Privacy Policy

When you order at a restaurant, the restaurant decides why your details are collected and what they are used for. Under India's Digital Personal Data Protection Act, 2023, the restaurant is the Data Fiduciary for that data, and Dineo processes it on the restaurant's behalf.

For restaurant owners and staff who use the portal, and for visitors to this website, Dineo is the Data Fiduciary.

We collect:

• the name and phone number you enter before ordering;
• your table number, what you ordered, any special instructions, when you ordered, and the bill;
• if you pay online, Razorpay's payment and order IDs and whether the payment went through. Your card, UPI or bank details go straight to Razorpay. Dineo never sees them.

We use this so the restaurant can prepare your order, find your table, contact you about that order and bill you. It is never used for marketing and never sold.

Only the restaurant you ordered from, its owner and its staff, can see it. No other restaurant can. You agree to this when you place the order, and the ordering page says so under the name and phone fields before you enter anything.

• When you sign in with Google: your name, email address and profile picture. We never see your Google password.
• Your role (owner, manager, chef or waiter) and which restaurant you belong to.
• Business details the owner enters: restaurant name, address and phone, GSTIN, FSSAI number, the owner's name and email, and menus, prices and photos.
• If the owner connects Razorpay: the Razorpay Key Id and Key Secret. The secret is stored encrypted and cannot be viewed again, even by the owner.

We use these to run the portal, show orders to the right kitchen, and print bills.

This website sets no cookies and keeps no database. The contact form doesn't send anything to us: it opens WhatsApp with your message filled in, and WhatsApp's own privacy policy applies from there.

The ordering page keeps your restaurant, table, table session, cart and an order reference in your browser's local storage, so reloading the page doesn't lose your order. The restaurant portal keeps you signed in with login cookies. We don't use advertising or tracking cookies.

• Diners' names and phone numbers are deleted 90 days after the order. The order itself (items, amounts and time) stays without them, because the restaurant needs it for its accounts and tax records.
• Restaurant and staff accounts are kept while the restaurant uses Dineo. When an account is closed, we delete its personal data on request, except anything the law requires us or the restaurant to keep.

Data is encrypted in transit. Each restaurant can see only its own data, and the database enforces that, not just the app. Payment keys are encrypted at rest. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.

Under the DPDP Act you can ask to see your data, correct it, have it erased, withdraw your consent, and nominate someone to act for you. Email kattayatharth@gmail.com with the restaurant's name, the date and your phone number so we can find the record. Diners can also ask the restaurant directly.

We reply within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Dineo is not meant for children. If you are under 18, please ask a parent or guardian to place the order.

If this policy changes, we will update this page and the date at the top. Restaurants using Dineo will be told directly about any change that affects them.