1. Who we are and what this policy covers
TastyAdda (“TastyAdda”, “we”, “us”, “our”) operates the TastyAdda food-ordering Android app and the website where this policy appears (together, the “Service”). For the personal information described in this policy, TastyAdda is the data controller and, where applicable under Indian law, the data fiduciary.
This policy applies to customers who browse the menu, place an order or contact us, and to authorised administrators who sign in to manage the menu, coupons or orders. It does not apply to third-party services such as WhatsApp, Google Play or your device manufacturer, which have their own privacy policies.
2. Information we collect
Information you give us
- Your name and mobile number.
- Your order details: dishes, quantities, prices, subtotal, discount, coupon code, final total and order time.
- Any delivery or pickup instructions, messages or files you choose to send us through WhatsApp. WhatsApp is a separate service, so its privacy policy also applies to that conversation.
You do not need an account to order. We do not ask for a delivery address, payment card, bank details, government ID, date of birth or health information in the app. We also do not access your WhatsApp contacts or message history; you choose what to send.
Information stored on your device
We use your browser or app local storage to remember your cart and the name and mobile number you last entered. This information stays on your device and is sent to us only when you place an order. The admin area also uses local storage for the Supabase authentication session.
Information collected automatically
When your app or browser connects to our servers, our hosting and database providers may automatically process technical information such as your IP address, browser or app type, device and operating system, requested page, timestamps, and error or diagnostic logs. We use this information to serve the app, keep it secure, prevent abuse and fix problems.
We do not use advertising networks, third-party analytics or tracking pixels. We do not use your information for targeted advertising. For normal storefront use, we do not request access to your contacts, calendar, precise location, camera, microphone, photos or media, SMS, call logs, health data or biometric data.
Information for administrators
Authorised administrators sign in through Supabase Auth. For administrators, we process the login email, authentication session and menu images uploaded through the admin panel. This information is used only to operate and secure the Service.
3. How we use information
- To show the menu, manage your cart, apply coupons and prepare your order.
- To send your order to our kitchen on WhatsApp and contact you about availability, delivery or pickup.
- To keep an order history for admin reporting, accounting, dispute resolution and fraud prevention.
- To operate, secure, troubleshoot and improve the Service.
- To comply with applicable law, enforce our terms and respond to lawful requests.
We process this information because it is needed to provide the Service you request, because you have consented where required, because we have a legitimate business interest in keeping the Service secure and reliable, and because the law requires it in some cases. We do not sell or rent your personal information.
4. When we share information
We share information only as needed for the purposes described above:
- Supabase provides our database, authentication, file storage and realtime infrastructure. Order records, administrator accounts and menu images are stored in our Supabase project.
- WhatsApp (Meta) is used to send your order and chat with us. The order message includes your name, mobile number, items and totals. WhatsApp may also process your profile name, phone number, message content, media and metadata under its own privacy policy.
- Hosting and content-delivery providers process technical logs such as IP addresses, device details and request timestamps so the Service can be delivered securely.
- Authorised TastyAdda staff and administrators can access order and menu information when needed to fulfil orders or operate the Service.
- Service providers may process information on our behalf under confidentiality and data-protection obligations, only for the purposes we specify.
- Legal and safety purposes may require disclosure to authorities, courts or other parties where required by law, or where necessary to protect rights, safety and fraud prevention.
- A business transfer may involve transferring information as part of a merger, acquisition or sale of assets, subject to this policy and applicable law.
We do not sell your personal information, share it with data brokers, or provide it to advertising networks. Google Play and your app store provider may process download, installation and diagnostic information under their own policies.
5. Cookies and local storage
We do not use advertising or tracking cookies. The storefront uses local storage for your cart and saved
name and mobile number (for example, under keys such as tastyadda.cart.v1 and
tastyadda.customer.v1). The admin area uses local storage for the Supabase session.
You can clear this information at any time through your browser or Android app settings, or by uninstalling the app. Clearing local storage does not delete order records that have already been sent to us; see “Your rights and choices” below.
6. How long we keep information
- Cart and saved name/mobile details remain on your device until you clear them or uninstall the app.
- Order records are kept for as long as needed to provide order history, resolve disputes, prevent fraud and meet legal, accounting or tax obligations. Authorised administrators can delete individual order records when they are no longer needed.
- Diagnostic logs are kept for a limited period according to our hosting and database providers’ retention practices.
- Administrator account information is kept while the administrator account is active and as needed for security.
When information is no longer needed, we delete it or anonymise it where appropriate.
7. Security
We use HTTPS, access controls, Supabase row-level security and a restricted administrator allow-list to protect information. The app does not collect or store payment card details. However, no method of transmission or storage is completely secure. Please protect your device and your WhatsApp account, and never send passwords, one-time codes or card details through the app or WhatsApp.
8. Your rights and choices
Depending on where you live, you may have the right to:
- Request access to the personal information we hold about you.
- Ask us to correct inaccurate information.
- Ask us to delete information, subject to legal retention requirements.
- Withdraw consent where we rely on consent, without affecting earlier processing.
- Object to or request restrictions on certain processing.
- Clear the cart and saved details stored on your device.
- Complain to a data protection authority or use a grievance-redressal process.
If you are in India, these rights include access, correction, erasure, grievance redressal and nomination under the Digital Personal Data Protection Act, where applicable. If you are in another region, you may have additional rights under local law, such as the EU/UK GDPR or California privacy laws. We do not sell or share personal information for cross-context behavioural advertising, and we do not discriminate against you for exercising your rights.
Because customers do not have accounts, we may ask for your name, the mobile number used for the order and an approximate order date or order number so we can locate the right record. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law, normally within 30 days.
9. Children’s privacy
The Service is not directed to children under 13, or a higher minimum age where local law requires one. We do not knowingly collect personal information from children. If you believe a child has provided information, please contact us and we will take appropriate steps to delete it. Minors should use the Service only with the involvement of a parent or guardian.
10. International processing
Our service providers, including Supabase and our hosting provider, may store or process information outside India. Where required, we use contractual and organisational safeguards for those transfers. WhatsApp and Meta process information under their own policies and may transfer it internationally.
11. Changes to this policy
We may update this policy to reflect changes in the Service or the law. We will post the new effective date on this page and, for material changes, provide an additional notice in the app or on this page. Continued use of the Service after an update means you accept the updated policy, and we will ask for consent where the law requires it.
12. Contact and grievance redressal
For privacy questions, access or deletion requests, or complaints, contact our privacy and grievance contact:
Please include your name, the mobile number used for the order, the approximate order date or order number, and what you would like us to do. Do not send passwords, one-time codes or payment card details. If you are not satisfied with our response, you may contact the appropriate data protection authority in your jurisdiction.