This policy explains how Retova, a sole proprietorship of Hussain Trawadi based in Mumbai, India (“Retova”, “we”, “us”), handles personal data through retova.in, the apps and ordering pages we run for our business customers, and the messages we send and receive, including on WhatsApp.

Who we are

Business: Retova, a sole proprietorship of Hussain Trawadi
Udyam (MSME) registration: UDYAM-MH-18-0596238
Based in: Mumbai, Maharashtra, India
Email: hello@retova.in
Phone and WhatsApp: +91 86573 33852
Website: retova.in

Two different roles

This distinction matters, because it decides who is answerable to you.

For our website, our own enquiries and the businesses that buy from us, we are the Data Fiduciary. We decide what is collected and why.
For customers of a restaurant or café that uses Retova, that business is the Data Fiduciary and we are its Data Processor. We hold the data on its instruction and do not use it for our own purposes. Each business also publishes its own privacy policy on its ordering page.

What we collect

From a business enquiring with us or buying from us: name, business name, city, phone number, email address, the details of the outlet we set up, staff login names and emails, billing records, and whatever you choose to tell us in a message or call.

From a customer of a business using Retova, on that business's behalf: phone number (verified with a one-time code), name, email if given, delivery addresses you save, order and bill history, rewards balance, table or seat, reviews and feedback you submit, and, only if you allow it when placing an order, your device's location, used to confirm you are at the outlet.

When you message us or a business on WhatsApp: your WhatsApp phone number, your WhatsApp profile name, the messages you send and their delivery status.

Technical data: IP address, browser and device type, and the notification token your device gives us if you turn on order notifications. Sign-in pages run Cloudflare Turnstile, which checks that a visitor is a person and not a bot.

We do not collect or store payment card or bank details: payments go through the payment provider's own pages, and we receive only whether a payment succeeded. We do not run advertising trackers or advertising cookies on retova.in, and we do not sell or rent personal data to anyone, in any circumstance.

Why we use it

To place, prepare, bill, track and deliver an order you asked for.
To sign you in and keep your account secure, including stopping automated sign-in attempts.
To run a rewards programme you chose to join.
To send order updates, sign-in codes and replies on the channel you used or agreed to.
To answer an enquiry, set up and support a business account, and bill for it.
To keep an audit record of changes, which is also how disputes get settled.
To meet legal duties, such as tax records.

Where we rely on consent, it is asked for separately for each purpose. Nothing is pre-ticked and nothing is bundled. You can withdraw consent for any purpose without losing the others.

WhatsApp messages

We use the WhatsApp Business Platform, provided by Meta Platforms, to talk to businesses that enquire with us and, where a business has switched it on, to send that business's customers order updates, bills and replies.

We message you only after you have contacted us or given your number and agreed to updates. Promotional messages are sent only to people who have opted in to them.
Reply STOP at any time and we will not message you again on WhatsApp, other than to confirm that you have opted out.
Messages pass through Meta's systems and are also subject to WhatsApp's privacy policy. We do not share your data with Meta for advertising.
We keep WhatsApp conversations only as long as we need them to serve you, within the periods below.

Where it lives

Our database is on managed infrastructure in Mumbai (ap-south-1). Data is encrypted in transit and at rest. Backups are taken nightly, retained for 30 days, and periodically restored to confirm they actually work. Some of the providers below run global networks, so data may pass through servers outside India on its way; they are bound by contract to protect it.

Who can see it

Isolation between businesses is enforced in the database itself, not in application code, and the default policy is to deny. Within a business, staff see only what their role needs: a kitchen screen carries no customer name, phone number or address.

We share data only with the service providers needed to run Retova, each under contract and only for that job:

Supabase: database, sign-in and file storage (Mumbai region).
Cloudflare: website and app hosting, network security and the Turnstile person check.
MSG91: text messages carrying sign-in codes.
Meta Platforms (WhatsApp Business Platform): WhatsApp messages.
Resend: emails such as password resets and booking confirmations.
Cashfree and Razorpay: online payments, where the business uses them.
Google Play and the Apple App Store: distributing a business's app.

We also disclose data to authorities where Indian law requires it.

Cookies and storage

retova.in sets no advertising or analytics cookies. Our apps store your sign-in session and your basket on your own device so they keep working between visits; clearing the app's data or signing out removes them.

How long we keep it

Enquiries and WhatsApp conversations with us: 24 months from your last contact.
Order and rewards records: for as long as the business is our customer, then 90 days.
Bills and tax records: as long as Indian tax law requires the business to keep them, with your personal details removed if you ask for deletion.
Audit logs: 12 months.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask us to:

tell you what data we hold about you and who it has been shared with;
correct or complete anything inaccurate;
erase your data (see how to delete your data);
withdraw a consent you gave;
nominate someone to exercise these rights if you cannot;
complain to our grievance officer below, and then to the Data Protection Board of India.

Write to hello@retova.in and we will respond within 30 days. If the data belongs to a business's ordering app, we will pass the request to that business and help them answer it.

Children

Our products are not directed at children under 18, and we do not knowingly process a child's personal data. If you believe we have, tell us and we will delete it.

Security and breaches

Access to personal data is limited to the people who need it, sign-ins are protected against automated attempts, and our own administrator accounts use two-step sign-in. If personal data is compromised, we will notify affected businesses fast enough for them to meet their own reporting obligations, and we will notify the Data Protection Board as required.

Changes

If this policy changes materially, we will update the date above and tell existing customers directly. Continuing to use the service after a change means you accept it.

Grievance officer

Hussain Trawadi, Proprietor
Retova, Mumbai, Maharashtra, India
hello@retova.in · +91 86573 33852

Privacy policy