Privacy Policy

1. Whose information this covers

• Restaurant owners and staff who have an account.
• Customers of a restaurant: for example a name typed when ordering by QR code, or customer records a restaurant keeps for loyalty points or credit.

For restaurant and customer records, the restaurant decides what to enter and why. Sudridha stores and processes that information on the restaurant's behalf.

2. What we collect

• Account details: name, email address, and your password (stored in protected, hashed form, never in plain text).
• Restaurant details: restaurant name, address, phone, and PAN/VAT number, if you provide them.
• Staff records: name, email, phone, role, PIN (stored in hashed form), photo, attendance times, and salary if the owner chooses to enter it.
• Customer records: name, phone, loyalty points, and credit balance, as entered by the restaurant; and buyer name or PAN if a customer asks for a tax invoice.
• Business records: orders, bills, payments recorded, menu, inventory, expenses, and reports.
• Diners using a QR code: no account is needed. If a diner types a name when ordering, it is stored with that order so staff can identify it.
• Technical data: IP address, browser and device type, performance information, and error reports, used to keep the service secure and working.

3. How we use it

• To provide and run the service, and to show each restaurant its own data.
• To sign you in, keep accounts secure, and limit abuse (such as repeated login attempts).
• To send emails you need, such as verification, password reset, and account status.
• To give support, find and fix errors, and improve performance.

We do not sell personal information and we do not use it for advertising.

4. Who we share it with

We use trusted service providers to run Sudridha. They handle data only to provide their service to us:

• Vercel — hosting, and anonymous page-performance measurement.
• Supabase — database and file storage (uploaded photos and logos). Our database is hosted in India (Mumbai).
• Upstash — a fast store used to rate-limit requests by IP address.
• Resend — sending emails.
• Sentry — error monitoring, which may include technical details about the page and browser where an error happened.
• Telegram — internal alerts to our team about new restaurant signups and support requests, which include the restaurant name and owner email.

Some of these providers process data outside Nepal. We may also share information if the law requires it, or to protect the security of the service and its users.

5. Cookies and local storage

We use only what the service needs: a sign-in session cookie, cookies that remember which branch and which staff member is active, and small browser-storage entries for settings such as which menu groups are open and orders waiting to sync while offline. We do not use advertising or cross-site tracking cookies.

6. How long we keep it

We keep data while an account is active. If an account is closed, we delete or anonymise its data on request, except limited information we may need to keep for security, accounting, or legal reasons.

7. Security

We protect data with measures such as encrypted connections, hashed passwords, access limited by role and by restaurant, and monitoring for errors and abuse. No system is completely secure, so we cannot guarantee absolute security. Please choose a strong password and keep staff PINs private.

8. Your choices

You can ask to see, correct, or delete your personal information, or to close your account. Staff should ask their restaurant owner first, since the restaurant controls staff and customer records. To make a request, please use the Support page inside the app.

9. Children

Sudridha is a business service and is not aimed at children under 18.

10. Changes

We may update this policy. If a change is significant we will tell you in the app or by email. The date at the top shows when it was last updated.

11. Contact

Questions about privacy? Please use the Support page inside the app.