Privacy Policy

This Policy applies to personal data collected through:

• the Book Your Menu mobile application (iOS and Android);
• our website and any admin tools, to the extent they collect personal data from Users; and
• customer support conversations by phone, email, WhatsApp or in-app chat.

It does not apply to third-party websites or apps linked from the Platform. Those are governed by their own privacy policies.

2.1. Data you give us

• Account and profile: name, mobile number, email address, date of birth, gender, profile photo and city or address.
• Verification: confirmation that your mobile number was verified by OTP. We do not keep the OTP itself once verification is complete.
• Booking and Order details: event type, Event Date and time, guest count, venue address, contact person's name and mobile number, selected Package, customisations, Add-ons and special instructions, including any dietary or allergy information you choose to share.
• Payment: your chosen payment method and transaction references. Full card, UPI and bank details are collected and processed directly by our payment partner (Razorpay) and are never stored on our servers.
• Reviews and ratings: ratings, dish ratings, review text and any photos you submit.
• Communications: messages you send to customer support, including complaints, refund requests and feedback.
• Saved addresses: venue addresses you choose to save for future bookings.

If you give us details of another person (for example, an on-site contact person), you confirm that you have their permission to do so.

2.2. Data collected automatically

• Device data: device model, operating system, app version, device identifiers and push notification tokens, used to run the app and send Order updates.
• Location (only with your permission): approximate or precise location, used to show catering available near you and to help fill in venue addresses. You can turn this off at any time in your device settings.
• Camera and photos (only with your permission): used only when you choose to upload a profile photo or review photo.
• Usage data: screens viewed, menus browsed, filters and searches, used to improve the Platform.
• Log data: IP address, timestamps and crash or error logs, used for security and to fix problems.

2.3. Data from others

• Payment partner: payment status, transaction ID and payment method type (without full financial details).
• Vendors: Order status updates from the Vendor fulfilling your Order (for example, "Preparing" or "Out for Delivery").

We use personal data only for these purposes:

3.1.to create and manage your Account and verify your mobile number;

3.2.to process, confirm and fulfil your Orders, including sharing necessary details with the assigned Vendor;

3.3.to process payments, refunds and tax invoices;

3.4.to provide customer support and handle complaints and refund requests;

3.5.to send transactional messages (confirmations, status updates, payment receipts and review requests) by push notification, SMS, WhatsApp or email;

3.6.to personalise your experience, such as recommended menus, saved addresses and your Veg/Non-Veg preference;

3.7.to understand how the Platform is used and improve its features, reliability and performance;

3.8.to detect, prevent and investigate fraud, abuse and security incidents;

3.9.to comply with legal obligations, such as GST invoicing, accounting and consumer protection record-keeping; and

3.10.with your consent, to send marketing about offers, new menus and referral or loyalty programmes (see Section 13).

We will not use your personal data for a new purpose that is unrelated to these purposes without telling you and, where required, asking for your consent.

Under the DPDP Act, we process your personal data on one of these grounds:

• Your consent, given at sign-up, through permission prompts (location, camera, photos, notifications) or when you opt in to marketing; or
• Legitimate uses permitted by the DPDP Act, including processing data you have voluntarily provided for a specific purpose (such as fulfilling an Order you placed), complying with law or a court order, and responding to medical emergencies or threats to safety.

5.1.Where we rely on consent, we will ask for it in clear and plain language, for a specific purpose.

5.2.You may withdraw consent at any time, as easily as you gave it, through the app settings, your device settings or by writing to privacy@bookyourmenu.com. Withdrawal does not affect processing carried out before it.

5.3.If you withdraw consent for data that is essential to a service (for example, your mobile number for your Account), we may not be able to continue that service. We will tell you if this applies.

5.4.You may also give, manage or withdraw consent through a Consent Manager registered with the Data Protection Board of India, once such services are available.

We do not sell your personal data. We share it only as follows:

6.1.With Vendors. To fulfil your Order, we share your name, contact number, venue address, guest count, Package, customisations and special instructions with the assigned Vendor. Vendors are contractually required to use this data only to fulfil your Order and to protect it.

6.2.With our payment partner. Payment details go directly to Razorpay to process your transaction, under Razorpay's own privacy policy.

6.3.With service providers (Data Processors). We use trusted providers for cloud hosting and image storage, OTP and SMS delivery, push notifications, customer support tools and analytics. They process data only on our instructions, under contracts that require appropriate security.

6.4.For legal reasons. We may disclose data where required by law, a court order or a lawful request from a government authority, or where necessary to protect the rights, property or safety of Book Your Menu, our Users or the public.

6.5.Business transfers. If Book Your Menu is involved in a merger, acquisition or sale of assets, personal data may be transferred, and it will remain protected by this Policy or an equally protective one.

6.6.Aggregated data. We may share aggregated or de-identified information that cannot reasonably identify you.

7.1.Your data is primarily stored and processed in India. Some service providers, such as our image storage provider, may store data on servers outside India.

7.2.Any transfer outside India is made in line with the DPDP Act, and not to any country the Central Government has restricted. We require such providers to apply security safeguards at least as protective as those described in this Policy.

8.1.We keep personal data only for as long as needed for the purposes in this Policy, or as required by law.

8.2.Account data is kept while your Account is active. Order, payment and invoice records are kept for as long as tax, accounting and company laws require (currently up to eight years). Security and access logs are kept for at least one year, as required by the DPDP Rules, 2025.

8.3.When data is no longer needed, or when you ask us to erase it and no legal obligation requires us to keep it, we will delete or anonymise it. Where the DPDP Rules require, we will notify you before erasing data because of inactivity.

8.4.Reviews may remain visible in de-identified form after your Account is deleted, unless you ask us to remove them.

As a Data Principal, you have the right to:

9.1.Access: get a summary of the personal data we hold about you, how we process it, and who we have shared it with;

9.2.Correction and updating: correct, complete or update your data (most profile details can be edited directly on the Personal Information screen);

9.3.Erasure: ask us to erase your personal data, except where we must keep it by law;

9.4.Withdraw consent: at any time, as described in Section 5;

9.5.Grievance redressal: complain to our Grievance Officer (Section 15) and receive a response; and

9.6.Nomination: nominate another person to exercise your rights if you die or become unable to do so.

To exercise any of these rights, write to privacy@bookyourmenu.com from your registered email or mobile number. We may need to verify your identity first. We will respond within the time required by law, and in any case within 90 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Please also note your duties under the DPDP Act: give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.

10.1.We use reasonable security safeguards, including encryption in transit (HTTPS/TLS), access controls and role-based permissions for our staff, secure storage of login tokens, and monitoring and logging of access to personal data.

10.2.No system is completely secure. We will keep reviewing and improving our safeguards.

10.3.Data breaches. If a personal data breach occurs, we will inform affected Users without delay, explaining what happened, the likely impact and the steps they can take. We will also report it to the Data Protection Board of India and other authorities within the time required by law.

The Platform is meant for adults aged 18 and over. We do not knowingly collect personal data from children, and we do not track, profile or target advertising at children. If we learn that we have collected a child's data without verifiable consent from a parent or lawful guardian, we will delete it promptly. If you believe a child has given us personal data, contact privacy@bookyourmenu.com.

12.1.The app uses secure on-device storage to remember your session, preferences and login tokens.

12.2.Our website may use cookies for essential functions, analytics and, only with your consent, marketing. You can manage cookies in your browser settings.

12.3.Analytics tools we use may set their own identifiers, subject to their own privacy policies.

We send marketing (offers, new menus, referral and loyalty updates) only with your consent. You can opt out at any time in the app's notification settings, by using the unsubscribe link, or by replying STOP where offered. Promotional SMS and calls follow TRAI rules, including the Do Not Disturb (DND) registry. Opting out does not stop transactional messages about your Orders.

The Platform may link to or work with third-party services (for example, payment gateways, map services and UPI apps such as PhonePe, Paytm or Google Pay). This Policy does not cover how those third parties handle your data. Please read their privacy policies.

In accordance with the Information Technology Act, 2000, the DPDP Act and the rules made under them, our Grievance Officer is:

Name: Hemanth Solleti
Designation: Grievance Officer
Email: privacy@bookyourmenu.com
Address: 2nd Floor, Akshaya Heights Plot Nos. Road No. 9, Sai Aishwarya Layout Rd, Chitrapuri Colony, Hyderabad, Telangana-500032.

We will acknowledge your complaint within 48 hours and respond within the time required by law.

We may update this Policy to reflect changes in our practices, technology or the law. We will post the updated Policy with a new "Last updated" date and, for material changes, notify you in the app or by email before they take effect. Where a change requires fresh consent, we will ask for it.

Book Your Menu
2nd Floor, Akshaya Heights Plot Nos. Road No. 9, Sai Aishwarya Layout Rd, Chitrapuri Colony, Hyderabad, Telangana-500032.
Privacy: privacy@bookyourmenu.com
Support: support@bookyourmenu.com
Grievance Officer: see Section 15