Privacy policy
cafeaiOS is software for cafes and restaurants, run by Aman Sharma, New Delhi, India (“we”). This policy explains what we collect on our website and in the app, why, who helps us process it, and the choices you have. It is written to follow India’s Digital Personal Data Protection Act, 2023.
Two kinds of data
About cafes and their staff (our customers): we decide how this is used, to run your account.
About a cafe’s guests (people who scan a table QR or chat with a cafe): the cafe decides why it collects this; we store and process it for the cafe, only to provide the service. Guests’ data belongs to that cafe. It is kept separate from every other cafe, never sold, and never used for advertising.
What we collect
| Who | What | Why |
|---|---|---|
| Website visitors | Your IP address when the page loads fonts from Google Fonts. | To show the site. |
| Demo request form | Name, cafe name, mobile number, city, and optionally email and a message. Your IP address, to stop spam. | To call or WhatsApp you about a demo. Nothing else. |
| Cafe owners and staff | Name, email, mobile number, password (stored only as a one-way hash), role, and a log of important actions with IP address. | To log you in, keep the account secure and show who changed what. |
| Cafe business data | Menu, tables, orders, bills, payments records, invoices, settings, and what you teach the AI. | To run the cafe’s ordering, kitchen, billing and reports. |
| Cafe guests | Chat messages, orders and table. Only if the guest chooses to share them: name, mobile number, birthday, reviews and feedback. Vouchers earned and used. | To take orders, answer questions, give rewards and, for guests who opted in, send the cafe’s WhatsApp offers. |
Cookies and browser storage
- cafe_session: keeps staff signed in. Strictly necessary; set only when you log in.
- cafe_phone (browser storage on the guest’s own phone): remembers the number a guest shared, so they don’t retype it next time. It never leaves that phone except when the guest chats.
- No advertising or social-media trackers.
Who processes it for us
| Service | What it does | Where |
|---|---|---|
| Supabase | Database (all of the data above) | Mumbai, India |
| Render | Runs the app | Singapore |
| Cloudflare | Network security and scheduled jobs | Global |
| Groq, Google (Gemini) | Writes the AI replies from chat text. Phone numbers are masked before text is sent. | May be outside India |
| Meta (WhatsApp Business) | Delivers WhatsApp messages, when a cafe connects its own WhatsApp number | Global |
| Razorpay | Online payments, only when a cafe connects its own Razorpay account | India |
| Google Fonts | Serves the website’s fonts | Global |
Each of these is bound by its own privacy terms and only gets what it needs for its job. We do not sell data to anyone.
How long we keep it
- Cafe accounts and their guests’ data: while the cafe uses cafeaiOS, then deleted within 90 days of the account closing (invoices are kept as long as tax law requires).
- Demo requests: up to 24 months, or until you ask us to delete them.
- Security logs: up to 12 months.
Your choices and rights
- Guests: reply STOP on WhatsApp to stop offers at any time. To see, correct or delete what a cafe holds about you, ask the cafe, or write to us and we will pass it on and help.
- Everyone: you can ask for a copy of your data, a correction, or deletion, and withdraw consent you gave, by emailing hello@cafeaios.com. We reply within 30 days.
- Complaints: write to the same address. If you are not satisfied, you can complain to the Data Protection Board of India.
Security
Data is encrypted in transit (HTTPS) and at rest with our database provider. Each cafe’s data is isolated in the database, staff access is by role, passwords are hashed, and logins and signups are rate-limited.
Children
Cafe accounts are for adults (18+). Guests of any age may chat to order, but we do not knowingly collect a child’s contact details for marketing.
Changes
If we change this policy we update the date at the top; for important changes we tell cafes in the app. See also our terms.