Skip to content

Privacy Policy

Last updated: October 19, 2026

Your privacy and data security are our top priorities.

Our Privacy Commitment

At Supaorder, we believe that privacy is a fundamental right. We are committed to being transparent about how we collect, use, and protect your information while providing you with the tools and controls you need to manage your privacy.

  • The security measures we actually run (section 4)
  • Where your data is hosted, and the transfer safeguards we use (section 7)
  • Full Transparency

1. Information We Collect

We collect information to provide, improve, and protect our services. The information we collect falls into several categories:

Restaurant Account Information

  • Business name, address, and contact details
  • Owner/manager information and credentials
  • Business registration and licensing data
  • Tax identification numbers
  • Banking and payment information
  • Menu items, pricing, and descriptions
  • Operating hours and delivery zones
  • Staff accounts and permissions

Customer Data (On Your Behalf)

  • Customer names and contact information
  • Delivery addresses and preferences
  • Order history and payment data
  • Loyalty program participation
  • Customer reviews and feedback
  • Communication preferences
  • Device and browser information
  • App usage and interaction data

Technical and Usage Information

Platform Usage:

  • Dashboard interactions and feature usage
  • Order processing and management activities
  • Report generation and data exports
  • Integration configurations and API usage

Technical Data:

  • IP addresses and geolocation data
  • Device identifiers and browser information
  • Performance metrics and error logs
  • Security event logs and access patterns

Important Note About Customer Data

When you use Supaorder, you remain the data controller for your customer information. We process this data on your behalf as a data processor. You are responsible for obtaining proper consent from your customers and complying with applicable privacy laws.

2. How We Use Your Information

We use the information we collect for specific, legitimate business purposes that benefit you and improve our services:

Service Delivery & Operations

  • Process and manage your restaurant orders
  • Provide customer support and technical assistance
  • Generate analytics and business insights
  • Facilitate payment processing and billing
  • Maintain and improve platform performance
  • Customize your dashboard and user experience
  • Send important service notifications
  • Manage integrations with third-party services

Security & Compliance

  • Detect and prevent fraud and security threats
  • Monitor for unauthorized access or misuse
  • Comply with legal and regulatory requirements
  • Conduct security audits and investigations
  • Verify identity and business legitimacy
  • Maintain audit trails and compliance records
  • Respond to legal requests and court orders
  • Protect intellectual property rights

Product Development & Improvement

  • Analyze usage patterns to improve features
  • Develop new products and services
  • Conduct research and testing
  • Optimize platform performance and reliability
  • Create aggregated, anonymized insights
  • Benchmark industry trends and metrics
  • Test new features and improvements
  • Enhance user interface and experience

3. Information Sharing & Disclosure

We do not sell your personal information. We only share information in specific circumstances and with appropriate safeguards:

Authorized Service Providers

We work with trusted third-party service providers who help us deliver our services. These providers are contractually bound to protect your information and use it only for specified purposes:

  • Payment processors (Stripe, Finix, etc.)
  • Cloud infrastructure providers (AWS, Google Cloud)
  • Customer support platforms
  • Analytics and monitoring services
  • Email and communication services
  • Security and fraud prevention tools
  • Backup and disaster recovery services
  • Legal and compliance consultants

Legal Requirements & Protection

We may disclose information when required by law or to protect our rights and the safety of our users:

  • In response to valid legal requests (subpoenas, court orders)
  • To comply with applicable laws and regulations
  • To protect against fraud, security threats, or illegal activities
  • To enforce our Terms of Service and protect our rights
  • In connection with business transfers or acquisitions

With Your Consent

We may share information in other circumstances with your explicit consent:

  • Integration with third-party services you choose
  • Participation in marketing or promotional activities
  • Business partnerships you specifically authorize
  • Research studies you opt into

4. Data Security & Protection

We implement comprehensive security measures to protect your information from unauthorized access, alteration, disclosure, or destruction:

Technical Safeguards

  • Encryption in transit (TLS) for all apps and APIs
  • Encryption at rest provided by Google Cloud for the database, file storage and backups
  • Tenant isolation enforced by database security rules and server-side authorisation checks
  • Role-based access with signed permissions; staff PINs and device login codes stored only as salted hashes
  • API rate limiting, and signature verification on inbound payment webhooks and on messaging webhooks where the provider signs them
  • Card numbers never stored by us — they are tokenised by PCI DSS-compliant payment processors

Operational Security

  • Production access limited to named engineering personnel and reviewed periodically
  • Code review, automated tests and staged rollout before production deployment
  • Dependency monitoring, with security fixes prioritised over feature work
  • Point-in-time recovery (7 days) and daily backups retained for 14 days
  • Audit records for administrative and money-moving actions
  • Incident escalation and personal-data breach notification procedures
  • Written confidentiality obligations for everyone with production access

We do not currently hold a third-party security certification or a third-party penetration-test report.

Compliance Framework

  • PCI DSS — Payment security via our PCI-compliant payment processors
  • GDPR — EU Privacy
  • CCPA — California Privacy

5. Your Privacy Rights

You have important rights regarding your personal information. We provide tools and processes to help you exercise these rights:

Access & Portability Rights

  • Right to Access: Request copies of your personal data
  • Data Portability: Export your data in machine-readable formats
  • Transparency: Understand how your data is processed
  • Processing Records: Access logs of data processing activities

Control & Correction Rights

  • Right to Rectification: Correct inaccurate information
  • Right to Erasure: Request deletion of your data
  • Right to Restrict: Limit how we process your data
  • Right to Object: Opt out of certain processing activities

How to Exercise Your Rights

Self-Service Options:

  • Account dashboard settings
  • Data export tools
  • Privacy preference center
  • Communication preferences

Contact Methods:

Response Timeline:

  • Acknowledgment: 48 hours
  • Simple requests: 5-10 days
  • Complex requests: 30 days
  • Extensions communicated

Important Considerations

Some rights may be limited by legal requirements or legitimate business interests. For example, we may need to retain certain information for tax, legal, or security purposes. We'll explain any limitations when responding to your requests.

6. Data Retention

We retain your information only as long as necessary for the purposes outlined in this policy:

  • Active Accounts: Data retained while your account is active and for legitimate business purposes
  • Closed Accounts: Your data stays available for export until day 90 after the end of service, and is then deleted from live systems within 30 days. Copies in backups are deleted in the ordinary backup rotation and are not restored to live systems. Some records are kept where the law requires it
  • Legal Requirements: Financial records retained for 7 years

7. International Data Transfers

As a global service, we may transfer your information internationally. We ensure appropriate safeguards are in place:

Transfer Mechanisms:

  • European Commission Standard Contractual Clauses (SCCs), with the UK International Data Transfer Addendum for UK data
  • Adequacy decisions, where one covers the destination
  • The mechanism the local law requires in other countries

Data Locations:

  • Primary database and file storage: Google Cloud / Firebase in your project's region (United States for most customers; an EU region on a dedicated project)
  • Backups: in the same cloud project as the primary database
  • Reporting systems, shared by all customers: reporting database (MongoDB Atlas, primary cluster in the United States; its secondary cluster and backups in the locations MongoDB Atlas uses) and message queue (AWS) in the United States; the reporting API on DigitalOcean (the United States or another country where DigitalOcean operates); cache in Japan
  • Images: Cloudinary's global content-delivery network
  • Error monitoring: Sentry, United States
  • Engineering and support operations: India

Cookies & Similar Technologies

Every cookie this site can set is listed with its purpose and lifetime in our cookie policy.

Our website uses a small number of cookies and browser-storage entries, grouped as follows:

  • Strictly necessary — session and security cookies required for the site and forms to function. These cannot be switched off.
  • Functional — our live-chat widget (Crisp) sets cookies so conversations persist between pages and visits. Chat is a core support channel, so these load without a consent prompt; you can block them in your browser without affecting the rest of the site.
  • Embedded video — our product videos play through YouTube's privacy-enhanced mode (youtube-nocookie.com). Nothing is requested from YouTube or Google until you press play; after that, YouTube handles the playback, and anything it stores, under Google's own privacy policy.
  • Analytics (opt-in) — Google Analytics 4 and HubSpot load only after you accept analytics cookies in the consent banner. IP addresses are anonymized, Google Signals is disabled, and no advertising personalization is enabled. HubSpot links a form you submit to the pages you read before it. Declining the banner keeps both off.

Your analytics choice is stored in your browser. Change it at any time with the link in the footer, which reopens the banner. Declining also clears the analytics cookies a previous acceptance set.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will:

  • Provide at least 30 days' notice of material changes
  • Email notifications to account holders
  • Post updates prominently on our website
  • Maintain an archive of previous versions

8. Contact Our Privacy Team

If you have questions about this Privacy Policy or want to exercise your privacy rights, please contact us:

Privacy Officer

Email: privacy@devkart.com
Phone: +91 7829527438
Response time: 48 hours

Mailing Address

Devkart Technologies LLP
Attn: Privacy Officer
No: 73, 3A, Millennium House, 2nd Cross Road, Sector 1, HSR Layout
Bengaluru, Karnataka – 560102
India

EU Representative: For GDPR-related inquiries from EU residents, you may also contact our EU representative at eu-privacy@devkart.com