Privacy Policy

Keystonne OS ("we", "us") is restaurant management software operated from India. This policy explains what personal data we handle when you use https://os.keystonne.in and the Keystonne OS marketing site, why we handle it, and the rights the Digital Personal Data Protection Act, 2023 ("DPDP Act") gives you.

It is written to be read. If anything here is unclear, write to us at the address in Contact below and we will answer in plain language.

What we collect, and why

Your account. Your email address and password hash (or your Google account's email, if you sign in with Google), and the language you choose. We use these to sign you in and to speak to you in your language. Legal basis: performing the service you signed up for.

Your business. The business name, outlet address, GSTIN, FSSAI licence, PAN and registration type you enter at onboarding or in settings. These print on the tax documents the product exists to produce. They are business identifiers, but where a proprietor's PAN identifies a person, we treat it with the same care as personal data.

Your team. Names, phone numbers, roles and PINs (hashed) of staff you add. You are responsible for telling your team their details are stored here.

Your customers. Names and phone numbers you or your staff enter — for credit (house-account) records, loyalty, or receipts — and the order history attached to them. You are the data fiduciary for your customers' data; we process it on your instructions. We never sell it, never use it to advertise, and never contact your customers except to deliver something you asked us to send (an e-bill link, for example).

Operational records. Orders, bills, payments, stock movements and the double-entry journal derived from them. These are business records, retained because tax law expects them to be.

Support and demo requests. If you fill the contact form we collect the name, phone number and city you give us, solely to respond to you.

Where it lives

Your data is stored in a Supabase-managed PostgreSQL database in the ap-south-1 (Mumbai) region, with every table isolated per business by row-level security. The application runs on Vercel. Transactional email (sign-in and notifications) is delivered through Resend.

AI features. When you use an AI surface (the copilot, dish planner, voice entry), the text needed to answer — your question, dish names, your ingredient list — is sent to Anthropic's API to generate the reply. Model outputs never write to your data without your explicit approval, and AI features are optional: the product works with them off.

We do not sell personal data to anyone, and we do not use your business's data to train AI models.

How long we keep it

Your operational records are kept for as long as you have an account, because they are your books. If you close your account we delete your tenant's data after a winding-down period, except where Indian law requires longer retention of specific records. You can ask for deletion sooner at the contact below.

Your rights

Under the DPDP Act you can ask us, at the address below, to:

• tell you what personal data of yours we hold,
• correct or complete it,
• erase it, where the law does not require us to keep it,
• and raise a grievance, which we will answer within the timelines the Act sets.

If you are a customer of a restaurant that uses Keystonne OS, your first stop is that restaurant — they control what was entered about you. We will help them honour your request.

Cookies

The app uses cookies only to keep you signed in and to remember your language. The marketing site sets no advertising or cross-site tracking cookies.

Children

Keystonne OS is a business tool and is not directed at children. We do not knowingly collect children's data.

Changes

When this policy changes we will update the date above and, for material changes, tell you in the app before they take effect.

Contact

Keystonne OS — Grievance / Data Protection contact Email: support@keystonne.in

We answer privacy mail with priority.