This policy explains how RelayTable (“we”, “us”) handles personal data when restaurants use our platform and when guests order through a RelayTable menu. We follow India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Restaurants are our customers. Guestsare the people who scan a QR code and order. For guest data, the restaurant decides what is collected and why; we process it on the restaurant's behalf.

• Account data — owner and staff name, email, phone number and password (stored hashed).
• Restaurant data — restaurant name, address and location, logo, menu, tables, offers, GSTIN and payment settings.
• Order data — table, items, amounts, payment mode and order status. Guests may enter a display name when joining a table.
• Business records — inventory, production, expenses and bank account details you enter.
• Technical data — IP address, device and browser type, and logs needed to keep the service secure.

• To provide the service: show menus, send orders to the kitchen, bill and report.
• To create and secure accounts, including sending one-time passwords (OTP) by email.
• To manage subscriptions and billing.
• To provide support and tell you about important changes to the service.
• To improve reliability and performance, using aggregated data.

We share data only with providers that help us run RelayTable, and only what they need:

• Razorpay — processes online payments. We never see or store full card or UPI details.
• Google — email delivery for OTPs and Google Maps for address and location lookup.
• OpenAI — generates nutrition estimates from dish names and ingredients. No guest data is sent.
• Hosting providers — store data and run our servers.

We do not sell personal data.

We keep account and restaurant data while your account is active. When an account is closed we delete or anonymise its data within 90 days, unless the law requires us to keep records (for example tax and billing records) for longer.

Data is encrypted in transit with HTTPS, passwords are hashed, and access to each restaurant's data is limited by role-based permissions. No system is perfectly secure, but we work to protect your data and will notify affected users and the authorities of a breach as required by law.

Under the DPDP Act you can ask to access, correct or erase your personal data, withdraw consent, and nominate someone to exercise these rights for you.

Guests should contact the restaurant first; we will help the restaurant respond. To make a request, email privacy@relaytable.in.

RelayTable accounts are for businesses and are not meant for anyone under 18.

If we make important changes we will update this page and, where appropriate, notify account owners by email.

Questions or complaints about privacy: privacy@relaytable.in.