Privacy & Data Protection Policy

This policy explains what personal and commercial information ALOT CAFÉ ("we", "us") collects through our physical experience centre, website, online shop, and vendor portal, how that data is processed, and your rights.

1. Information We Collect

• Vendor Applicants & Empanelled Makers: When signing into our vendor portal via Google OAuth, we receive your verified email, name, and profile photo. During application, we collect your business or company name, brand name, authorized contact person, phone number, registered office address, optional GSTIN, product descriptions, pricing, and high-resolution photographs.
• Customers & Cafe Guests: When placing orders in-store (via QR scan) or online, we collect your name, contact phone number, delivery address, order details, and payment confirmation tokens. We never store raw credit card or bank login credentials.
• Website Visitors: Anonymous, aggregated technical data such as browser type, operating system, approximate region, and pages visited to ensure site performance and security. We do not engage in third-party ad tracking or cross-site profiling.

2. How We Use Information

We process information strictly for legitimate commercial and operational purposes:

• To evaluate, empanel, and manage vendor partnerships under our Master Vendor Agreement.
• To facilitate customer transactions, verify orders, coordinate deliveries, and remit vendor payouts.
• To issue compliant GST invoices, maintain accounting records, and comply with tax deduction (TDS) requirements under Indian law.
• To provide customer support, attend to warranty or repair inquiries, and communicate service updates.

3. Customer Data Protection & Vendor Obligations

Under Article 16 and Article 21 of our Master Vendor Agreement, customer information constitutes a valuable and confidential commercial asset. All empanelled vendors are legally bound to:

• Maintain strict confidentiality of customer contact details, project specifications, and order data.
• Never sell, disclose, copy, or distribute customer information to any third party.
• Use customer details solely for fulfilling confirmed orders or carrying out warranty service.
• Implement reasonable administrative, technical, and organizational safeguards to prevent unauthorized access or disclosure.
• Securely return or destroy customer data upon termination of empanelment, unless retention is mandated by law.

4. Infrastructure, Storage & Security

Our digital platform is built with enterprise infrastructure provided by Supabase and Vercel. Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access to sensitive vendor submissions and customer records is restricted exclusively to authorized ALOT personnel on a strict need-to-know basis.

5. Data Retention

We retain customer and vendor transactional records for as long as necessary to fulfill the commercial purpose, provide warranty and after-sales support, and meet statutory retention obligations under Indian taxation and corporate laws (typically 7 to 8 years for tax records), after which data is safely anonymised or permanently deleted.

6. Your Rights & Choices

In accordance with applicable Indian laws (including the Digital Personal Data Protection Act, 2023):

• You have the right to request access to or correction of personal information held by ALOT.
• You may request erasure of your data or withdraw an active vendor application by contacting us in writing.
• You can revoke Google OAuth permissions granted to ALOT at any time via your Google Account security settings.

7. Contact & Grievance Redressal

For inquiries, data access requests, or privacy concerns, contact our Grievance Officer: