What a café counter records, and what we do with it.

Two different relationships run in parallel here, and almost everything in this policy follows from the difference between them.

• Your business data. Your account details, your sales, your bake and waste records, your staff records. We hold these to provide the service to you, and we are responsible for how they are handled.
• Your customers' data. The loyalty records and order histories of the people who buy from you. Here you decide what is collected and why. We process it on your instructions, as your processor, and we do not use it for our own purposes.

That second point has a practical consequence: if one of your regulars asks to be deleted, the request is yours to action and the tools to do it are in the product. If they come to us directly, we will point them back to you rather than act on your data without your instruction.

From you, when you sign up. Your name, email address, role, the name of your café or bakery, its city, how many counters you run, the system you currently use, and the bake lines and notes you choose to send. The email address is used to send account and login details.

From your counter, as you trade. Orders and their line items, modifiers, timestamps, the payment mode used, which counter took the order and which member of staff was signed in. Bake quantities logged, units sold, transfers, non-sale depletion such as staff eats or breakages, and units recorded as waste.

Technical data. Sign-in events, device and browser type for the counter terminal, IP address, and an audit log of sensitive actions such as refunds, voids, price edits and permission changes.

From the contact form. Whatever you put in it, used to answer you and nothing else.

Regular-customer recognition needs a record of who returns and what they order. That record is limited to what the feature actually requires: a loyalty identifier, a name if one was given, order history at your counters, and a reward balance.

A person is only in this record if they are using your loyalty identifier or were added by your staff. Recognition is not silent - when it works, somebody at a counter greets a customer by name and offers their usual order, so the person can see exactly what is known about them.

• Order histories are used to establish a usual order and a visit rhythm, and for the rewards you have defined.
• They are never pooled with other cafés, sold, or shared with advertisers or data brokers.
• They are not used to train models that serve anyone else.
• A customer can be deleted on request, which removes the profile and the order history behind it.

Deleting a customer does not remove the underlying sales from your accounting figures, because those are records of your business's trade. It removes the link between those sales and a person.

• Running the service. Taking orders, counting stock, printing receipts, holding rosters. Without this data the product does not function.
• Forecasting and alerting. Sales and waste history produce bake quantity suggestions, low-stock alerts and aging flags.
• Recognition and rewards. Repeat-order patterns stage a usual order and accrue whatever rewards you have configured.
• Support and incident response. Logs are read when something breaks or a change is disputed.
• Security and fraud prevention. Sign-in and audit records exist so unusual refunds or permission changes can be traced.
• Legal and accounting obligations. Some transaction records must be retained for statutory periods regardless of preference.

We do not use your sales data or your customer records for advertising, and we do not build a marketing profile of your business from how you use the product.

Because the forecasting is the part people most often ask about, it is worth being explicit. Bake quantity suggestions for your counter are produced from your counter's own history: units sold per line per day and the hour they sold in, recorded waste, sell-out timing, day of week, recent trend, the public holiday calendar for your city, and weather outlook only where a line has demonstrated a weather relationship in your own data.

There is no shared cross-customer model. Your data does not train forecasting for another café, and another café's data does not forecast yours. Forecasting also operates on line-level volume rather than on individual customers - it does not read who bought what.

Card and UPI acceptance stays with your existing payment provider. We are not in the payment flow. What is recorded against an order is the payment mode and, where your provider returns it, a masked reference such as the last four digits.

Full card numbers, expiry dates, CVV codes and PINs are never transmitted to or stored by us. For your own subscription billing, payment details are handled by the payment processor and we hold only the billing record.

Where you use scheduling and attendance, records are kept of who was rostered, who clocked in and out and when, and which orders were taken during a shift. This exists so you can tell whether cover matched demand and so a disputed transaction can be traced to a session.

It is scoped deliberately. Staff can see their own hours and rota, not those of colleagues. There is no productivity score, no ranking of your team against each other, and no location tracking outside clock-in at the counter terminal.

You remain responsible for telling your team what is recorded, since you are the employer and the controller of that data.

A short list, and it is the whole list.

• Cloud infrastructure and database hosting, on infrastructure located in India, holding data at rest under encryption.
• A transactional email provider, used to send account, login and notification emails. It receives the email address and the message content, and nothing about your sales.
• Your subscription payment processor, for billing you.
• Error monitoring, which receives technical diagnostics rather than customer records.
• Authorities, where we are legally required to disclose and after satisfying ourselves the request is valid.

We do not sell data. We do not share it with advertisers or data brokers. We do not pool your sales or customer data with other cafés for any purpose, commercial or analytical.

• Order, sales, bake and waste records: retained while your account is active, because forecasting quality depends directly on history depth.
• Customer loyalty records: until deleted on request, or 24 months after a customer's last recorded visit.
• Staff records: while employed at your café, then 12 months.
• Access and audit logs: 12 months.
• Contact form submissions: kept while the enquiry is being handled and for a reasonable period afterwards, then deleted.
• After account closure: your data is deleted after a short grace period allowing for accidental closure and for you to take an export, except records we are legally required to keep for longer.

A full export in standard formats is available on request, without a fee and without a waiting period to sit through first.

Under the Digital Personal Data Protection Act, 2023 and comparable frameworks, you can ask us to confirm what personal data we hold about you, correct it, delete it, or provide it in a portable form. You can also withdraw consent where consent was the basis for processing, and nominate someone to exercise these rights on your behalf.

Requests come through the contact page and are answered within the statutory timeline. If we need to verify who you are before acting on a deletion request, we will ask.

For requests from your customers about their own records, you are the controller. The tools to view, correct and delete a customer profile are in the product, and we will help if a request is unusual.

Connections between your counter and the service use TLS 1.2 or above. Stored data is encrypted at rest with AES-256, including backups. Access inside the product is role-scoped, and internal access to production data is limited to named engineers under least privilege and is logged.

If a breach affects your data we will notify you and the relevant authority within the timelines the law requires, and tell you what happened and what was exposed rather than issuing a vague statement. The security page sets out our current position in more detail, including certifications we do not yet hold.

If this policy changes in a way that materially affects how your data or your customers' data is handled, we will tell account holders directly rather than relying on you to notice an edit. Continued use after a material change that you have been notified of amounts to acceptance of it.

Questions about anything on this page can go through the contact page, and they will be answered by someone who can speak to how the product actually handles the data rather than by quoting this text back.