Your data is your data.

1. Plain-English summary

You are either a restaurant operator using our software, or you submitted a demo request. We collect the data you give us (your name, restaurant name, contact details), the data your operations generate (orders, inventory, customer feedback), and basic technical data (IP, browser type) so the product works.

We do not sell your data, share it with advertisers, or train external AI models on your venue's operating data. We use it to run the product for you and to make it better.

2. Who we are

Nom Nom AI ("we", "us", "our") is a restaurant operations platform built and operated from Hyderabad, India. For privacy purposes, we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and the Data Controller under the EU General Data Protection Regulation (GDPR) where applicable.

Contact: via our contact page or write to our Data Protection Officer at dpo@nomnomai.in.

3. What we collect

3.1 Information you provide

• Account & demo data: name, restaurant name, phone/WhatsApp, email, number of outlets, and anything you write in a contact form or onboarding call.
• Operational data: menu items, recipes, inventory counts, orders, payments, table reservations, customer profiles, feedback, KDS tickets, audit logs.
• Team data: staff names, roles, PINs, shift schedules, only what is needed for role-based access.
• Communications: support tickets, emails, WhatsApp messages you send to us, call recordings (when you explicitly opt in).

3.2 Information we collect automatically

• Device & usage: IP address, browser type, screen size, pages viewed, actions taken inside the app, timestamps.
• Cookies & storage: session cookies, login tokens, and a small amount of localStorage used to keep the four operator surfaces in sync (e.g. an "86" propagating from KDS to the QR menu).

3.3 Information we receive from third parties

• Payment processors (Razorpay, UPI handlers): order amount, transaction ID, success/failure, last 4 digits of card. We do not see your full card number.
• Aggregators (Zomato, Swiggy, when integrations are enabled): incoming order details, customer aliases, status updates.
• Review platforms (Google, Zomato): public reviews about your venue.

4. Why we collect it

• To run the product: render orders, fire tickets to the kitchen, generate invoices, calculate margins.
• To support you: answer questions, debug issues, restore data.
• To improve the product: anonymous, aggregated usage patterns inform what we build next.
• To communicate: respond to demo requests, send service notifications, share product updates.
• To comply: with tax law, GST/Tally reporting, anti-money-laundering rules where applicable.

5. Legal basis

We rely on the following legal bases:

• Performance of contract, to deliver the service you signed up for.
• Legitimate interest, to keep the product secure, fix bugs, and prevent fraud.
• Consent, for optional things like marketing emails, call recording, or sharing case studies. You can withdraw consent any time.
• Legal obligation, tax records, GST reporting, court orders.

Under the DPDP Act, you are the Data Principal and we process your data only for specified, lawful purposes.

6. Who we share it with

We share data only with these categories of recipients, and only as much as needed:

• Sub-processors that run the platform: cloud hosting (AWS Mumbai region by default), database (Supabase), email (Resend), error monitoring (Sentry), analytics (PostHog, self-hosted).
• Integrations you turn on: Tally, Petpooja, WhatsApp Business, Retell AI, Zomato, Swiggy, only the data they need to function.
• Professional advisors: lawyers, auditors, accountants under confidentiality.
• Authorities: when we receive a valid legal request.

We do not sell your data. We do not share customer-identifiable data with advertisers. We do not use your operational data to train third-party AI models.

7. How long we keep it

• Account & operational data: for as long as you use the product, plus 90 days after you stop, after which it is permanently deleted (excluding records we must retain by law).
• Financial & tax records: 8 years, as required by Indian tax law.
• Backups: rolling 30 days, then overwritten.
• Demo request data: 24 months from last contact, unless you opt in to longer retention.

8. How we protect it

• TLS 1.3 in transit, AES-256 at rest.
• Role-based access controls, staff only see what their role permits.
• PIN-protected device sessions, password-protected admin accounts.
• Audit logs for every change to operational records.
• Regular backups, tested restore procedures.
• Security updates applied within 7 days of patch release.

No system is perfectly secure. If a breach occurs, we will notify affected Data Principals and the Data Protection Board within 72 hours of becoming aware, as required by the DPDP Act.

9. Your rights

Under the DPDP Act and GDPR, you have the right to:

• Access a copy of the data we hold about you.
• Correct data that is wrong or out of date.
• Erase data we no longer need.
• Withdraw consent for any optional processing.
• Port your data to another provider in a machine-readable format.
• Nominate a person to exercise these rights on your behalf if you become unable to (DPDP-specific).
• Complain to the Data Protection Board of India or your local supervisory authority.

To exercise any of these rights, write to dpo@nomnomai.in. We will respond within 30 days.

10. Cookies & local storage

We use a small number of cookies and browser localStorage entries:

• Session cookie, keeps you logged in. Essential.
• Auth token (sessionStorage), tracks the active user in this browser tab. Cleared on logout.
• Sync state (nomnom_sync_v1), keeps the operator surfaces (Owner app, KDS, QR menu, Pass) in sync on the same device. Holds 86 lists, ticket pickups, heartbeats. No personal data.
• Analytics (PostHog, self-hosted), only if you accept the analytics opt-in.

11. Children

Our product is built for restaurant operators. We do not knowingly collect data from anyone under 18. If you believe a child's data has reached us, tell us and we will delete it.

12. Changes to this policy

We will update this page when our practices change. Material changes get an in-app notice and an email to your registered address at least 14 days before they take effect.

13. Contact

For privacy questions: dpo@nomnomai.in

For everything else: contact page or WhatsApp us.