Privacy Policy

DataRestro is a restaurant operating system operated by Data Doodles Tech Private Limited, Baluwatar-3, Kathmandu, Nepal (“DataRestro”, “we”, “us”). This policy explains how personal data is handled on datarestro.com, in the DataRestro business console, staff screens and apps, and on the ordering pages and websites that restaurants publish with DataRestro.

Who is responsible for your data depends on how you meet us:

• Guests of a restaurant. When you order, pay, book, join a loyalty programme or leave feedback at a restaurant that uses DataRestro, the restaurant is responsible for your data (the controller). We process it on the restaurant’s behalf and on its instructions (as its processor), under our Data Processing Addendum. The restaurant’s own privacy notice applies too.
• Restaurant owners and staff, and visitors to datarestro.com. For account, sign-in, billing and support data, and for enquiries sent through our website, DataRestro is responsible (the controller).

If you are a guest

Only what an order, payment or booking needs. Depending on what you do:

• Table orders by QR code: the table, what you ordered, notes for the kitchen and the time. Your name and phone number are optional unless the restaurant asks for them.
• Pickup and delivery orders: your name, phone number and, for delivery, the address you give.
• Payments: the payment status, amount, method and the provider’s transaction reference. We never receive full card numbers or wallet passwords.
• Invoices: if you ask for a tax invoice in your name, the name, PAN and address you give.
• Reservations: name, phone number, party size, date and time, and any note you add.
• Loyalty: if you join a restaurant’s programme, your phone number, visits and points.
• Feedback: the rating and comment you choose to leave.

If you own or work at a restaurant that uses DataRestro

• Account data: name, email address, phone number, role and branch, and your password or PIN, which we store only as a one-way hash.
• Sign-in and security data: your sessions, with IP address, browser or device information and times; failed sign-in attempts, with the email address tried and IP address; and the actions you take in the Service, recorded in an audit log the restaurant can review.
• Work records the restaurant keeps: shifts and cash counts, and, if the restaurant uses employee records, your employee code, joining date, salary, address and emergency contact.
• Business and billing contacts: the business’s legal name, PAN or VAT number, addresses, and the billing contact’s name, email and phone number.
• Agreements: which version of our legal documents an owner accepted, when, and the IP address and browser used.
• Support: the support requests you raise and the messages in them.

If you visit datarestro.com

• Enquiries: if you use the contact form, your name, email, restaurant, number of locations, country, topic and message.
• Technical data: like any website, our hosting provider processes your IP address and request details to deliver pages and protect the site from abuse.
• Website analytics: pages we serve under datarestro.com, including the business and staff consoles and restaurant pages on datarestro.com addresses, use Cloudflare Web Analytics. It records the page address, the page you came from, your browser and device type and how long the page took to load. It sets no cookies and stores nothing in your browser. We use the totals to see which pages are used and how fast they load. We do not use advertising tools or build profiles of visitors.

• From you, when you sign up, order, book, contact us or use the Service.
• From the restaurant or business you work for or visit: an owner creates staff accounts, and staff enter guest details for orders and reservations.
• From payment providers, which tell us whether a payment succeeded and give us its reference.
• Automatically, from your browser or device when it connects to the Service (see section 1 of the Cookie Notice).

We do not sell personal data, show advertising, profile people, make automated decisions with legal or similar effects, or use personal data to train AI models. DataRestro does not send marketing to a restaurant’s guests.

• The restaurant you ordered from, booked with or work for. Each restaurant sees only its own data.
• Our service providers, who host and deliver the Service for us under contracts that require them to protect it: Cloudflare (hosting, file storage and network), Neon (database) and Resend (account emails). The current list is in the Data Processing Addendum.
• Payment providers a restaurant connects, such as Khalti, eSewa, Fonepay or Stripe, when you choose to pay online. You enter your payment details with the provider, under its own privacy policy.
• Nepal’s Inland Revenue Department, when a restaurant enables CBMS reporting: each invoice’s details, including a buyer’s name and PAN where recorded.
• Authorities and advisers, where the law requires it or to establish or defend legal claims, and our professional advisers under confidentiality.
• A successor, if our business is reorganised, merged or sold, under the same protections.

Our database is hosted in Singapore, and our website and API run on Cloudflare’s global network, so your data is processed outside Nepal and may be processed outside your own country. Wherever it is processed, it is protected as this policy and our Data Processing Addendum describe. Where European or UK law applies to a transfer, we use the safeguards set out in the Data Processing Addendum.

We keep personal data for as long as it is needed for the purposes above, including to meet legal, tax and accounting requirements. In particular:

• Tax invoices and the sales records behind them are never edited or deleted early. For restaurants in Nepal they are kept for at least six years, as Nepal’s tax law requires, and longer where a tax authority, court or dispute requires it.
• Restaurant account and operational data is kept while the business uses DataRestro, then returned or deleted as the Data Processing Addendum describes.
• Guest profiles are kept while the restaurant keeps them. A profile without orders can be deleted at any time; for one with orders, we remove the guest’s contact details on request and keep the invoice records the law requires.
• Security data: records of failed sign-ins are kept for 90 days, then deleted; password-reset links expire after an hour and invitation links after 30 minutes; sign-in sessions expire after 7 days of inactivity.
• Acceptance records of our legal documents are kept for as long as the agreement they prove may matter.
• Website enquiries are kept only as long as needed to answer them and any follow-up.

Each restaurant’s data is separated from every other restaurant’s on the server. All connections are encrypted with TLS, passwords are hashed with Argon2id, payment and IRD credentials that restaurants store are encrypted, staff access is controlled by role and checked on the server, sign-in is protected against repeated guessing, and sensitive actions are written to an audit log. No system is perfectly secure. If a breach affects personal data, we will tell the affected restaurants without undue delay, and the restaurant or we will tell affected people and authorities as the law requires. More detail, including what we do not claim, is on our security page.

Depending on the law where you live, including Nepal’s Individual Privacy Act 2075 (2018), you may have the right to:

• know what personal data is held about you, and get a copy of it;
• have data that is wrong or incomplete corrected;
• have data deleted when it is no longer needed, apart from records the law requires us to keep;
• object to, or ask us to restrict, certain uses;
• receive data you provided in a portable format;
• withdraw consent where we rely on it, at any time.

How to make a request

Write to support@datadoodlestech.com. You do not need an account, and making a request never requires you to accept anything first. We may ask for information to confirm it is you, and we aim to respond within 30 days.

Guests: the restaurant decides how your data is used, so contacting it first is usually quickest. If you write to us, we will pass your request to the restaurant and help it respond. Staff: your restaurant’s owner or manager can correct your details in the console. Owners can also raise requests through Support.

If you are not satisfied with our answer, you can complain to the data protection authority or court where you live. In Nepal, the Individual Privacy Act 2075 (2018) provides for remedies.

DataRestro uses only the cookies and browser storage it needs to work: to keep staff signed in, keep a guest’s cart and order safe across a reload, and run the point of sale offline. There are no advertising cookies, and our website analytics set no cookies and store nothing on your device, so we do not show a consent banner. The full list, including the analytics script, is in our Cookie Notice.

Business accounts are for adults. Guests of any age may eat at restaurants that use DataRestro, but its ordering and booking features are not directed at children, and we do not knowingly collect personal data from children beyond what a parent or guardian enters for an order. If you believe a child has given us personal data, contact us and we will delete it where the law allows.

Each version of this policy has a version number and an effective date, shown at the top of this page. If a change materially affects how personal data is used, we will tell restaurant account owners in advance and ask them to acknowledge it in the console.

Data Doodles Tech Private Limited, operator of DataRestro, Baluwatar-3, Kathmandu, Nepal. Privacy questions and requests: support@datadoodlestech.com. General enquiries: our contact page.