Privacy Notice & Data Rights
This Privacy Notice governs personal data processing across BrewPluse’s cloud POS, QR table ordering, kitchen display systems, and marketing websites. We follow strict data minimisation and empower you with full control under India’s Digital Personal Data Protection framework.
BrewPluse has engineered its architecture to strictly adhere to the requirements of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. Provisions dependent on the formal appointment and operational notification of the Data Protection Board of India (DPBI) or Significant Data Fiduciary classifications will take operational effect in harmony with official statutory gazette schedules.
1. Itemised Personal Data & Purpose Specification
In accordance with Section 5 of the DPDP Act, the table below provides an itemised breakdown of every personal data category collected by BrewPluse, the exact purpose for collection, necessity status, and lawful basis.
| Processing Activity | Personal Data Categories | Purpose of Processing | Type | Lawful Basis |
|---|---|---|---|---|
| Account Registration, Google OAuth & Authentication |
| Authenticate cafe operators, issue session credentials, and grant access to cafe POS dashboard. | Required | CONTRACT PERFORMANCE |
| Cafe Storefront, Menu & POS Terminal Operations |
| Operate the cafe point-of-sale, digital menu, staff ordering, and kitchen display queues. | Required | CONTRACT PERFORMANCE |
| Dine-in, QR Table & Counter Order Processing |
| Fulfill food orders, display tickets on Kitchen Display System (KDS), and generate bills. | Required | CONTRACT PERFORMANCE |
| Payment Reconciliation & Hardware Billing |
| Facilitate thermal printer hardware purchases, online settlement references, and tax invoices. | Required | LEGAL OBLIGATION |
| Customer Inquiries, WhatsApp Support & Grievance Redressal |
| Answer onboarding questions, diagnose thermal printer compatibility, and resolve privacy requests. | Required | LEGITIMATE USE |
| Website Telemetry & Landing Page Analytics |
| Analyze aggregated traffic to optimize landing page performance and feature discovery. | Optional (Consent) | EXPLICIT CONSENT |
| Promotional Emails, New Feature Releases & POS Updates |
| Send newsletter updates, product tips, and promotional hardware discounts. | Optional (Consent) | EXPLICIT CONSENT |
| Bot Defense, Anti-Abuse & System Security |
| Protect BrewPluse infrastructure against DDoS attacks, brute force authentication, and data scrapers. | Required | LEGITIMATE USE |
| DPDP Consent Verification & Compliance Audit Trail |
| Maintain immutable proof of consent granting, withdrawal, and data rights execution under Section 6 of DPDP Act. | Required | LEGAL OBLIGATION |
2. Identity of the Data Fiduciary
The Data Fiduciary determining the purpose and means of processing personal data across BrewPluse websites and SaaS platforms is:
3. Third-Party Data Processors & Service Partners
BrewPluse engages select, reputable third-party infrastructure providers to deliver high-availability cloud computing and payment services under strict confidentiality and data protection obligations:
Hosts our edge compute workers, SQL D1 database, and web application firewall with end-to-end TLS 1.3 encryption.
Provides OIDC authentication. We only request basic public profile and email address. We never request Google Drive or contacts access.
Processes billing settlements and hardware orders. BrewPluse does NOT store complete card CVVs, bank passwords, or UPI PINs.
Used strictly on the marketing landing page and gated behind your explicit cookie consent. IP anonymization is enforced.
4. Data Retention & Disposal Schedules
In compliance with Section 8(7) of the DPDP Act 2023, BrewPluse erases personal data upon withdrawal of consent or as soon as the purpose for which it was collected has been achieved, unless retention is mandated under statutory law:
shield_person5. Rights of Data Principals under DPDP Act, 2023
As a Data Principal in India, you possess defined legal rights under Chapter III of the DPDP Act:
Right to Access Summary of Personal Data (Sec. 11)
You have the right to obtain a summary of personal data being processed, identities of all data fiduciaries/processors with whom data has been shared, and any other relevant processing details.
Right to Correction & Erasure (Sec. 12)
You have the right to request the correction of inaccurate or misleading personal data, completion of incomplete data, updating of records, and erasure of personal data that is no longer necessary.
Right of Grievance Redressal (Sec. 13)
You have the right to have readily available means of grievance redressal provided by BrewPluse in respect of any act or omission regarding personal data obligations.
Right to Nominate (Sec. 14)
You have the right to nominate an individual who shall, in the event of your death or incapacity, exercise your data rights in accordance with statutory procedures.
6. Children’s Personal Data Protection (Sec. 9)
BrewPluse is a commercial SaaS operating platform intended solely for cafe and restaurant business operators aged 18 and above. BrewPluse does not deliberately collect, track, profile, or target advertisements at minors. If you believe personal data of an individual under 18 has been submitted without lawful parental consent, please contact our Grievance Officer immediately for prompt erasure.
7. Cookies & Tracking Technologies
We categorize cookies into Strictly Necessary (essential for authentication and system security) and Optional (Analytics and Marketing). You may accept, reject, or customize optional cookies anytime through our preference center.
| Cookie Name | Category | Purpose | Duration | Consent Required |
|---|---|---|---|---|
| cf_session / cf_auth | NECESSARY | Maintains secure server-side authenticated user session for store dashboard and POS. | Session / 30 days | No (Essential) |
| __cf_bm / cf_clearance | NECESSARY | Cloudflare bot management, DDoS mitigation, and firewall challenge clearance. | 30 minutes to 1 year | No (Essential) |
| brewpluse_consent_preferences | NECESSARY | Stores user's privacy choices (necessary, analytics, marketing) to respect consent. | 180 days (6 months) | No (Essential) |
| brewpluse_ui_theme | FUNCTIONAL | Remembers UI preference such as collapsed navigation or high-contrast POS counter mode. | 1 year | No (Essential) |
| _ga | ANALYTICS | Distinguishes unique users and measures aggregate landing page engagement anonymously. | 2 years (or 14 months) | Yes (Optional) |
| _ga_Y9RW5966VW | ANALYTICS | Persists session state and interaction telemetry for Google Analytics 4 stream. | 2 years | Yes (Optional) |
| _gid | ANALYTICS | Counts and tracks pageviews on a daily basis. | 24 hours | Yes (Optional) |
| __gads / __gpi | MARKETING | Measures ad performance, prevents ad fraud, and limits ad repetition. | 13 months | Yes (Optional) |
| IDE / DSID | MARKETING | Used to deliver relevant contextual or targeted promotions if marketing consent is granted. | 1 year | Yes (Optional) |
8. Grievance Redressal Mechanism & Contact
In accordance with Section 13 of the DPDP Act 2023, any grievance regarding personal data processing may be addressed to our designated Grievance Officer: