Privacy Policy

Last updated: 7 November 2026 · Version 1.0 (Beta)

This Privacy Policy explains how [Legal name of the business] ("Nyarum’s Café", "we", "us") collects, uses, shares and protects your personal data when you use the Nyarum’s Café app on iOS or Android, the Nyarum’s Club loyalty programme, our website, and our services at the café. It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them.

By creating an account you confirm that you have read this policy. Where we rely on your consent, you can withdraw it at any time, as described in section 8.

1. Who we are

Data Fiduciary: [Legal name of the business], [registered address], Arunachal Pradesh, India. GSTIN: [GSTIN]. FSSAI licence: [number].

Contact: privacy@nyarumscafe.com · [phone].

Grievance Officer: [Name], [designation], grievance@nyarumscafe.com. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.

2. What we collect

Information you give us

• Mobile number (required to create an account). During the beta it is not yet verified by a one-time password; verification will be added.
• Name, and optionally your gender and date of birth.
• Email address, verified by a link or code, if it is not provided by Sign in with Apple or Google.
• Your choices: order type (dine in or take away), table number, items, options and notes.
• Messages you send us, feedback and support requests.

Information created when you use our services

• Loyalty records: Nyaru Beans earned, redeemed, expired or adjusted, your tier, badges, streaks and treats.
• Orders and bills: items, amounts, taxes, payment mode, date and time, receipt and invoice numbers.
• Notification preferences and consent history, with time stamps.

Information from your device

• Device and app information: model, operating system, app version, language, a device identifier generated by the app, and a push-notification token.
• Camera access, only while you scan a table QR code. Images are processed on your device and are not stored or sent to us.
• Approximate usage data (screens viewed, features used, crash reports), only if usage analytics is switched on.

Information from sign-in providers

• If you use Sign in with Apple or Google, we receive your name and email (or Apple’s private relay email) and a unique account identifier. We never receive your Apple or Google password.

We do not collect precise location, contacts, photos, health data or financial account numbers. Card and UPI payments, when introduced, are handled by a licensed payment gateway; we receive only the payment status and a reference number.

3. Why we use it (purposes and legal basis)

• Create and secure your account, verify your number and email: Mobile, email, sign-in identifier, device data · Consent and performance of the service you requested
• Run Nyarum’s Club: earn, redeem and expire Beans, tiers, badges, birthday rewards: Loyalty and order records, date of birth · Consent
• Take and prepare orders, show live order status, issue GST invoices: Orders, table number, contact details · Consent; legal obligation for tax invoices
• Send order updates (always on while you have an active order): Push token, mobile · Necessary to provide the order you placed
• Send offers and café news by push or WhatsApp: Name, tier, preferences, push token, mobile · Consent (you can switch these off)
• Improve the app and fix problems: Usage and crash data · Consent (Usage analytics switch)
• Prevent fraud and misuse of Beans or one-time passwords: Account, device and transaction data · Legitimate uses permitted by law
• Meet tax, accounting and legal requirements: Bills and invoices · Legal obligation

We do not sell your personal data and we do not use it for automated decisions that have legal effects on you.

4. Who we share it with

We share only what each partner needs, under written contracts that require them to protect it and use it only for our instructions:

• Cloud hosting and database: [Supabase Inc.], servers in [region].
• Messaging: Apple Push Notification service, Firebase Cloud Messaging (Google), the WhatsApp Business Platform (Meta) and a DLT-registered SMS provider [name] for one-time passwords and messages you have agreed to receive.
• Sign-in providers: Apple and Google, when you choose them.
• Payment gateway, when online payment is introduced: [name].
• Our chartered accountant and auditors, for tax records.
• Government or law-enforcement authorities, when required by law.

Some providers may process data outside India. We transfer data only to countries not restricted by the Government of India under the DPDP Act.

5. How long we keep it

• Account and loyalty data: while your account is open. If you close your account, within 90 days, except where we must keep it longer by law.
• Bills and GST invoices: at least 8 years, as required by tax law.
• One-time passwords: expire after 5 minutes and are deleted within 24 hours.
• Consent records: for as long as needed to show we respected your choices, and at least 3 years.
• Usage analytics: up to 14 months.

6. Notifications and marketing

• Order updates are sent while you have an active order. You cannot switch them off for that order because they tell you when it is ready.
• Offers and café updates, WhatsApp offers and usage analytics are on by default when you join. You can switch each off at any time in Notifications > Settings. Signing in never counts as agreement to WhatsApp marketing on its own; WhatsApp offers are sent only while that switch is on.
• Promotional pushes are not sent between 9:30 PM and 10 AM IST and are limited to a few each week.
• Reply STOP to any WhatsApp offer to stop them.

7. How we protect it

Encryption in transit (TLS) and at rest, access limited by role (staff see only what their job needs), audit logs for changes to Beans and prices, rate limits and device checks on one-time passwords, and regular backups. No system is perfectly secure. If a personal data breach occurs, we will inform you and the Data Protection Board of India as the law requires.

8. Your rights

Under the DPDP Act you can:

• Access: ask for a summary of the personal data we hold and how we use it.
• Correct and update: edit your details in Profile > Personal details, or ask us.
• Erase: ask us to close your account and erase your data. Write to privacy@nyarumscafe.com from your registered number or email. Erasure ends your membership and any unused Beans. We keep tax records the law requires.
• Withdraw consent: switch off notifications and analytics in the app at any time. Withdrawal does not affect processing already done.
• Nominate: name another person to exercise your rights in case of death or incapacity.
• Grievance redressal: contact our Grievance Officer. If you are not satisfied, you may approach the Data Protection Board of India.

We may ask you to verify your identity before acting on a request.

9. Children

The app is meant for people aged 18 and over. We do not knowingly collect data from children. If a parent or guardian believes a child has created an account, contact us and we will delete it. Alcohol-containing items are sold only to adults, subject to the café’s licence.

10. Changes to this policy

We will tell you in the app before material changes take effect and, where the law requires, ask for your consent again. The date at the top shows the latest version.

11. Contact

Nyarum’s Café, [address] · privacy@nyarumscafe.com · Grievance Officer: [Name], grievance@nyarumscafe.com, [phone] (Monday to Saturday, 11 AM to 7 PM IST).