Privacy Policy

CafeStat (“CafeStat”, “we”, “us”) is currently operated as an unregistered brand rather than through a separately incorporated company. For the purposes of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), the individual(s) operating CafeStat act as the Data Fiduciary for the personal data described below, contactable at svntytoopixels@gmail.com.

This policy covers two different people, because they use CafeStat very differently: the Café (the business and its staff who register and run CafeStat) and the Guest (a customer who scans a table’s QR code to order, or tracks a delivery).

1. What we collect

From a Café and its staff

• Business details — café/brand name, country, address, tax settings.
• Staff details — name, email, phone number, and role, provided when an account is created or a staff member is invited.
• Menu, pricing, table layout and other operational data you enter.
• Order, bill and payment-method records generated by using CafeStat (what was ordered, what was charged, and how it was settled — not card or bank details, which never pass through CafeStat since we don’t process payments).

From a Guest

• Nothing, to open the menu and browse. Ordering may ask for a name for the kitchen ticket, and a delivery order needs an address and phone number so a rider can reach you.
• A short-lived session token tied to the table you scanned, so your phone can follow your own order. There is no guest account, login or password.
• If a delivery is tracked by link, the tracking page itself shows no address, phone number or surname to whoever holds the link — only an estimated time.

2. How we use it

• To operate the service — take orders, run the kitchen display, dispatch deliveries, generate bills and reports.
• To bill a Café for orders placed, as described in our Terms.
• To contact a Café’s staff about their account, an invoice, or a change to the service.
• To fix problems and improve CafeStat, generally by looking at aggregated or de-identified usage rather than any one person’s data.

We do not use personal data to build advertising profiles, and we do not sell personal data to anyone.

3. Cookies and tracking

CafeStat always uses the cookies and tokens needed to keep you signed in, or to keep a guest’s ordering session tied to their table — these aren’t optional, since the product doesn’t work without them, and nothing in this section applies to them.

With your permission, given through the cookie banner shown on your first visit, we also set an analytics cookie to see which pages are actually used and where something’s confusing. It doesn’t identify you by name, isn’t used for advertising, and isn’t shared with anyone outside CafeStat. Declining it changes nothing about using the product — you can change your mind at any time from the “Cookie preferences” link in the footer. We do not run advertising trackers or sell data derived from this cookie to anyone.

4. Who we share it with

• We don’t sell personal data or share it for marketing purposes.
• We use infrastructure providers — hosting, email delivery, and similar — to run CafeStat. They process data only to provide that infrastructure to us, under the confidentiality that implies, and some of these providers may be located outside India.
• A rider delivering an order sees what they need to complete that delivery — an address and a phone number — and nothing about your bill or your table.
• We may disclose information if required to by law, or to protect the rights, safety or property of CafeStat, a Café, or a Guest.

5. How long we keep it

Bills and invoice records are kept for as long as applicable tax and accounting law requires. Account and operational data is kept while an account is active, and for a reasonable period afterwards in case it’s needed for a data-export request, a legal obligation, or to resolve a dispute — after which it’s deleted.

6. Your rights

Under the DPDP Act, you can ask us to confirm what personal data of yours we hold, to correct it, or to erase it (subject to our own obligations, such as retaining a bill for tax purposes), and to nominate someone to exercise these rights on your behalf in the event of your death or incapacity. To ask, write to svntytoopixels@gmail.com; we’ll aim to respond within 30 days.

If you’re not satisfied with how we’ve handled a request, you can raise it with the Data Protection Board of India once it is constituted and operational under the DPDP Act.

7. Security

We take reasonable technical and organisational measures to protect personal data — access to Café data is restricted to that Café’s own staff and to CafeStat’s operators for support purposes, and passwords are never stored in plain text. No system is perfectly secure, and we can’t guarantee absolute protection against every possible attack.

8. Children

CafeStat is a business tool and an ordering page, not a service directed at children. We don’t knowingly collect personal data from a child in a way that requires a parent or guardian’s consent under the DPDP Act; if you believe a child’s data has reached us, contact us and we’ll remove it.

9. Changes to this policy

We may update this policy as CafeStat changes. If a change is material, we’ll let registered Cafés know by email before it takes effect.

10. Contact

For anything in this policy, or to exercise a right described above, write to svntytoopixels@gmail.com. This is also the contact point for grievance redressal under the DPDP Act.