CDN: Cloudflare Inc. (TLS 1.3 encryption, DDoS mitigation).
• SMS Authentication Gateways: Fast2SMS / Telecom DLT partners for transactional one-time password (OTP) delivery.
• Crash Diagnostics: Sentry (Functional performance monitoring and runtime crash stack traces).

5. Data Security Standards

All communication between our mobile apps, web POS, and cloud APIs is enforced over HTTPS with TLS 1.3 encryption. Databases utilize PostgreSQL with isolated tenant schema architectures, encrypted secrets at rest, and Redis token blacklists for instant session revocation.

6. Data Retention & Account Deletion Policy

In full compliance with Google Play Store User Data Policies and the DPDP Act 2023, you have the absolute right to request complete deletion of your account and personal data:

• In-App Deletion: You can delete your account instantly by navigating to More > Danger Zone > Delete Account in the RestroMithra HQ app.
• Web Deletion Portal: You can submit a deletion request online at any time via our Account Deletion Request Page.
• Tax & Statutory Retention: Under Section 36 of the Central Goods and Services Tax (CGST) Act, 2017, registered businesses are legally mandated to retain books of accounts and tax invoices for 72 months from the due date of the annual return. When an account is deleted, all personal identification (names, phone numbers, emails, biometrics, credentials) is immediately purged or anonymized, while statutory invoices are retained in an unlinked, non-identifying format.

7. Grievance Officer & Contact Information

For privacy inquiries, data rectification, or deletion escalations, contact our designated Data Protection Grievance Officer: