Privacy policy

Who we are and our role

POSBADA is run by Ankaavi Technologies Pvt. Ltd. ("Ankaavi", "we", "us"), B1-704, G-21, Vatika India Next, Vatika Sector Road, Sector 83, Gurugram, Haryana 122012, India. This policy explains what personal data POSBADA handles, why, who we share it with and the choices you have. It is written for India's Digital Personal Data Protection Act, 2023.

• For restaurants and their staff, we decide how account data is used, so we are the data fiduciary.
• For guests who order from a restaurant, the restaurant decides why it keeps your details, and we process them on its behalf. The restaurant is the data fiduciary and we are its data processor. One exception: when you verify your phone number with a one-time code, we keep that verified number so you don't have to verify again at other POSBADA restaurants. For that, we are the data fiduciary.

What we collect

From restaurants and their staff

• Business details: restaurant and branch names, addresses, phone numbers, GSTIN, legal and trade name, FSSAI number, UPI ID and your public shop profile.
• Payout details if online collection is on: bank account holder name, account number (stored encrypted) and IFSC.
• Staff logins: login ID, optional email, role and branch access. Passwords and PINs are stored only as secure hashes, never as text.
• A short device label for each signed-in device, such as "Chrome · Phone", so you can see and end sessions.
• An activity log of important actions, such as voids, refunds, discounts and access changes, with who did them and when.
• If you connect them: your Telegram chat for alerts, and your PITCH account for speakers.

About guests, on behalf of restaurants

• Name, phone number and, for delivery, your address.
• What you ordered, notes, your table, order status and payment status.
• Loyalty points, credit (udhaar) balances and notes the restaurant adds to your customer record.
• Your choice about WhatsApp receipts and updates, and any unsubscribe or STOP reply.
• If you start a prepaid online order but don't pay, your name and phone number, so the restaurant can follow up.

Card, UPI and net banking details are entered with our payment gateway, an RBI-authorised payment aggregator. We never see or store them; we keep only the payment reference, method, amount and status.

When you visit our websites

Our servers log basic request details (IP address, browser, time and page) for security and troubleshooting. We do not use analytics, advertising or tracking tools.

How we use it

• To run POSBADA: take orders, send KOTs, print bills, show order status and receipts, and manage tables, staff and cash.
• To take online payments, process refunds and pay out restaurants.
• To send messages people have asked for, such as WhatsApp receipts, one-time codes and owners' Telegram alerts.
• To keep accounts secure, prevent fraud and abuse, and fix problems.
• To meet legal duties, including tax and accounting records.
• To improve POSBADA, using aggregated information that does not identify anyone.

We do not sell personal data, and we do not use it for advertising.

Consent and legal grounds

We rely on your consent where the law needs it, for example before sending WhatsApp receipts and updates. You can withdraw consent at any time: reply STOP to a WhatsApp message, use the unsubscribe link in it, or contact us. Withdrawing does not affect messages already sent. Otherwise we process data because it is needed to provide the service you or the restaurant asked for, or to comply with the law.

Who we share it with

We share personal data only with service providers that help us run POSBADA, under contracts that limit how they can use it, and with authorities when the law requires.

If our business is reorganised or sold, data may move to the new owner under this policy.

Where your data is stored

Our servers and database run in Mumbai, India. Some providers above, such as the AI, messaging and file-storage services, may process data in other countries. We transfer data abroad only as Indian law allows.

How long we keep it

• Account and business data: while your account is active. After it closes, you can ask for an export within 30 days; then we delete or anonymise it, except records the law requires us to keep.
• Orders, bills, payments, refunds, payouts and related activity logs: for as long as tax and company law requires.
• Guest details on orders: as long as the restaurant needs them to serve you and keep its records.
• Short-lived data, such as sign-in sessions, one-time codes, order tracking links and unpaid checkout details: only as long as needed, then deleted or anonymised.
• Backups: for a limited period, currently up to 35 days.

How we protect it

• All connections use HTTPS (TLS 1.2 or later).
• Passwords and PINs are hashed with Argon2id; bank account numbers are encrypted with AES-256.
• Staff see only what their role allows, and each restaurant's data is kept separate.
• Server disks are encrypted and the database is backed up every day.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Your rights

Under Indian law you can ask us to:

• give you a summary of the personal data we hold about you and how we use it;
• correct, complete or update it;
• erase it, unless we must keep it by law;
• stop using it where you gave consent;
• let someone you nominate act for you if you die or cannot act.

If you are a guest, the quickest route is usually the restaurant, because it controls your details; we will help it respond. Email info@knownsense.ai with the subject "Privacy request". We acknowledge requests within 2 working days and aim to resolve them within 15 days. If you are not satisfied, you can complain to the Data Protection Board of India.

Cookies and browser storage

We use only cookies that POSBADA needs to work: to keep staff signed in and protect forms, to keep a guest's table order and phone verification on their device, and to remember a counter print station. Your browser also stores preferences such as language, sounds and your cart. When you order, your name, phone number, WhatsApp choice and delivery address are saved on your phone so you don't have to type them next time; tap Clear in "Your details" to remove them. We do not use advertising or analytics cookies.

Children

POSBADA is a service for businesses. Guests ordering from a restaurant should be 18 or older, or order with a parent's or guardian's consent.

Changes to this policy

We will post any changes here with a new date, and tell restaurants about important changes in the app or by email or WhatsApp.

Grievance officer and contact