Skip to content
VisitBite

Privacy policy

Last updated: 3 November 2026

This policy explains what personal data VisitBite handles, why, and the choices you have. We follow the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it. If anything here is unclear, write to hello@visitbite.app.

1. Who this policy covers

  • Businesses that sign up for VisitBite (restaurants, cafés, salons, shops and others) and their staff who log in to the dashboard.
  • Customers of those businesses who order at a table or join a business's loyalty programme.

For a business's own customer list and loyalty records, the business decides why the data is collected and is the Data Fiduciary. VisitBite processes that data on the business's behalf as a Data Processor. For staff accounts and our own website, VisitBite is the Data Fiduciary.

2. What we collect

  • Phone number and OTP. Customers log in to loyalty with a 10-digit mobile number and a one-time password sent by SMS. We store the number and a one-way hash of each OTP, which expires after 5 minutes. We never store the OTP itself.
  • Name, if a customer chooses to give it.
  • Loyalty data per business: the businesses you joined, stamps, coins, visits, rewards redeemed, scratch cards and referral codes. Each business sees only the data for its own programme. It cannot see your activity at other businesses.
  • Location, only when a business has turned on GPS check-in and you tap Check in. Your browser asks for permission first. We use it to confirm you are near the shop and keep it with that visit record.
  • Orders and bills placed through QR table ordering. Ordering does not need a phone number.
  • Business and staff accounts: business name, address, GSTIN if provided, staff names, email addresses and roles.
  • Technical data: IP address, browser type and logs needed to keep the service secure and working.

3. Why we use it

  • To run ordering, billing and loyalty: add stamps and coins, issue reward codes and prevent misuse such as duplicate scans.
  • To log you in and keep your account secure.
  • To show businesses reports about their own programme, such as visits and repeat customers.
  • To meet legal duties, such as GST record-keeping by the business.

We do not sell personal data. We do not send marketing messages to customers. A business may ask for your consent to contact you; you can withdraw it at any time.

4. Payments

Online payments are handled by Razorpay, which acts as an independent payment processor. Card, UPI and bank details are entered on Razorpay's secure checkout and are not stored by VisitBite. We receive only the payment status and a reference number. Razorpay's own privacy policy applies to the data it processes.

5. Cookies

We use only essential cookies: a session cookie for staff, a session cookie for loyalty customers (valid up to 90 days) and a table session cookie for ordering. They are needed for the service to work, so there is no opt-out banner. We do not use advertising or third-party tracking cookies. Your browser may also store small preferences, such as your cart, on your device.

6. Who we share data with

  • The business whose programme you joined or where you placed an order.
  • Service providers who help us run VisitBite, such as cloud hosting, SMS delivery and Razorpay, under contracts that limit how they may use the data.
  • Authorities, when the law requires it.

7. How long we keep it

We keep loyalty and account data while the business uses VisitBite. When a business closes its account, we delete or anonymise its customer data within 90 days, except records the law requires us or the business to keep, such as tax invoices. OTP records are deleted shortly after they expire.

8. Your rights

Under the DPDP Act you can ask to:

  • see a summary of the personal data held about you;
  • correct or update it;
  • erase it, where it is no longer needed or you withdraw consent;
  • nominate someone to act for you; and
  • raise a grievance.

For data held by a particular business, you can contact that business, or write to us and we will pass your request on and help them respond. You may also complain to the Data Protection Board of India.

9. Security

We use encrypted connections, hashed OTPs and session tokens, access controls so that each business sees only its own data, and an audit trail for loyalty changes. No system is perfectly secure; if a breach affects your data we will inform you and the Board as the law requires.

10. Children

VisitBite is not meant for children under 18 to join loyalty programmes. If you believe a child has joined, contact us and we will remove the data.

11. Grievance officer and changes

Write to our grievance officer at hello@visitbite.app. We aim to respond within 30 days. If we change this policy we will update the date above and, for important changes, tell businesses by email. See also our terms and conditions.