Privacy policy

1. Who we are

Thaalo is a product of StriveBit Technologies Private Limited (CIN U72900UP2021PTC142374), 1059, Neemapatti, Saidupur, Distt. Bulandshahr, Uttar Pradesh 203411, India. Under the Digital Personal Data Protection Act, 2023, we are the data fiduciary for the personal data of restaurant owners and staff, and for visitors to thaalo.in. For the personal data of a restaurant’s diners, the restaurant is the data fiduciary and we process that data on its behalf.

2. Who owns what

• A restaurant's customer list, orders, ratings and notes belong to that restaurant. We handle them only to run the service for it.
• A diner's data is never shared with another restaurant, even one that also uses Thaalo. Each restaurant sees only guests who ordered from it or booked with it.
• We do not sell personal data, use it for advertising, or combine lists across restaurants.

3. What we store

About restaurant owners and staff:

• Name, phone number, email address and role, to create and secure staff accounts.
• Business details: restaurant name, address, menu, opening hours, GST details if provided, and plan.
• Usage records: when orders were accepted, edited, billed or cancelled, and by which staff account.

About diners, in the restaurant’s customer list:

• Name and phone number, which the ordering page asks for with each order, and which staff may type at the counter.
• Orders: items, amounts, table or pickup or delivery, any note for the kitchen, and the time. From these the list shows visits, total spend, last visit and a favourite dish.
• For delivery orders, the delivery address: flat or house, street, area, city, pincode, and an optional landmark and instructions for the rider.
• Ratings and comments the diner gives after an order.
• Table bookings the diner makes.
• WhatsApp choices: whether the diner ticked the box to receive messages, and when they opted in or out.
• Notes the restaurant's staff add about a guest.
• Device data needed to serve the page: IP address and browser type.

Kept only on the diner’s own phone, in the browser’s local storage, and never sent to us unless the diner places an order or booking: the cart, recent orders and their status, the name and phone number to fill in next time, a saved delivery address, dishes saved with the heart, the table scanned, and the WhatsApp choice. Clearing the browser’s site data removes all of it.

Location: on the delivery checkout a diner can tap Use my location instead of typing the address. The phone asks for permission first. The location is then sent once to Google’s Geocoding service to look up the street, area, city and pincode, which fill the address form for the diner to check. We do not save the location with the order or in the restaurant’s records; only the address the diner confirms is stored.

We do not collect payment card details. Online payments, when available, are processed by a licensed payment gateway under its own policy.

4. Why we use it

• To run the service: show menus, route orders to the kitchen, produce bills and reports.
• To build each restaurant's own customer list, so it can see its regulars and send offers to guests who opted in.
• To keep accounts secure and to prevent abuse.
• To support restaurants on WhatsApp and email.
• To meet legal obligations, including tax record-keeping.

Legal basis: performance of the contract with the restaurant, and consent given by the diner when they enter their details and, separately, when they tick the box for WhatsApp messages.

5. WhatsApp messages and consent

• The WhatsApp box at checkout and on the booking page starts unticked. A diner who does not tick it gets no WhatsApp messages from the restaurant through Thaalo.
• A diner who ticks it can receive order updates and bills, and offers the restaurant chooses to send.
• Offers go only to diners who opted in. Thaalo does not let a restaurant send an offer to anyone else.
• Messages are sent from the restaurant's own WhatsApp number once connected, using templates approved by Meta, or by the restaurant's staff from their own phone until then. Meta processes these messages under its own terms.
• On a connected number, replying STOP opts the number out automatically. The opt-out takes effect as soon as the reply reaches us, and no further offers or order messages are sent to that number. Replying START opts back in.
• When staff send from their own phone, a STOP reply reaches the restaurant rather than us, and the restaurant must mark the guest as opted out in Thaalo, which it can do in one tap. Either way, an opted-out guest is left out of every later offer.

6. Who else sees it

• The restaurant the diner ordered from, and only that restaurant.
• Hosting, database and file-storage providers that run the service.
• Meta (WhatsApp) and SMS providers, for messages the diner has agreed to receive or asked for, such as a login code.
• Google, to turn a location into an address when a diner taps Use my location. Where a restaurant shows its public Google reviews, the diner's browser loads the reviewers' photos from Google, which sees the browser's IP address.
• Thaalo's own team, only to support the restaurant, fix a problem, or answer a legal request. Access is by named account.
• The payment gateway, for online payments when available.
• Authorities, where the law requires it.

Where it is kept: our application servers and database run in Singapore. Personal data may be processed outside India, which the Digital Personal Data Protection Act, 2023 permits except to countries the Government of India restricts.

7. How long we keep it

• Diner name, phone number, delivery addresses, notes and WhatsApp choices: 6 months after the diner's last order or booking with that restaurant, unless the restaurant or the diner asks for earlier deletion. A daily job removes them; the orders themselves stay for tax, without the diner's details.
• Order and billing records: eight years, as required for tax and accounting.
• Staff accounts: while the restaurant's subscription is active, then 30 days.
• A restaurant that closes its account receives an export of its menu and orders on request; the data is deleted 30 days after closure, except records we must keep by law.

8. Analytics

We run Umami, a cookieless analytics tool that we host ourselves, on thaalo.in, on restaurant ordering pages and on the staff app, to count page views. On thaalo.in and the staff app it also records a sample of sessions (clicks, scrolling and page content, with everything typed into form fields masked) so we can find what is confusing or broken. Restaurant ordering pages, where diners enter their name and phone number, are never recorded. Umami sets no cookies, builds no advertising profile, and its data is not shared with anyone. Where a Plausible site ID is configured, thaalo.in also uses Plausible, which is cookieless as well.

9. Your rights

Owners, staff and diners can ask to see, correct or delete their personal data, or withdraw consent, by writing to [email protected]. We respond within 30 days. Diners may also ask the restaurant directly, which can act on the request from its customer list, or reply STOP to stop WhatsApp messages. You can nominate another person to exercise these rights for you if you die or are unable to. You can complain to the Data Protection Board of India if you are not satisfied with our response.

10. Children

Thaalo is not directed at children under 18, and we do not knowingly collect their personal data.

11. Security

Data is encrypted in transit and passwords are stored hashed. Every query a restaurant’s staff can make is limited to that restaurant’s own data, and our data layer refuses one that is not. Staff and Thaalo’s own team sign in with named accounts. No system is perfectly secure; if a breach affects you we will tell you and the Board as the law requires.

12. Grievance officer

CEO, StriveBit Technologies, StriveBit Technologies Private Limited, 1059, Neemapatti, Saidupur, Distt. Bulandshahr, Uttar Pradesh 203411, India. Email [email protected]. Complaints are acknowledged within 48 hours and resolved within 30 days.

13. Changes

We will post changes here and, for material changes, tell restaurants on WhatsApp or email before they take effect.