Privacy Policy

1. Scope & Data Controller

Swaadbyte is the trade name of S N T GROUP (OPC) PRIVATE LIMITED. For the purposes of this Policy, we act as the data controller for information processed through our owned systems. Restaurants using Swaadbyte remain responsible for how they handle diner-facing service data (such as order fulfilment and on-premise conduct) once it leaves our platform interfaces.

2. Categories of Information We Collect

We collect only what is needed to run subscriptions, authenticate users, route orders, and maintain platform security. The main categories are:

• Merchant & Subscriber Accounts: Business legal name, outlet address, GST or tax identifiers where provided, owner or authorised signatory name, email, mobile number, subscription plan tier, billing history, and manual renewal status.

• Staff & Role-Based Logins: Staff display name, mobile or username credentials, assigned branch, role permissions, shift activity logs, and device/session metadata required for access control.

• Table QR & Diner Order Sessions: Table or section identifiers, items ordered, order timestamps, session tokens, and optional diner contact fields only when the restaurant enables them on the QR flow. We do not require diners to create a permanent Swaadbyte account to place a table order.

• Payments: Subscription charges and in-venue digital payments are processed by authorised gateways (such as Razorpay, Stripe, or Cashfree). We receive transaction references, amounts, and status codes—not full card numbers stored on our servers.

• Technical & Security Logs: IP address, browser or app version, API request logs, error diagnostics, and fraud-prevention signals generated by our backend validation layer.

3. How We Use Your Information

We process data strictly for operational delivery of the Service, including:

• Provisioning and enforcing subscription limits (staff accounts, branches, monthly order ceilings) validated on the server.

• Routing Kitchen Order Tickets (KOT), digital bills, and table-order status between diner QR interfaces and merchant dashboards.

• Sending renewal reminders via dashboard notifications and registered channels (such as WhatsApp or SMS) ahead of plan expiry—consistent with our manual-renewal model (no standing auto-debit mandate stored by Swaadbyte for plan renewal).

• Customer support, billing reconciliation, dispute investigation against server logs, and compliance with applicable Indian law.

• Producing anonymised, aggregated usage statistics to improve product performance. These outputs cannot reasonably identify an individual merchant or diner.

4. What We Do Not Do With Your Data

• No Sale to Data Brokers: We do not sell, rent, or trade your personal information, business analytics, customer order logs, or staff metrics to third-party data brokers or advertising networks.

• No Unrelated Profiling: We do not build cross-restaurant consumer profiles from diner QR sessions for external marketing purposes.

• No Standing Auto-Renew Mandate Storage: Plan renewal is initiated by the merchant; we do not store open-ended bank mandates solely to auto-debit subscription renewals without your action.

5. Sharing & Sub-Processors

We share information only with parties that help us deliver the Service, under contractual confidentiality obligations:

• Payment Gateways (e.g., Razorpay, Stripe, Cashfree) for subscription and in-venue payment settlement.

• Cloud Hosting & Infrastructure providers that store encrypted databases and application logs within commercially reasonable security standards.

• Messaging Providers for transactional WhatsApp/SMS renewal alerts and OTP delivery where enabled.

• Legal & Regulatory Disclosures when required by competent authority, court order, or to investigate fraud, security incidents, or misuse of the Platform.

6. Storage, Retention & Deletion

• Active subscription data is retained for the life of the merchant account plus a reasonable period for backups, audits, and tax record-keeping under Indian law.

• If a subscription lapses and is not renewed after the grace window described in our Terms, backend access may be suspended; data may be archived or deleted per our internal retention schedule except where law requires longer storage.

• Merchants may request export or correction of account-held data by writing to [email protected]. Deletion requests are honoured where no overriding legal or billing obligation requires continued retention.

7. Security Practices

We apply industry-standard safeguards appropriate to a cloud restaurant operations platform, including:

• Encryption in transit (TLS) for dashboard, API, and QR order traffic.

• Role-based access controls separating owner, manager, and staff permissions on the server.

• Restricted internal access to production databases and audit logging of administrative actions.

• No system is perfectly secure. Subscribers must protect staff credentials; compromise arising from shared passwords or device loss remains the merchant's operational responsibility, as stated in our Terms.

8. Your Rights & Choices

Subject to applicable Indian privacy law (including the Digital Personal Data Protection Act, 2023, where it applies), you may:

• Request access to personal data we hold about your merchant account or authorised user profile.

• Request correction of inaccurate business or contact details.

• Request deletion or restriction of processing where legally permissible.

• Opt out of non-essential promotional messages while still receiving transactional renewal and security notices required to operate your subscription.

9. Cookies & Website Analytics

Our marketing website may use cookies or similar technologies for session management, security, and aggregated traffic measurement. Disabling cookies in your browser may limit certain site features. Merchant dashboard sessions use secure authentication tokens separate from public-site cookies.

10. Children's Data

Swaadbyte is a business-to-business restaurant platform intended for merchants and staff aged 18 and above. We do not knowingly collect personal data from children. If you believe a minor has submitted information through our systems, contact us and we will take appropriate steps to remove it.

11. International Transfers

Primary processing and storage are oriented toward service delivery in India. Where a sub-processor operates infrastructure outside India, we require appropriate contractual protections consistent with applicable law.

12. Changes to This Policy

We may revise this Privacy Policy when our product, billing model, or legal obligations change. Material updates affecting subscribers will be communicated via the merchant dashboard or this page with an updated Last Updated date. Continued use after notice constitutes acceptance of the revised Policy.