Privacy Policy

This policy explains what personal data Stashlyo collects, why, and the choices you have. We wrote it to be read, not skimmed past.

What we collect

• Account details you give us when you register: your name, role, email, mobile number, password (stored only as a one-way hash), and your business details such as brand name, registered name, GSTIN, FSSAI number and outlet address.
• Business data you create while using Stashlyo: menus, tables, orders, stock and staff logins.
• Your guests' details, such as name, phone number, orders and feedback, which your outlet collects through Stashlyo. We process these only on your behalf (see below).
• Payment gateway keys, if you connect your own PhonePe account: we store them encrypted and use them only to create and check your guests' payments. We never see your guests' UPI PIN, bank or card details.
• Technical data: essential sign-in cookies, and a one-way hash of the network address used to register, kept only to stop automated signups. We do not use advertising or tracking cookies.

How we use it

• To run Stashlyo for you: sign-in, orders, kitchen screens, reports and your licence.
• To bill you, support you and keep the service secure.
• To send you product updates and tips, only if you opted in. You can stop them at any time.

Your guests' data

Under India's Digital Personal Data Protection Act, 2023, your business is the Data Fiduciary for your guests' personal data and Stashlyo is your Data Processor. We use guest data only to provide Stashlyo to you, never for our own marketing, and we never sell it.

Before a guest gives their name and mobile number on your menu, Stashlyo asks them to agree to your outlet's terms and privacy policy, which are published on your outlet's own policies page. Guests can send feedback without their name, and they get notifications only if they switch them on.

Where it is stored and who sees it

Data is stored with established cloud providers in their Mumbai, India region and is sent only over encrypted connections. We share data only with the providers that help us run Stashlyo (hosting and database in India, WhatsApp messaging for sign-in codes when you use it, browser notification services when guests switch notifications on, and your own payment gateway such as PhonePe when you connect it), or when the law requires us to. We never sell personal data.

Security

Passwords are stored only as one-way hashes, payment keys are encrypted, and staff screens are protected by sign-in and PINs. If a breach ever affects your data, we will tell you and, where the law requires, the Data Protection Board of India, without undue delay.

How long we keep it

We keep your data while your account exists. If you ask us to close your account, we delete your data within 30 days, except records we must keep by law, such as invoices.

Your rights

You can ask to see, correct or delete your personal data, withdraw consent for optional uses such as product emails, and raise a complaint with our grievance contact below. If you are a guest of an outlet that uses Stashlyo, please contact that outlet first (its contact details are on its policies page, linked from its menu). We will help them answer you. If you are not satisfied with the answer, you can complain to the Data Protection Board of India.

Children

Stashlyo is meant for businesses. We do not knowingly collect personal data from children for our own purposes.

Changes

If we change this policy in a way that matters, we will tell registered businesses before the change takes effect.