Privacy Policy

Your account. Your name and mobile number, and an email address if you give one. Your password is stored only in encrypted (hashed) form. We send a one-time code by SMS to check your number.

Orders and payments. What you order, from which cafe, when, and how you paid; your meal plans and wallet balance. Online payments are handled by Razorpay: we never see or store your card, UPI or bank details, only the payment reference and whether it succeeded.

Delivery addresses and location. The addresses you save, with their position on the map, so we can deliver and choose the nearest cafe. If you tap "use my location", your phone's location is read once to fill in the address. We do not track your location in the background.

Health and nutrition (optional). If you fill in your health profile or use nutrition tracking: height, weight and weight log, goals, activity level, dietary preferences, allergies and notes, and the meals you mark as eaten. We use these only to work out your nutrition targets, show your progress and prepare your meal plan. You can leave them blank.

Notifications. If you turn notifications on, a notification token for your device, so we can send order updates and, if you allow them, offers and news.

WhatsApp. If you message our WhatsApp number or get order updates there, your number and those messages.

Technical information. Error reports and basic usage information (pages visited, device and browser type, and on a small share of visits a recording of what happened on the page) so we can find and fix problems. Passwords and payment details are not included.

The Android app asks for a permission only when a feature needs it, and you can refuse or turn it off in your phone's settings:

• Notifications: order updates, and the new-order alarm on staff phones.
• Location: to fill in a delivery address from where you are.
• Camera and photos: only when you choose to add a photo.
• SMS code: with your OK each time, the app reads only the sign-in code from the one SMS we sent. It cannot read your other messages.
• Nearby devices (Bluetooth): for cafe staff, to print bills and kitchen tickets on Bluetooth printers. It is not used to find your location.
• Alarms, Do Not Disturb and battery: on staff phones, so a new order rings even when the phone is on silent or the app is closed.

• To take, prepare, deliver and bill your orders and meal plans, and to handle refunds.
• To sign you in and keep your account secure.
• To send order updates, and offers and news if you have not turned them off.
• To answer your questions, including on WhatsApp.
• To keep our records as the law requires, such as GST bills.
• To find and fix problems and improve the service.

Our staff see what they need for their job: the kitchen sees your order, the delivery person sees your name, number and address for that delivery, and the cafe sees allergies and dietary notes for meal plans it prepares.

We share information only with the companies that run parts of our service for us, and only what they need:

• Supabase: our database and sign-in, including sending SMS codes.
• Vercel: website hosting and anonymous visit statistics.
• Razorpay: online payments and refunds.
• Google: maps for addresses, and Firebase to deliver app notifications.
• Meta (WhatsApp): WhatsApp messages and order updates.
• OpenRouter and the AI model it uses: messages you send to our WhatsApp assistant, so it can reply.
• Sentry: error reports.

Some of these companies store data outside India. We may also share information if the law requires it or to protect our customers, staff or business.

We keep your account information while your account is open. Error logs are deleted after 90 days and notification history and WhatsApp messages after 180 days. Bills and payment records are kept for as long as tax and accounting law requires, even after an account is deleted.

• You can see and change your name, addresses and health profile in the app, under Profile.
• You can turn off notifications, or just offers and news, in the app or in your phone's settings.
• To get a copy of your information, correct it, or delete your account, email info@fitbitescafe.com from your email address or write to us on WhatsApp from your registered number, saying what you would like. We will confirm it is you and complete the request within 30 days. Deleting your account removes your profile, addresses, health and nutrition information and saved notifications; bills we must keep by law stay, without your health information.

Your information travels over encrypted connections (HTTPS), access to it is limited by role, and payment details stay with Razorpay. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you, as the law requires.

Our service is meant for adults. Anyone under 18 should use it with a parent or guardian, who can contact us to see or delete their information.

If we change this policy, we will update this page and the date at the top, and tell you in the app if the change is significant.

Questions or requests about your information: info@fitbitescafe.com · Fit Bites Café, Manjeri, Kerala, India.