Privacy Policy

Gustara ("we", "us") operates the gustara.app platform and related services. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our platform.

This policy is aligned with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDPA).

Information you provide directly

• Account information: Name, phone number, email address when you create an account.
• Delivery addresses: Saved addresses for order delivery.
• Order details: Items ordered, special instructions, order history.
• Payment information: Payment method selection. We do not store your card numbers, UPI IDs, or bank details directly. Payment processing is handled by PCI-DSS compliant third-party gateways (e.g., Razorpay, Cashfree).
• Communications: Messages or feedback you send through customer support.

Information collected automatically

• Device information: Browser type, operating system, device model.
• Usage data: Pages visited, features used, time spent on the platform.
• Location data: Approximate location based on IP address or, with your permission, precise GPS location for delivery and restaurant discovery.
• Cookies and similar technologies: See our Cookie section below for details.

We use your information for the following purposes:

• Order fulfillment: Processing your orders, coordinating with restaurants and delivery partners, sending order updates.
• Account management: Maintaining your account, saving preferences, and providing customer support.
• Platform improvement: Analyzing usage patterns to improve the ordering experience, fix bugs, and develop new features.
• Communication: Sending order confirmations, delivery updates (via WhatsApp, SMS, or email), and responding to your queries.
• Safety and security: Detecting fraud, preventing misuse, and ensuring platform security.

We do not sell your personal data. We do not use your data for unrelated advertising or share it for third-party marketing purposes.

We share your information only when necessary to fulfill your orders or operate the platform:

• Restaurants: When you place an order, the restaurant receives your name, delivery address, phone number, and order details to prepare and confirm your food. Restaurants on Gustara own their customer relationships and may use this data in accordance with their own privacy practices.
• Delivery partners: Your name, phone number, and delivery address are shared with the assigned rider for delivery coordination.
• Payment processors: Transaction details are shared with our payment gateway partners (Razorpay, Cashfree) to process your payments securely.
• Analytics providers: Anonymized usage data may be shared with analytics tools to help us understand platform usage. This data cannot identify you personally.
• Legal requirements: We may disclose information if required by law, court order, or government regulation, or to protect the rights, property, or safety of Gustara, its users, or the public.

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: Request a summary of the personal data we hold about you and how it is being processed.
• Right to correction: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to withdraw consent: Withdraw your consent for data processing at any time. This may affect our ability to provide certain services.
• Right to grievance redressal: File a complaint with our Grievance Officer or escalate to the Data Protection Board of India.
• Right to nominate: Nominate another person to exercise your data rights in case of your death or incapacity.

To exercise any of these rights, email us at hello@gustara.xyz or visit our Contact page.

We retain your personal data for as long as your account is active or as needed to provide services. After account deletion:

• Personal data is deleted or anonymized within 90 days.
• Transaction records may be retained for up to 8 years as required by Indian tax and financial regulations.
• Anonymized usage data may be retained indefinitely for analytics purposes.

We implement industry-standard security measures to protect your data:

• All data transmitted between your device and our servers is encrypted using TLS/SSL.
• Payment information is processed through PCI-DSS compliant gateways and never stored on our servers.
• Access to personal data is restricted to authorized personnel on a need-to-know basis.
• We conduct regular security reviews and follow secure development practices.

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

We use cookies and similar technologies on the Platform:

• Essential cookies: Required for the platform to function (authentication, session management, cart persistence). These cannot be disabled.
• Analytics cookies: Help us understand how you use the platform so we can improve it. These are anonymized and do not identify you personally.

We do not use advertising or tracking cookies. We do not track you across other websites. You can manage cookie preferences in your browser settings.

Gustara is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a minor, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email (if you have an account) and update the "Last updated" date. We encourage you to review this policy periodically.

If you have concerns about how your data is handled, reach out to us:

For any privacy-related questions or concerns, email hello@gustara.xyz or visit our Contact page.