2. Privacy Policy

This Privacy Policy explains how Wephoton ("we") processes your personal data when you use Dawingo Resto. It is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

## 2.1 Roles

- For your Platform account, order records, and Platform analytics, **Wephoton is the Data Fiduciary**.
- The Restaurant you order from also receives your order details (items, table, name if provided, contact details where applicable) to fulfil your order. For its own use of that data (e.g., its customer relationships), the **Restaurant is an independent Data Fiduciary**, responsible for its own compliance.

## 2.2 What we collect

| Category | Data | Source |
|---|---|---|
| Identity & contact | Mobile number (verified by OTP), name (optional) | You |
| Order data | Items ordered, table and outlet, order value, timestamps, order status history, special instructions | You / Restaurant systems |
| Payment data | Payment status, transaction reference, amount, payment method type | Payment gateway. **We never receive or store your full card number, CVV, UPI PIN, or banking passwords.** Card payments are handled on the payment aggregator's PCI-DSS-compliant hosted checkout. |
| Ratings & reviews | Ratings and review text you submit, linked to your order | You |
| Device & usage | Device identifier cookie, session cookie, IP address, browser type, pages viewed, approximate coarse location inferred from the QR/table you scanned | Automatic |
| Notifications | Web push subscription token (only if you opt in) | You |

We do not collect biometric, financial account, health, or precise GPS location data.

## 2.3 Why we process it (purpose & lawful basis)

| Purpose | Basis under DPDP Act |
|---|---|
| Creating your account and verifying your mobile number via OTP | Consent |
| Transmitting your order to the Restaurant and showing live status | Consent / performance of the service you requested |
| Processing payments and issuing refunds | Consent; legal obligations (payment and tax laws) |
| Sending transactional SMS/email/push about your order and payments | Consent / legitimate use for the service requested |
| Publishing your ratings and reviews | Consent |
| Fraud prevention, security, rate limiting, abuse blocking | Legitimate use · protecting the Platform and its users |
| Complying with law (tax, CERT-In directions, court orders) | Legal obligation |
| Promotional communications, if any | Separate opt-in consent only; withdraw any time |

We do not sell your personal data. We do not use your data for third-party advertising or cross-site behavioural profiling.

## 2.4 Who we share it with

- **The Restaurant you order from** · order details necessary for fulfilment and service.
- **Payment aggregator engaged by the Restaurant (one of PhonePe Private Limited, PayU Payments Private Limited, or Cashfree Payments India Private Limited)** · to process payments and refunds.
- **SMS provider (MSG91)** · to deliver OTPs and transactional SMS.
- **Email provider (Resend)** · to deliver transactional emails, where applicable.
- **Hosting provider** · the Platform runs on Wephoton-managed servers provisioned with **[VPS PROVIDER, REGION]**.
- **Law enforcement or regulators** · where required by applicable law or valid legal process.

Analytics and error monitoring are **self-hosted and operated by Wephoton** · no analytics or error data is shared with any third party. We share only what each recipient above needs, and recipients acting on our behalf are bound by contracts requiring them to protect your data.

## 2.5 Where your data is stored

Your data is stored on Wephoton-managed servers provisioned with [VPS PROVIDER, REGION]. Some service providers listed above may process limited data (e.g., SMS delivery logs) in their own regions. Any cross-border processing is carried out in accordance with the DPDP Act; we do not transfer personal data to any country restricted by the Central Government.

## 2.6 How long we keep it

| Data | Retention |
|---|---|
| Account (mobile number, name) | Until you delete your account, plus **30 days** for backup rotation |
| Order and payment records | **8 years** from the transaction (tax and accounting law requirements), after which deleted or anonymised |
| OTP codes | Minutes · expired and discarded immediately after verification |
| Ratings/reviews | Until you delete them or your account |
| Server and security logs | Minimum **180 days** (CERT-In Directions, 2022) |
| Push subscription | Until you disable notifications or your browser revokes the token |

## 2.7 Your rights (DPDP Act)

You have the right to:

1. **Access** · obtain a summary of the personal data we hold about you and the processing activities;
2. **Correction and erasure** · correct inaccurate data and request deletion of data no longer required (order/payment records must be retained for the statutory periods above);
3. **Withdraw consent** · at any time, with effect for future processing; this may disable OTP login and ordering features;
4. **Grievance redressal** · see the Grievance Redressal Policy below;
5. **Nominate** · nominate a person to exercise your rights in case of death or incapacity.

To exercise any right, email **support@wephoton.in** from your registered details or use the in-app options. We respond within the timelines prescribed under the DPDP Act and rules.

## 2.8 Security

We use HTTPS/TLS encryption in transit, encrypted storage, hashed credentials, role-based access controls, row-level security isolating each restaurant's data, rate limiting, and audit logging. Payment card data never touches our servers. No system is perfectly secure; report suspected vulnerabilities to **support@wephoton.in**.

## 2.9 Data breach

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required under the DPDP Act, and report cyber security incidents to CERT-In within the mandated timelines.

## 2.10 Children

The Platform is not directed at children. We do not knowingly process children's personal data for tracking, behavioural monitoring, or targeted advertising. A parent or guardian who believes a child's data was collected without consent may contact the Grievance Officer for erasure.

## 2.11 Changes

We will post any changes here with a new effective date and, for material changes, notify you on the Platform. Prior versions are archived and available on request.

---