Privacy Policy

This Privacy Policy explains how DineTide ("we", "us", "DineTide") collects, uses, shares and protects personal data when you visit our website, sign up, or use the DineTide service. It follows India's Digital Personal Data Protection Act, 2023 and, for people in the European Economic Area, the United Kingdom and similar places, the GDPR and UK GDPR.

1. Two roles, and why they matter

• We are the data fiduciary / controller for information about you as our customer or website visitor: your name, work email, company, billing details, how you use our website and support requests.
• We are the data processor for the information your business puts into its own system: stock, suppliers, recipes, staff names and sign-ins, records and photos. Your business decides why and how that data is used. We handle it only on your instructions under our Data Processing Agreement. If you are a member of staff at a restaurant using DineTide, your employer is the controller of your data and you should read its privacy notice; ask it to exercise your rights.

2. What we collect

• You give us: name, work email, phone, company name and country, billing address and tax number, messages to support, feedback and demo requests, and the content your team adds to its system.
• Collected automatically: sign-in and security records (time, device type, approximate location from IP address), actions taken in the system (the audit log), error and performance records, and basic website analytics.
• From payment partners: subscription status, the last four digits and type of a payment card, billing country and receipts. We never see or store full card numbers.
• Cookies: see our Cookie Notice.

3. Why we use it, and on what basis

Under the Indian Act we rely on your consent or on the "legitimate uses" the Act allows, such as performing a contract, complying with law and keeping the service secure.

4. Who we share it with

We do not sell personal data. We share it only with:

• Service providers (sub-processors) that help us run the service: cloud hosting and backup providers, email delivery (Resend), payment partners (Razorpay for India, Paddle elsewhere), error monitoring and website analytics. They may use data only for us and under contract. The current list is on our Sub-processors page.
• Professional advisers, auditors and insurers under confidentiality.
• Authorities, where the law requires it or to protect rights and safety.
• A buyer or partner in a merger or sale of the business, who must honour this policy.

5. International transfers

Our systems may be hosted in India and other regions, and our providers may process data in other countries. Where data leaves the European Economic Area or the United Kingdom we use safeguards such as Standard Contractual Clauses or an adequacy decision. Where the Indian Act applies we transfer data only to places the government has not restricted.

6. How long we keep it

• Account and billing records: while you are a customer and for the period tax and accounting law requires (generally up to 8 years).
• Your business's system data: while your subscription is active and for 30 days after it ends so you can export it, then deleted from live systems and within 35 more days from backups.
• Security and audit records: up to 2 years.
• Support messages: up to 3 years after the matter is closed.
• Marketing contacts: until you opt out or after 2 years without engagement.

We then delete or anonymise it.

7. Your rights

Depending on where you live you may have the right to: know what we hold about you and get a copy; correct it; have it erased; restrict or object to its use; receive it in a portable format; withdraw consent at any time; nominate someone to exercise your rights if you die or cannot; and complain to a regulator. To use a right write to (our support email, shown on our website). We reply within 30 days (one month under the GDPR) and may need to confirm who you are. If your data is in a restaurant's system, we will pass the request to that business as controller or help it to answer.

8. Security

We use encryption in transit and at rest, per-customer separation, role-based access, two-step sign-in, audit logs, nightly backups, staff access controls and regular reviews. See the Data Processing Agreement for details. If a breach affects your personal data we will notify you and the authorities as the law requires.

9. Children

The service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. Tell us if you think we have and we will delete it.

10. Automated decisions

We do not make decisions about you that have legal or similarly significant effects by purely automated means. Alerts and forecasts inside the service are aids for your team.

11. Links and third parties

Our website and service may link to other sites. We are not responsible for their privacy practices.

12. Changes

We may update this policy. We will post the new version here with its effective date and, for material changes, tell you by email or in the service.

13. Contact and complaints

DineTide, (our registered address, shown on our website). Email (our support email, shown on our website). If you are not satisfied with our answer you may complain to the Data Protection Board of India or to your local data protection authority.