Privacy Policy

CountStand (“CountStand”, “we”, “us”) provides a restaurant operating system used by restaurants (“Customers”) to run their outlets. This policy explains what personal data we handle, why, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDP Act). It applies to our website and the CountStand product.

1. Roles, who controls the data

For data about our own users (restaurant owners and staff who sign up, billing contacts, website visitors), we act as the Data Fiduciary. For data that a restaurant enters about its guests (e.g. a diner's phone number for loyalty), the restaurant is the Data Fiduciary and we act as a Data Processor on its behalf, handling that data only on the restaurant's instructions.

2. Personal data we collect

• Account data, name, business name, email, phone, password (hashed), role.
• Outlet & compliance data, outlet name, address, GSTIN, FSSAI licence number and expiry.
• Billing data, plan, billing contact, and payment metadata. Card/UPI details are handled by our payment processor (Razorpay); we do not store full card numbers.
• Customer (guest) PII entered by restaurants, typically a phone number, optionally name and order history, used for loyalty, feedback and receipts. This is stored encrypted.
• Usage & device data, log data, IP, device/browser, and product analytics used to run and improve the service.

3. Why we use it (purpose & legal basis)

• To provide the service, take orders, print GST invoices, manage inventory, and sync across devices.
• To meet legal obligations. GST invoicing and record-keeping, FSSAI reminders.
• To bill and support you, and to communicate service and account notices.
• To secure, maintain and improve the product.

Our legal bases are your consent (given at signup and when a restaurant collects guest data) and the necessity of processing to deliver a service you have requested and to comply with law.

4. How we protect it

• Guest PII is encrypted at rest; data is transmitted over HTTPS/TLS.
• Each restaurant's data is isolated using row-level security so one tenant can never see another's data.
• Access is role-based and audited; passwords are hashed, never stored in plain text.

5. Sharing & processors

We do not sell personal data. We share it only with sub-processors that help us run the service, under contract and only as needed, for example cloud hosting, database, payments (Razorpay), email delivery, and error/analytics tooling. We may disclose data if required by law.

6. Data retention

We keep personal data for as long as your account is active and as required to meet legal, tax and accounting obligations (e.g. GST records). When no longer needed, data is deleted or anonymised. On account closure you can export your data; guest PII can be erased on request (see below).

7. Your rights (data principals)

• Access, request a copy of the personal data we hold about you.
• Correction, have inaccurate data corrected or completed.
• Erasure, request deletion of your personal data, subject to legal retention. The product supports erasure of guest PII on request.
• Withdraw consent, where processing is based on consent, you can withdraw it.
• Grievance redressal, raise a concern with our Grievance Officer and, if unresolved, with the Data Protection Board of India.

To exercise any right, email contact@countstand.com. We respond within the timelines required by law.

8. Cookies & analytics

We use essential cookies to keep you signed in and privacy-friendly analytics to understand usage and improve performance. You can control cookies in your browser; disabling essential cookies may break parts of the app.

9. Children

The service is for businesses and is not directed to children. We do not knowingly collect personal data of children as defined under the DPDP Act.

10. Grievance Officer

As required by law, you can contact our Grievance Officer, Tarim , at contact@countstand.com, CountStand, India.

11. Changes

We may update this policy; material changes will be notified in-product or by email, and the “last updated” date above will change.