Privacy Policy

1. Who we are

AtithiSetu (operated by Manhotra Consulting, Gurgaon, Haryana, India) is the data fiduciary for the personal information processed through our hotel, resort and restaurant software platform at atithi-setu.com. For questions about this policy, write to our Data Protection Officer at [email protected].

2. What we collect

We collect only what we need to run your hospitality operation. Specifically:

• Business owner data — name, email, phone, business name, GSTIN, address, state and city.
• Customer order data — items ordered, table or room number, payment mode, order timestamps, and the phone number entered at QR checkout (used as your loyalty identity).
• Loyalty profile — lifetime spend, current tier, order history, birthday (optional), notes.
• Staff records — name, role, phone, attendance, shift roster, payroll figures.
• Hotel guest data — name, contact, ID type/number, nationality, Form-C/FRRO data for foreign nationals (collected to meet statutory obligations under the Registration of Foreigners Act, 1939).
• Payment metadata — order ID, amount, gateway reference, mode. We never store full card numbers, CVV, UPI PIN or bank credentials.
• Aggregator data — orders, settlement reports and commissions returned by Swiggy, Zomato, Dunzo, Magicpin and ONDC for your account.
• Technical data — IP, browser, device fingerprint, session logs, error traces (used for security and reliability).

3. How we use your data

We process personal data for the following specified, lawful purposes:

• Delivering the AtithiSetu service you signed up for — POS, PMS, KDS, loyalty, payroll, analytics.
• Producing GST-compliant invoices and supporting your statutory filings.
• Sending operational WhatsApp, SMS and email — order confirmations, shift reminders, low-stock alerts, payroll slips, loyalty upgrades.
• Improving the platform — aggregate analytics, anomaly detection, AI inventory forecasting (built on tenant data, never cross-tenant).
• Customer support, billing, fraud prevention, and security investigations.
• Complying with Indian law — Form-C/FRRO, GST, Income Tax, response to lawful requests from regulators.

We do not sell your personal data. We do not use customer order data to train third-party AI models.

4. Where we store your data

Tenant data is stored on servers in Mumbai, India with isolation at the database-schema level — every property gets its own PostgreSQL schema, so your data is never co-mingled with another customer's. Traffic to the app is encrypted in transit over HTTPS. Staff identity and bank details (PAN, Aadhaar, bank account) and payment-gateway credentials are additionally encrypted with AES-256-GCM. We do not transfer personal data outside India except where you explicitly opt in (e.g. an outlet on the US/EU multi-currency preset). See our security page for the controls in place.

5. Who can see your data

• You — through the AtithiSetu app, using role-based access controls you configure (Owner, Manager, Chef, Waiter, etc.).
• AtithiSetu support engineers — only on your express request to debug an issue. Every access is logged.
• Sub-processors — Hostinger (hosting, Mumbai), Cloudflare (network security and file storage), Razorpay/PhonePe/Paytm (payments, through your own merchant account), Gupshup/MSG91 (WhatsApp/SMS), Resend/SendGrid (email).
• Aggregators — Swiggy, Zomato, Dunzo, Magicpin, ONDC receive only the menu/availability/price you publish and order updates you trigger.
• Authorities — when compelled by law, court order or to prevent imminent harm. We notify you unless legally prohibited.

6. Your DPDP rights as a data principal

Under DPDP 2023, you have the right to:

• Access a copy of the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure when the data is no longer necessary.
• Withdraw consent for non-essential processing (e.g. marketing).
• Nominate another individual to exercise your rights in case of incapacity.
• Raise grievances and receive a response within 14 days.

To exercise any right, email [email protected] with your registered phone or business ID. Customers of AtithiSetu tenants (e.g. a diner who used QR ordering at a restaurant) should contact that restaurant directly — they are the data fiduciary; we are the data processor on their behalf.

7. Cookies & analytics

We use first-party cookies to keep you logged in and remember preferences. On this website we use Cloudflare Web Analytics, which sets no cookies and does not track you across sites, to count visits to each page — no behavioural advertising. When you request a demo or a resource, we record your details together with the page and button you used and any campaign link you arrived by, so we know which pages are useful. Decline non-essential cookies any time in your browser settings.

8. Retention & deletion

We retain tenant data while your account is active. After cancellation, data is retained for 90 days (so you can export it), then permanently deleted from production and from backups within a further 30 days, except where retention is required by law (e.g. tax records — 8 years under the Income Tax Act). Anonymised analytics may be retained indefinitely.

9. Children

AtithiSetu is a B2B product not directed at children. We do not knowingly collect personal data of anyone under 18. If a restaurant or hotel customer who entered their phone for QR ordering is under 18, the tenant is responsible for obtaining verifiable parental consent under DPDP §9.

10. Changes & contact

We may update this policy as the product evolves. Material changes will be notified in-app and by email at least 14 days before they take effect. For any privacy question, write to [email protected] or by post to AtithiSetu — Data Protection Officer, Gurgaon, Haryana, India.

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India once it becomes operational.