This policy applies to website pages, onboarding workflows, tenant dashboards, customer ordering flows, APIs, and operational analytics connected to Sevata Elite.

It does not cover third-party websites or payment pages that have separate privacy notices.

We collect account and business profile data such as name, email, phone, role, company details, and authentication-related metadata needed for secure access.

We also process service data including menus, orders, table/kitchen setup, payment status metadata, customer contact records, support interactions, and technical logs.

We use data to deliver platform features, verify identity, support merchant operations, process transactions, improve product reliability, and detect abuse.

We may use aggregated or de-identified information for analytics and product improvement.

We share data with service providers only where needed to run the platform, including payment processors, hosting providers, messaging systems, and security tools.

We may disclose information when required by law, to protect rights and safety, or in connection with a legitimate business transfer.

We use cookies and storage technologies for session continuity, security, preferences, and performance analytics.

Browser controls may disable certain cookies, but some features may not function correctly without them.

We retain data for as long as necessary to provide services, meet legal obligations, resolve disputes, and enforce platform terms.

Retention periods vary by data category and legal requirement; data may be deleted or anonymized when no longer needed.

We use layered safeguards such as role-based controls, tenant-level data separation, transport security, and audit-oriented logging.

No method of storage or transmission is perfectly secure. You should protect account credentials and report suspected incidents promptly.

Under the DPDP Act (and, where applicable, GDPR/UK GDPR, CCPA/CPRA and other laws), you have the following rights over your personal data, subject to identity verification and lawful exceptions:

• Right to access a summary of the personal data we process about you and our processing activities.
• Right to correction and updating of inaccurate or incomplete data, and completion of incomplete data.
• Right to erasure of your personal data where it is no longer needed for the purpose it was collected. You can self-initiate account deletion at Account & Data Deletion.
• Right to withdraw consent at any time, as easily as it was given, via your Privacy Center. Withdrawal does not affect processing done before withdrawal.
• Right of grievance redressal through our Grievance Officer (see below) before approaching the Data Protection Board of India.
• Right to nominate (DPDP Act §14) another individual to exercise your rights in the event of death or incapacity. Manage nominations in your Privacy Center.
• Right to data portability and, in some jurisdictions, to object to or restrict certain processing.

To exercise any right, use the Privacy Center or contact our Data Protection Officer at dpo@sevata.in. We respond within the timelines required by applicable law.

We do not knowingly process the personal data of children (under 18 in India) without verifiable consent of a parent or lawful guardian, as required by the DPDP Act. Certain features are not directed at children.

We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, and we do not process children's data in a way likely to cause a detrimental effect on their well-being. Where a service (for example a hotel kids' club registration) necessarily involves a child's information, it is collected from and with the consent of the parent/guardian and used only for that service.

Personal data of Indian data principals is stored and processed within India wherever the platform's data-residency controls apply. Some sub-processors (for example certain communications, mapping, and error-monitoring providers) may process limited data outside India.

Any such transfer is made only to countries not restricted by the Central Government under the DPDP Act, and under contractual and security safeguards. Our current sub-processors are listed in the sub-processor register.

In accordance with the DPDP Act §8(9) and the Information Technology Act, 2000, you may raise any grievance regarding the processing of your personal data with our Grievance Officer:

We acknowledge grievances within 48 hours and endeavour to resolve them within 30 days. See the full Grievance Redressal notice.

We may update this policy from time to time to reflect product, legal, and security developments. Material updates may be announced through in-app notices or email.

For privacy concerns or to exercise your rights, contact our Data Protection Officer at dpo@sevata.in or general support at support@sevata.in.

Related: Terms of Service · Cookie Policy · Refund & Cancellation · Grievance Redressal.