Privacy Policy

1. Who This Policy Applies To

This Privacy Policy applies to:

• Business owners and staff who use the Service to manage their food business
• Visitors to samruddhi.app
• End-customers who order food through businesses using the Service (where we receive their personal information)

If you are a business using the Service, this policy applies to your personal information. The personal information of your end-customers (people ordering food from you) is processed by us on your behalf — you are the controller of that data, and you must have your own privacy policy informing your customers how it is used.

2. Information We Collect

We collect the following types of personal information:

2.1 Account Information

When you create an account, we collect:

• Your name and business name
• Email address and phone number
• Business address and contact details
• Password (stored encrypted)
• Payment details (processed by Stripe; we do not store full card numbers)

2.2 Usage Information

When you use the Service, we automatically collect:

• IP address
• Browser type and device information
• Pages visited and features used
• Date and time of access
• Referring website

2.3 Business Data

When you use the Service for your business, we process the data you enter:

• Menu items, prices, product descriptions
• Order history and transaction records
• Your end-customers' details (names, emails, phone numbers, order history) — processed on your behalf
• Staff accounts and access logs

2.4 Communications

When you contact us, we collect the content of your communications and any information you provide.

3. How We Collect Information

We collect personal information:

• Directly from you when you sign up, contact us, or use the Service
• Automatically through cookies and similar technologies when you use the Service
• From third-party services you connect to the Service (e.g. Stripe for payments)

4. Why We Collect and Use Your Information

We use personal information to:

• (a) Provide, operate, and improve the Service
• (b) Process subscriptions and payments
• (c) Communicate with you about the Service (updates, support, billing)
• (d) Send you marketing communications (which you can opt out of at any time)
• (e) Detect and prevent fraud, abuse, and security incidents
• (f) Comply with legal obligations
• (g) Enforce our Terms of Service

5. Legal Basis for Processing

Under the Privacy Act 2020, we process personal information on the basis of:

• Your consent, which you give by signing up for and using the Service
• Performance of a contract with you (to provide the Service)
• Legitimate business interests (such as fraud prevention, improving the Service)
• Legal obligations (such as tax records, responding to lawful requests)

6. Cookies and Tracking

The Service uses cookies and similar technologies to:

• Keep you logged in
• Remember your preferences
• Analyse Service usage
• Improve security

You can control cookies through your browser settings. Disabling cookies may affect Service functionality.

7. Sharing Your Information

We share personal information only as described below. We do not sell your personal information.

7.1 Service Providers

We share personal information with third parties who help us provide the Service, including:

• Stripe (payment processing) — stripe.com/privacy
• Hosting and cloud infrastructure providers
• Email and SMS delivery services
• Analytics providers

These providers are bound by contract to use your information only to provide their services to us.

7.2 Legal Requirements

We may disclose personal information if required by law, court order, or regulatory authority, or to protect our rights and the safety of others.

7.3 Business Transfers

If we are acquired by or merged with another company, your information may be transferred to the new owner, subject to this Privacy Policy.

7.4 Aggregated and Anonymised Data

We may share aggregated, anonymised data that does not identify individuals (such as overall usage statistics) for any purpose.

8. Data Storage and International Transfers

8.1 We store personal information on secure servers, which may be located in New Zealand, Australia, the United States, or other countries where our service providers operate.

8.2 When personal information is transferred outside New Zealand, we take reasonable steps to ensure it is protected to a standard comparable to the Privacy Act 2020.

9. Data Security

9.1 We implement reasonable technical and organisational measures to protect personal information from unauthorised access, use, disclosure, alteration, or destruction, including:

• Encryption in transit (HTTPS) and at rest
• Access controls and authentication
• Regular security reviews
• Staff training on data handling

9.2 No system is completely secure. While we work hard to protect your information, we cannot guarantee absolute security.

9.3 If we become aware of a privacy breach that has caused or is likely to cause serious harm, we will notify you and the Office of the Privacy Commissioner as required by law.

10. Data Retention

10.1 We retain personal information for as long as your account is active or as needed to provide the Service.

10.2 If you cancel your account, we will retain Your Content for up to 30 days to allow you to export it. After 30 days, we may delete it from active systems, subject to:

• Legal requirements (e.g. tax records — held for at least 7 years)
• Backup retention cycles (deleted from backups within 90 days)

10.3 You may request earlier deletion by contacting us.

11. Your Rights

Under the Privacy Act 2020, you have the right to:

• (a) Access the personal information we hold about you
• (b) Correct any inaccurate personal information
• (c) Request deletion of your personal information (subject to legal requirements)
• (d) Withdraw consent for processing (which may affect your ability to use the Service)
• (e) Object to certain processing activities
• (f) Complain to the Office of the Privacy Commissioner (privacy.org.nz)

To exercise any of these rights, contact us at support@samruddhi.app. We will respond within 20 working days.

12. Children

The Service is not intended for use by individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will delete it.

13. Marketing Communications

13.1 We may send you marketing communications about the Service and related offerings.

13.2 You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, or by contacting us.

13.3 We will still send you transactional emails (account notifications, billing, service updates) even if you opt out of marketing, as these are necessary to provide the Service.

14. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to review their privacy policies before sharing personal information.

15. Changes to This Policy

15.1 We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and/or by posting a notice in the Service at least 14 days before the changes take effect.

15.2 The "Last updated" date at the top of this policy indicates when it was last revised.

16. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us: