This Privacy Policy explains how RestroBuzz ("RestroBuzz", "we", "us", "our"), the operator of restrobuzz and the RestroBuzz platform (the "Service"), collects, uses, discloses, and protects information relating to (a) restaurants and food businesses that register for and use the Service ("Merchants", "you") and (b) individuals who view a Merchant's digital menu or place an order through the Service ("Guests").

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended from time to time.

By creating an account, accessing restrobuzz, or otherwise using the Service, you acknowledge that you have read and understood this Policy and consent to the collection, use, and disclosure of information as described here. If you do not agree with this Policy, please do not use the Service.

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.
• "Merchant" means a restaurant, café, cloud kitchen, or other food business that registers an account on the Service.
• "Guest" means any individual who accesses a Merchant’s digital menu or places an order through the Service, typically by scanning a QR code.
• "Data Fiduciary" means RestroBuzz, in respect of Personal Data it determines the purpose and means of processing for.
• "Data Principal" means the individual to whom the Personal Data relates — i.e. a Merchant’s authorised representative or a Guest.

We collect information in the following ways:

• Account information you provide: name, mobile number, email address, restaurant/business name, business address, and any GST or business-registration details you choose to provide during onboarding.
• Menu content: the images, PDFs, item names, descriptions, prices, and categories you upload or share with us so that we can build your digital menu, including via our AI-assisted extraction process.
• Verification data: your mobile number is verified using an OTP (one-time password) at signup. We do not require card or bank details, or documents, to start a free trial.
• Guest interaction data: when a Guest scans a QR code and views a menu or places an order, we may collect the device/browser type, IP address, table number (if applicable), items selected, and order timestamp. Guests are typically not required to create an account or log in.
• Communications: messages you send us via WhatsApp, phone, email, or the contact form, including the content of those messages.
• Usage and log data: pages visited, features used, timestamps, approximate location (derived from IP address), and diagnostic data collected automatically through cookies and similar technologies.
• Billing information: if you subscribe to a paid plan after your free trial, payment details are collected and processed by our third-party payment processor; RestroBuzz does not store full card numbers on its own servers.

We use the information we collect to:

• Create and administer Merchant accounts, including OTP-based verification.
• Build, host, and update digital menus, including AI-assisted extraction and human review of uploaded menu content.
• Operate the QR-based ordering experience for Guests and relay orders to the relevant Merchant.
• Process subscription billing once a free trial ends, and manage renewals, upgrades, downgrades, and cancellations.
• Provide customer support, including responding to queries raised via WhatsApp, phone, or email.
• Send transactional and service communications (for example, account, billing, or menu-status updates), and, where you have opted in, promotional communications.
• Monitor, maintain, and improve the security, performance, and functionality of the Service.
• Detect, investigate, and prevent fraud, abuse, or violations of our Terms of Service.
• Comply with applicable law, regulatory requirements, and lawful requests from public authorities.

We process Personal Data on one or more of the following bases recognised under the DPDP Act: (a) your consent, given at the time of account creation or when you otherwise provide information to us; (b) processing necessary for the performance of a contract with you (for example, delivering the Service you signed up for); (c) compliance with a legal obligation; and (d) certain "legitimate uses" permitted under the DPDP Act, such as responding to a request you have voluntarily made.

Where consent is the basis for processing, you may withdraw it at any time as described in Section 10 below, without affecting the lawfulness of processing carried out before withdrawal.

We use cookies, local storage, and similar technologies to keep you signed in, remember preferences, understand how the Service is used, and improve performance. You can control cookies through your browser settings; disabling certain cookies may affect the functionality of the Service, including the QR-menu ordering flow.

We do not sell Personal Data. We may share information with:

• Service providers who host our infrastructure, process payments, send communications (including via WhatsApp Business messaging), or provide analytics — solely to help us operate the Service, and bound by confidentiality and data-protection obligations.
• The relevant Merchant, where a Guest places an order through that Merchant’s digital menu — order details are shared with the Merchant so they can fulfil the order.
• Law enforcement, regulators, or courts, where required by applicable law, or to protect the rights, property, or safety of RestroBuzz, our users, or the public.
• A successor entity, in the event of a merger, acquisition, restructuring, or sale of assets, subject to that entity honouring the commitments in this Policy.

Information is stored on secure cloud infrastructure. We retain Personal Data for as long as your account is active and for a reasonable period thereafter to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. Menu content is retained for as long as your account remains active, unless you request earlier deletion.

We implement reasonable security practices and procedures, including access controls, encryption in transit, and restricted internal access, consistent with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, including the DPDP Act, you have the right to:

• Access a summary of the Personal Data we hold about you and how it is being processed.
• Request correction or updating of inaccurate or incomplete Personal Data.
• Request erasure of your Personal Data, unless we are required or permitted by law to retain it.
• Withdraw consent at any time, where processing is based on consent (this may limit or end your ability to use parts of the Service).
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Register a grievance with our Grievance Officer (Section 15) and, if unresolved, escalate the matter to the Data Protection Board of India.

To exercise any of these rights, write to us at privacy@restrobuzz.com.

The Service is intended for use by restaurant businesses and their adult representatives, and by Guests of legal age to place food or beverage orders. We do not knowingly collect Personal Data from children. If you believe a child has provided us with Personal Data, please contact us and we will take appropriate steps to delete it.

The Service may link to, integrate with, or rely on third-party services, including WhatsApp/Meta messaging and payment processors. Your use of those services is governed by their own privacy policies and terms, and RestroBuzz is not responsible for their practices.

In the event of a Personal Data breach that is likely to affect you, we will notify affected users and the relevant regulatory authorities as required under applicable law, and take reasonable steps to contain and remediate the breach.

In accordance with the IT Act, 2000, the IT Rules 2021, and the DPDP Act, the following Grievance Officer has been appointed to address privacy-related complaints and queries:

• Name: The Grievance Officer, RestroBuzz
• Email: privacy@restrobuzz.com
• Address: India

We will acknowledge complaints within a reasonable time and endeavour to resolve them within the timelines prescribed under applicable law.

We may update this Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date below indicates when this Policy was last revised. Material changes will be notified through the Service or by email where appropriate. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

This Policy is governed by the laws of India. Subject to the dispute-resolution provisions of our Terms of Service, the courts at India shall have exclusive jurisdiction over any disputes arising out of or relating to this Policy.

If you have questions about this Privacy Policy or how we handle your information, contact us at privacy@restrobuzz.com or write to us at India.