CountStand (“CountStand”, “we”, “us”) provides a restaurant operating system used by restaurants (“Customers”) to run their outlets. This policy explains what personal data we handle, why, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDP Act). It applies to our website and the CountStand product.
1Who controls the data
For data about our own users (restaurant owners and staff who sign up, billing contacts, website visitors), we act as the Data Fiduciary. For data that a restaurant enters about its guests (e.g. a diner's phone number for loyalty), the restaurant is the Data Fiduciary and we act as a Data Processor on its behalf, handling that data only on the restaurant's instructions.
2The personal data we collect
- Account data, name, business name, email, phone, password (hashed), role.
- Outlet & compliance data, outlet name, address, GSTIN, FSSAI licence number and expiry.
- Billing data, plan, billing contact, and payment metadata. Card/UPI details are handled by our payment processor (Razorpay); we do not store full card numbers.
- Customer (guest) PII entered by restaurants, typically a phone number, optionally name and order history, used for loyalty, feedback and receipts. This is stored encrypted.
- Usage & device data, log data, IP, device/browser, and product analytics used to run and improve the service.
3Why we use it, and on what basis
- To provide the service, take orders, print GST invoices, manage inventory, and sync across devices.
- To meet legal obligations. GST invoicing and record-keeping, and printing your FSSAI number on every bill.
- To bill and support you, and to communicate service and account notices.
- To secure, maintain and improve the product.
Our legal bases are your consent (given at signup and when a restaurant collects guest data) and the necessity of processing to deliver a service you have requested and to comply with law.
4How we protect it
- Guest PII is encrypted at rest; data is transmitted over HTTPS/TLS.
- Each restaurant's data is isolated using row-level security so one tenant can never see another's data.
- Access is role-based and audited; passwords are hashed, never stored in plain text.
5Who we share it with
We do not sell personal data. We share it only with sub-processors that help us run the service, under contract and only as needed, for example cloud hosting, database, payments (Razorpay), email delivery, and error/analytics tooling. We may disclose data if required by law.
6How long we keep it
We keep personal data for as long as your account is active and as required to meet legal, tax and accounting obligations (e.g. GST records). When no longer needed, data is deleted or anonymised. On account closure you can export everything, and you can ask for it to be erased; both are described in section 7.
7Your rights as a data principal
- Access, request a copy of the personal data we hold about you.
- Correction, have inaccurate data corrected or completed.
- Erasure, request deletion of your personal data, subject to legal retention. The product supports erasure of guest personal data on request, from inside the product; erasing a whole tenant is a request an owner makes to us and we run together, for the reason given under How export and erasure actually work below.
- Withdraw consent, where processing is based on consent, you can withdraw it.
- Grievance redressal, raise a concern with our Grievance Officer and, if unresolved, with the Data Protection Board of India.
To exercise any right, email contact@countstand.com. We respond within the timelines required by law.
How export and erasure actually work
One of these you run yourself; the other you ask us for, and the difference is deliberate. Export is a real endpoint, not a promise to do it by hand: POST /api/tenancy/export, owner-only. It answers with a row count, a table count, a byte count and a SHA-256, so you can check the export is complete before you move it, and the same call with download returns the whole tenant as one JSON file. It keeps working while an account is suspended, deliberately, because a billing dispute is not a reason to hold your data.
Erasing guest personal data is yours to do, from inside the product: POST /api/dpdp/erase, for anyone who can manage settings. Erasing a whole tenant is POST /api/tenancy/erase, owner-only, and it is not a button. It defaults to a dry run that tells you exactly what would be removed, and it refuses until you confirm by typing your own organisation's slug — and beyond that the server itself refuses unless we have armed that one operation, on that one database, first. So you ask us and we run it with you. That is not us holding your data: export needs none of this and never will. It is that the one irreversible action here should not be one command away from a mistake. What survives an erasure is only what the law requires us to keep, including the audit-log entry that records the erasure itself.
8Cookies and analytics
We use essential cookies to keep you signed in and privacy-friendly analytics to understand usage and improve performance. You can control cookies in your browser; disabling essential cookies may break parts of the app.
9Children
The service is for businesses and is not directed to children. We do not knowingly collect personal data of children as defined under the DPDP Act.
10Our grievance officer
Under section 13 of the DPDP Act you can raise a concern with our Grievance Officer:
- Name, Tarim .
- Email, contact@countstand.com.
- Postal address, Sidhu Bhavan, Ahmedabad.
Write to the officer and we respond within the timelines required by law. If the concern is unresolved, you can approach the Data Protection Board of India.
11Changes to this policy
We may update this policy; material changes will be notified in-product or by email, and the “last updated” date above will change.