Privacy Policy

Account Information

• Full name, email address, phone number, and password (hashed) when you register
• Organisation name, branch name, and business address
• Role and permission level (superadmin, branch admin, cashier, waiter, kitchen staff)

Business Data

• Menu items, categories, pricing, and images
• Table layouts, floor configurations, and KDS station settings
• Orders, transactions, payment records, and receipts
• Inventory levels, supplier details, and purchase records
• Staff attendance and shift information

Technical Data

• IP address, browser type and version, operating system
• Pages visited, time spent on pages, and navigation patterns
• Device type (desktop, tablet, mobile) and screen resolution
• Error logs and performance metrics for service reliability

We use the information we collect for the following purposes:

• Service delivery: To operate, maintain, and provide the POS system, KDS, order management, and analytics features
• Account management: To create and manage your account, authenticate logins, and enforce role-based access controls
• Billing and invoicing: To generate invoices, process subscription payments, and send billing reminders
• Communication: To send transactional emails (invoices, payment confirmations, subscription alerts, support ticket updates) and registration confirmations
• Improvement: To analyse usage patterns and improve the Service, fix bugs, and develop new features
• Security: To detect and prevent fraud, abuse, and unauthorised access (including anti-bot measures during registration)
• Legal compliance: To comply with applicable laws, regulations, and legal processes in India, UAE, and the UK

Legal basis (GDPR): We process your data based on contractual necessity (to provide the Service you signed up for), legitimate interest (to improve and secure the Service), consent (for optional marketing communications), and legal obligation (tax and compliance records).

We implement industry-standard security measures to protect your data:

• Encryption in transit: All data is transmitted over TLS (HTTPS). No unencrypted connections are accepted.
• Encryption at rest: Payment gateway credentials and sensitive configuration data are encrypted using AES-256 before storage.
• Password security: Passwords are hashed using bcrypt with a cost factor of 10. We never store plaintext passwords.
• Authentication: All API endpoints require JWT-based authentication. Tokens expire after a set period and must be refreshed.
• Input sanitisation: All user inputs are sanitised to prevent XSS, SQL injection, and other injection attacks.
• Content Security Policy: We enforce CSP headers to prevent unauthorised script execution.
• Access control: Role-based access ensures staff can only access data relevant to their role and branch.
• Audit logging: All significant actions are logged with timestamps and user identity. Audit logs are retained for 365 days.

We do not store raw credit or debit card numbers. All payment card processing is handled by our PCI-compliant payment gateway partners (see Third-Party Services below).

We share data with the following third-party service providers, solely for the purposes described:

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

We use a minimal set of cookies and browser storage mechanisms:

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not participate in behavioural advertising networks.

Depending on your jurisdiction, you have the following rights regarding your personal data:

Under GDPR (UK / EEA)

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to restrict processing: Request limitation of how we use your data
• Right to object: Object to processing based on legitimate interest
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

Under India IT Act & DPDPA 2023

• Right to access: Obtain a summary of your personal data and processing activities
• Right to correction and erasure: Request correction of inaccurate data or erasure of data no longer necessary
• Right to grievance redressal: Lodge a complaint with our designated grievance officer
• Right to nominate: Nominate another individual to exercise your rights in the event of death or incapacity

Under UAE Federal Decree-Law No. 45/2021

• Right to access: Request access to your personal data
• Right to correction: Request rectification of inaccurate data
• Right to stop processing: Request cessation of data processing in certain circumstances
• Right to data transfer: Request transfer of your data to another controller

To exercise any of these rights, please contact us at support@billfeeds.com. We will respond within 30 days (or within the period required by applicable law). We may ask you to verify your identity before processing your request.

• Account data: Retained for as long as your account is active. Upon account deletion, personal data is removed within 30 days.
• Order and transaction records: Retained for the duration of your subscription plus 7 years thereafter to comply with tax and accounting regulations in India, UAE, and UK.
• Audit logs: Retained for 365 days, then automatically archived. Archived logs are retained for an additional 2 years before permanent deletion.
• Billing records: Retained for 7 years from the date of the transaction as required by applicable tax laws.
• Support tickets: Retained for 3 years from resolution for quality assurance and legal purposes.

As Bill Feeds operates across India, the UAE, and the UK, your data may be transferred to and processed in countries outside your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the UK/EEA
• Adequacy assessments for all third-party processors
• Contractual obligations requiring equivalent data protection standards

Bill Feeds is a business-to-business service intended for restaurant operators and their staff. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us at support@billfeeds.com and we will promptly delete such information.

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a data protection concern, please contact us:

For complaints that remain unresolved, UK residents may contact the Information Commissioner's Office (ICO). Indian residents may contact the Data Protection Board of India. UAE residents may contact the UAE Data Office.