Privacy policy

1. Two kinds of data

Data about you, as a person who visits our website, fills the sign-up form, or owns or works at a business that uses ThaliKhali. For this data we decide why and how it is used (we are the Data Fiduciary).

Data about a restaurant's customers, such as the name and phone number a cashier saves on a bill. The restaurant decides why it is collected and is responsible for it; we only store and process it to run ThaliKhali for that restaurant (we are its Data Processor). Each restaurant has its own privacy notice for its customers, linked from its website page and e-bills. Customers should contact the restaurant first; we help the restaurant answer.

2. What we collect

• Sign-up form: your name, mobile number and, if you give them, your outlet name and city.
• Your account: the owner's name and mobile number, business and outlet details (name, address, phone, GSTIN, FSSAI number, tax type, UPI ID), and the names and roles of staff you add. Staff PINs are stored only as salted hashes.
• Your business records: menu, bills, kitchen tickets, stock, purchases, shifts and reports you create in ThaliKhali.
• Devices and security: the counters you register, app version, sign-in times, IP address and error logs, used to keep accounts secure, limit abuse and fix problems.
• Payments: if you connect a payment gateway, its keys are stored encrypted. We never see or store card numbers or UPI PINs; your customers pay through the gateway.
• Messages: bills and shift summaries sent on WhatsApp, and the record of whether each customer agreed to receive them.

3. Why we use it

• To call or message you about setting up ThaliKhali, when you ask us to through the sign-up form.
• To run the service: billing, kitchen tickets, reports, backups, your restaurant website and messages you choose to send.
• To sign you in with a one-time code sent by SMS, and to keep your account and our systems secure.
• To give support, fix problems and improve ThaliKhali.
• To bill you for your plan and keep the tax records the law requires of us.
• To tell you about important changes to the service or these policies.

4. Our basis for using it

We use data about you with your consent (for example, the tick box on the sign-up form, which you can withdraw at any time) or for the uses the DPDP Act allows without it: providing the service you asked for, meeting legal duties such as tax records, and responding to emergencies. Consent you withdraw stops future use; it does not undo what was done before.

5. Who we share it with

Only with service providers who help us run ThaliKhali, under contracts that let them use the data only for that work:

• our hosting and backup storage providers;
• an SMS provider, to send sign-in codes;
• Meta's WhatsApp Business service, to send bills and summaries you or your customers have agreed to;
• the payment gateway you connect (for example Cashfree), for payments made to your own account.

We may also share data when the law requires it, for example on a lawful order from a court or government authority. If Eleven Labs (India) is ever merged or sold, your data would move with the service under this policy.

6. Cookies and tracking

Our website sets no cookies and uses no trackers, analytics or ads. The ThaliKhali app stores your sign-in and a copy of your outlet's data on the counter device so billing works without the internet; signing out removes the sign-in.

7. How long we keep it

• Sign-up form: until you ask us to stop contacting you; then we delete it.
• Your account and business records: while you use ThaliKhali, and 90 days after your plan ends so you can download everything; then deleted, except what the law requires us to keep (such as our own invoices to you).
• A restaurant's customer data: as long as the restaurant keeps it. When a customer is erased, their name and number are removed while the bills stay for the restaurant's GST records.
• Security logs: for up to one year.
• Backups: deleted data leaves our encrypted backups as they roll over.

8. Where it is stored and how it is protected

Data is stored with our hosting and backup providers. If any of it is stored outside India, it will only be in countries the Government of India allows under the DPDP Act. How we protect it is set out on our security page.

9. Your rights

For data about you, you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct or complete it, or update it;
• erase it, when it is no longer needed or you withdraw consent, unless the law requires us to keep it;
• stop using it based on your consent;
• name a person to use these rights for you if you die or cannot act.

To use a right, call or WhatsApp WhatsApp +91 90825 36997 · +91 90825 36997, write to us at Eleven Labs (India), 13th Floor, WeWork 247 Park, Vikhroli West, Mumbai 400079, Maharashtra, India. We may ask you to confirm who you are. We answer within 90 days, sooner where we can. If you are not satisfied, see our escalation matrix; you can also complain to the Data Protection Board of India.

10. Children

ThaliKhali is for businesses and is not meant for anyone under 18. We do not knowingly collect data about children; if we learn we have, we delete it.

11. Changes to this policy

If we change this policy in a way that matters, we tell account owners on WhatsApp or in the app before it applies, and update the date at the top.

12. Contact

Eleven Labs (India), 13th Floor, WeWork 247 Park, Vikhroli West, Mumbai 400079, Maharashtra, India. Phone: WhatsApp +91 90825 36997 · +91 90825 36997. For complaints, the Grievance Officer is listed in our escalation matrix.