Privacy policy

1. Who we are to your data

For the restaurant account itself — the owner’s and staff’s sign-in details, the restaurant’s KYC and subscription — Rikaab is the data fiduciary (controller).

For the data a restaurant records about its guests — names, phone numbers, addresses, orders — the restaurant is the fiduciary and Rikaab is its processor: we store and process it only to run the restaurant’s software, on the restaurant’s instructions.

2. What we collect

• Account: the owner’s email and/or mobile number, name, and one-time codes used to sign in. Staff: name, mobile number, role, and a counter PIN stored only as a one-way hash.
• Restaurant KYC: legal name, address, GSTIN, PAN, FSSAI licence number and, optionally, bank account details. PAN and bank account numbers are stored sealed with a master key and are shown back to no one.
• Business data you create: menu, tables, orders, bills, invoices, expenses, stock, reports.
• Guests (processed for the restaurant): the details a restaurant enters or a guest provides when ordering — name, phone, delivery address, order history. Public e-bill links show the restaurant’s details and only the guest’s first name.
• Payments: Rikaab never sees card or UPI credentials. Online payments go through Razorpay under the restaurant’s own Razorpay account; the restaurant’s Razorpay keys are stored sealed.
• Technical: server logs with IP address, request id and timing, kept for security and debugging; essential session cookies (httpOnly) for sign-in; on the public website only, Google Analytics 4 usage statistics.
• Order alerts (optional): when you turn alerts on in the Rikaab POS app or a browser, a push token for that device is kept with the restaurant account so order alerts can reach it. An alert carries the order code, the guest’s first name, the items and the amount. Tokens are removed when you turn alerts off, remove the device, uninstall the app, or after repeated delivery failures.
• Notification access (optional, Android app only): if you turn on “Zomato & Swiggy orders”, Android lets the app read notifications on that device. The app acts only on new-order notifications from the Zomato and Swiggy partner apps, to ring and open that app; it does not store them or send them off the device. Turn it off in the app or in Android’s Notification access settings at any time.

3. Why we use it

• To provide the service: sign you in, issue bills, generate GSTR-1 exports, print KOTs, send e-bills.
• To verify a restaurant before it can issue GST invoices (KYC review).
• To keep the service secure: rate limits, lockouts, audit logs, fraud and abuse prevention.
• To bill the subscription and issue our own tax invoice to you.
• To answer support requests and tell you about changes to the service. We do not sell personal data or use it for third-party advertising.

4. Where it is kept and for how long

Data is hosted on cloud infrastructure (Amazon Web Services and MongoDB Atlas) with encryption in transit (TLS) and at rest. Each restaurant’s data is logically isolated from every other restaurant’s.

Business records that the GST law requires you to keep (invoices, credit notes, returns data) are retained for as long as your account exists and, after closure, for the statutory period — currently 72 months from the due date of the relevant annual return — unless you export and ask us to delete them earlier and the law allows it. Logs are kept for a short, fixed period. Account data is deleted within 90 days of a verified closure request, except what we must keep by law.

5. Who we share it with

• Service providers who process data for us under contract: cloud hosting, database hosting, email delivery, SMS/WhatsApp delivery, error monitoring, and Google Firebase Cloud Messaging for push alerts to the Android app (it receives the device token and the alert text). They may process it only for us. No analytics or advertising SDK runs in the app.
• Payment and delivery partners the restaurant itself connects (for example Razorpay, a delivery partner) — data goes to them on the restaurant’s instruction.
• Authorities, when the law requires it.
• Nobody else. Rikaab does not sell or rent personal data.

6. Your rights

• Access and correction: see and fix your account data in the console; ask us for anything you cannot reach.
• Export: your invoices, GSTR-1 files and reports are exportable from the console at any time.
• Erasure: ask us to close the account and delete personal data; we will, subject to the records the law requires us to keep.
• Grievance: write to hello@rikaab.in with “Privacy” in the subject. We acknowledge within 72 hours and resolve within 30 days. If you are a guest of a restaurant, contact the restaurant first; it decides how your data is used, and we will help it respond.

7. Cookies

The console uses only essential cookies: a short-lived access token and a refresh token, both httpOnly, needed to keep you signed in. The public website uses Google Analytics 4 to count visits; no analytics run inside the console, and we do not use advertising cookies.

8. Changes

We will post changes here with a new date. Material changes to how we use personal data will also be emailed to restaurant owners before they take effect.