Privacy policy

This policy explains how Kemu Infotech Pvt Ltd (“we”, “us”) handles personal data in OrderTill, our restaurant billing and order-taking service, and on this website.

Who we are

OrderTill is provided by Kemu Infotech Pvt Ltd, a company in India. You can reach us about anything in this policy at support@ordertill.com.

Two roles

• A restaurant's own records. Bills, orders, the menu and the details of a restaurant's own guests (for example a name or phone number recorded against an order) belong to the restaurant. The restaurant decides why and how they are used. Under India's Digital Personal Data Protection Act, 2023 the restaurant is the Data Fiduciary for that data and we are its Data Processor: we handle it only to provide OrderTill, on the restaurant's instructions, and never for our own purposes. If you are a guest of a restaurant, please contact the restaurant first; we will help it answer you.
• Account and contact data. For the details of the people who use OrderTill accounts (owners, managers and staff) and of anyone who writes to us, we decide how the data is used, and we are the Data Fiduciary.

What we collect

• Account details: name, email address and phone number, the person's role in the restaurant's account, and sign-in settings. Passwords are stored only in hashed form; we cannot read them.
• Restaurant business details: the business's name and the tax details it gives us (such as its GSTIN), its branches, its devices and its subscription.
• A restaurant's trading records: bills, orders, the menu, staff and any guest details the restaurant records. Where these are kept depends on how the restaurant is set up. By default they stay on the restaurant's own devices, and orders sent between those devices through our service are encrypted with keys only the restaurant's devices hold. Where a restaurant chooses to keep its records in our cloud, we store them for it.
• Device and technical data: IP addresses, device identifiers, app versions, when devices connect and how much they exchange, and sign-in and security events.
• Messages you send us, for example by email.

We do not collect or store payment-card numbers. When a restaurant records a card or UPI payment, OrderTill records the method and the amount, not the card.

Why we use it

• To provide OrderTill: signing people in, running billing and order-taking, carrying orders between a restaurant's devices, and keeping devices activated and up to date.
• To keep accounts and the service secure, including detecting and stopping automated or abusive sign-in attempts.
• To answer support requests and other messages.
• To manage a restaurant's subscription with us.
• To meet our legal obligations, such as keeping records the law requires.

We do not sell personal data, we do not use it for advertising, and OrderTill does not send marketing email.

Signing in with Google

If you choose “Sign in with Google”, Google sends us your Google account's identifier, your email address and your basic profile (name and picture). We use the identifier and the email address only to match you to your existing OrderTill account and sign you in; signing in with Google does not create an account. We keep only a protected reference to the identifier, so that we recognise you next time, and we do not keep the name or the picture. We do not use this information for advertising and we do not share it with anyone.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

reCAPTCHA

Our sign-in and password-reset pages use Google reCAPTCHA to protect accounts from automated abuse. reCAPTCHA collects hardware and software information (such as device, browser and interaction data) and sends it to Google for analysis; its use is subject to Google's Privacy Policy and Terms of Service. We receive only a risk score and never use it for any other purpose.

Google may process this information outside India.

Email

OrderTill sends only account email: links to set a password, password-reset links, security notices and, rarely, a notice about the service itself, such as a change to this policy. It sends them only to people whom a restaurant owner, or we ourselves, have added to an account. OrderTill never sends marketing email. Account email is sent through Amazon Simple Email Service (Amazon SES).

Cookies

This website sets no cookies of its own and runs no analytics or tracking. Cloudflare, which protects it from attack, may set a short-lived security cookie. The OrderTill web portal uses cookies only to keep you signed in securely and to remember whether you chose a light or dark theme.

Where data is kept and who processes it

Our servers and databases run on Amazon Web Services in its Mumbai region, in India. We use these service providers to run OrderTill:

• Amazon Web Services, for hosting, storage and sending account email.
• Cloudflare, which carries traffic to this website and our services and protects them from attack.
• Google, for Sign in with Google and reCAPTCHA.

How long we keep it

• Account and business details: for as long as the account exists. Nothing is deleted because a subscription lapses.
• Financial records we hold for a restaurant, such as invoices: seven years, as Indian GST law requires.
• Technical logs of device connections: 180 days, as Indian law (CERT-In) requires. These logs record that devices connected and how much they exchanged; they do not contain order contents.
• Records of how personal data was processed: one year, as the Digital Personal Data Protection Rules require.
• A guest's details: when a restaurant asks us to erase a guest's personal details, we remove the name, phone number, email address and address. The invoice's financial details are kept for the seven-year GST period, without the guest's personal details.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask us:

• for a summary of the personal data we process about you and how we process it;
• to correct, complete or update your personal data;
• to erase your personal data, except what the law requires us to keep;
• to withdraw consent, where we rely on your consent;
• to let a person you nominate use these rights for you in the event of your death or incapacity;
• to resolve a grievance about how we handle your data.

To use any of these rights, email support@ordertill.com, if possible from the address on your account. We may need to confirm who you are before we act. If your data is part of a restaurant's records, we will pass your request to the restaurant and help it answer. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Grievances

Send any complaint about how we handle personal data to support@ordertill.com. We respond within 30 days.

Security

We protect data with encryption in transit, hashed passwords and access limited to the people who need it. If a personal data breach happens, we will notify those affected and the Data Protection Board of India as the law requires.

Children

OrderTill is a service for businesses. Its accounts are for adults acting for a restaurant, and we do not knowingly create an account for anyone under 18.

Changes to this policy

When we change this policy we will publish the new version on this page with a new effective date. If a change materially affects how we handle your data, we will tell account owners by email before it takes effect.

Contact

Kemu Infotech Pvt Ltd, support@ordertill.com.