Privacy Policy

Rising Web LLP (“we”, “us”), handles personal data on restroos.io, app.restroos.io, myorder.is and the Restro OS staff app. This policy is written under the Digital Personal Data Protection Act 2023 (“DPDP Act”), the DPDP Rules 2025 and the Information Technology Act 2000.

If you are a Diner and want to exercise rights over your order data, you can contact the restaurant directly or write to us and we will pass your request on.

• Restaurant accounts: name, email, phone, business name and address, GSTIN, FSSAI registration or licence number, billing details, and staff names, emails, phone numbers and roles.
• Information you create in the product: your menu and prices, tables and QR codes, orders, bills, coupons, your team list and invites, and a log of who changed what in your account.
• Diners: name and phone number (if the restaurant asks for them), table number, order items, notes and order history with that restaurant.
• Device and usage data: IP address, browser and device type, pages viewed, actions taken, and app push-notification tokens, collected through cookies and analytics tools. When you sign in or sign up, a security check (Cloudflare Turnstile) also looks at signals from your browser to tell people from bots.
• Consent records: which version of our Terms and this policy you accepted, when, and from which IP address and browser.
• Communications: messages you send us, and one-time login codes or order messages we send by email, SMS or WhatsApp.

We do not ask for card or UPI details; payment gateways collect those directly under their own policies.

• To create and secure accounts, including sending one-time login codes.
• To run the Service: show menus, route orders to kitchens, send order updates and staff notifications.
• To bill restaurants and meet tax and legal obligations, including proof that you accepted our Terms.
• To provide support and respond to complaints.
• To understand usage and improve the product, using analytics.
• To send restaurants product updates; you can opt out of non-essential messages at any time.

We rely on your consent or on other uses the DPDP Act permits, such as data you voluntarily provide for a specific purpose, or compliance with law. Service messages (sign-in codes, team invites, account notices) are part of the Service and are sent whether or not you opt in to marketing. Marketing emails are optional: we send them only if you tick the optional box at signup or turn them on later, every one has an unsubscribe link, and we keep a record of when you opted in or out. We do not send marketing by SMS or WhatsApp without asking for your separate consent first.

We do not sell personal data. We share it only with:

• The restaurant you order from (for Diner data), and your own team, who see the parts of your account their role allows.
• Service providers who process data for us under contract: cloud hosting and database (Vercel, Supabase), email delivery (Resend), bot protection (Cloudflare), analytics (Vercel Analytics and PostHog), messaging (Meta WhatsApp Business, SMS and email providers), and payment gateways (Razorpay) for restaurant billing.
• Authorities, when the law requires it.
• A buyer or successor if our business is merged or sold, under the same protections.

Some providers may store data outside India. We transfer data abroad only as the DPDP Act permits and not to any country the Government of India restricts.

• Account data: while the account is active, then up to 30 days after closure for export, then deleted.
• Invoices and tax records: as long as tax law requires (currently at least 6 years under GST law).
• Diner order data: as long as the restaurant keeps its account, or until the restaurant asks us to delete it.
• Analytics data: up to 12 months, then deleted or anonymised.
• The activity log in your dashboard is kept for 7 days and then deleted automatically. You can export it before then.
• Consent records are kept for as long as needed to show that consent was given.

Under the DPDP Act you can:

• access a summary of your personal data and how it is processed;
• ask us to correct, complete, update or erase it;
• withdraw consent at any time (this does not affect processing already done);
• nominate someone to exercise your rights if you die or become incapable; and
• raise a grievance with us, and then with the Data Protection Board of India if unresolved.

Email [email protected] to use these rights. We may need to verify your identity first, and we will respond within the time the law sets.

The Service is not meant for anyone under 18 to use on their own. Restaurants must not knowingly collect children’s data through the Service without verifiable parental consent as required by the DPDP Act.

We use encryption in transit, access controls, row-level security separating each restaurant’s data, and limited staff access. No system is perfectly secure. If a personal data breach occurs, we will inform affected people and the Data Protection Board as the law requires, and inform restaurants about breaches affecting their Diners.

We use essential cookies and browser storage to keep you signed in, remember your progress while you sign up and remember your cart. The Cloudflare security check may set its own cookies or storage. On the marketing site we use Vercel Web Analytics and Speed Insights, which do not use advertising cookies; on myorder.is, PostHog analytics runs only if you accept the cookie prompt. We do not use advertising cookies. You can block cookies in your browser, but some features may stop working.

We will post updates here with a new version and effective date, and notify restaurants of material changes by email or in the dashboard.

Ajay Kumar
Rising Web LLP
Email: [email protected]
Phone: +91 88860 99660

We acknowledge grievances within 24 hours and aim to resolve them within 15 days.