This policy explains how [LEGAL ENTITY NAME] (“Retova”, “we”) handles personal data through retova.in and the ordering products we operate for our business customers.

Two different roles

This distinction matters, because it decides who is answerable to you.

For our website and our own customers, we are the Data Fiduciary. We decide what is collected and why.
For diners and visitors using a business's ordering app, that business is the Data Fiduciary and we are its Data Processor. We hold the data on their instruction, under a written agreement, and we do not use it for our own purposes.

What we collect

From a business enquiring with us: name, business name, city, phone number, email address, and whatever you choose to tell us in a message.

From a diner using a business's ordering app, on behalf of that business: phone number, name, delivery addresses you save, order history, loyalty balance, and reviews you submit.

We do not collect payment card details. We do not run advertising trackers, and we do not sell or rent personal data to anyone, in any circumstance.

Why we hold it

To place, prepare, track and deliver an order you asked for.
To operate a loyalty programme you chose to join.
To send you order updates on the channel you agreed to.
To answer an enquiry you sent us.
To keep an audit record of changes, which is also how disputes get settled.

Consent is asked for separately for each purpose. Nothing is pre-ticked and nothing is bundled. You can withdraw consent for any purpose without losing the others.

Where it lives

On managed infrastructure in Mumbai (ap-south-1). Data is encrypted in transit and at rest. Backups are taken nightly, retained for 30 days, and periodically restored to confirm they actually work.

Who can see it

Isolation between businesses is enforced in the database itself, not in application code, and the default policy is to deny. Within a business, staff see only what their role needs: a kitchen screen carries no customer name, phone number or address.

We share data only with the processors needed to run the service (hosting, database, messaging and delivery providers), each under contract, and with authorities where the law requires it.

How long we keep it

Enquiries: 24 months from your last contact with us.
Order and loyalty records: for as long as the business is our customer, then 90 days.
Audit logs: 12 months.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask us to:

tell you what data we hold about you and who it has been shared with;
correct or complete anything inaccurate;
erase data we no longer need;
withdraw a consent you gave;
nominate someone to exercise these rights if you cannot.

Write to hello@retova.in and we will respond within 30 days. If the data belongs to a business's ordering app, we will pass the request to that business and help them answer it.

Children

Our products are not directed at children under 18, and we do not knowingly process a child's personal data. If you believe we have, tell us and we will delete it.

Breaches

If personal data is compromised, we will notify affected businesses fast enough for them to meet their own reporting obligations, and we will notify the Data Protection Board as required.

Changes

If this policy changes materially, we will update the date above and tell existing customers directly. Continuing to use the service after a change means you accept it.

Grievance officer

[GRIEVANCE OFFICER NAME]
[LEGAL ENTITY NAME], [REGISTERED ADDRESS]
hello@retova.in · +91 86573 33852

Privacy policy