Privacy Policy

1. What we collect

• Account data: your name, email address and sign-in method (email/password or Google).
• Restaurant data: outlet name and city, floor plan and tables, menu items and prices, dish photos and logos you upload, orders, kitchen tickets and payment records.
• Staff data: names, emails and roles of staff accounts created by owners or managers.
• Guest data: when a guest orders via a QR link, only the name they optionally type and the items they order. Guests do not create accounts.
• Usage data: basic technical logs needed to keep the Service secure and running.

2. How we use it

• To operate the Service: taking orders, firing kitchen tickets, settling bills and producing reports.
• To keep each restaurant's data isolated — staff only see the restaurant they belong to.
• To process payments through Razorpay (currently in test mode).
• To communicate essential service information. We do not send marketing email without consent.

3. What we never do

• We never sell your data or your guests' data.
• We never use advertising trackers or third-party ad cookies.
• We never expose one restaurant's data to another restaurant.

4. Payments

Card and UPI details are handled entirely by Razorpay on their secure checkout — we never see or store full card numbers. We store only the payment reference, amount, method and status so your reports reconcile.

5. Storage and security

• Data is stored on secure cloud infrastructure with encryption in transit.
• Access is controlled by row-level security: every query is scoped to the signed-in user's restaurant.
• Uploaded photos live in private storage and are served through short-lived signed links.
• Payment gateway keys are stored as server-side secrets and never appear in the browser.

6. Retention and deletion

We keep your data while your account is active. You can delete your account yourself at any time from Settings → Delete my account, or by following the steps at https://restro.stepup-online.in/delete-account. Deletion is immediate: your login and profile are removed, and if you own a restaurant, all its data (tables, menu, photos, orders, payments, guests, coupons) is deleted. Backups are purged within 30 days. Records we must keep under Indian tax law are retained only as long as required.

7. Your rights

You may request access to, correction of, or deletion of your personal data at any time by writing to support@stepup-online.in. Restaurant owners are responsible for the staff and guest data they collect through the Service.

8. Who we are

The data controller is ASN Starchem Pvt Ltd, Kota, Rajasthan, India. Grievance officer / contact: support@stepup-online.in. Disputes are subject to the courts at Kota, Rajasthan.

9. Changes

If we change this policy materially, we will announce it in the app before the change takes effect.