Privacy Policy

1. Scope of This Privacy Policy

This Privacy Policy applies to:

• Restaurants, bakeries, cafés, hotels and other hospitality businesses using AirMenus (“Merchants”);
• Owners, employees and authorised representatives of Merchants;
• Customers and guests interacting with a Merchant through an AirMenus-powered menu, ordering website, reservation page, loyalty programme, feedback form or communication channel;
• Visitors to the AirMenus website; and
• Individuals who contact AirMenus for sales, support, onboarding or other enquiries.

For personal data collected through an AirMenus-powered service, the relevant Merchant generally determines why and how that data is used. AirMenus processes such data on the Merchant’s behalf to provide the Services.

AirMenus may independently determine how certain information is processed for purposes such as account administration, platform security, billing, legal compliance, service improvement and responding to direct enquiries.

2. Personal Data We May Collect

Depending on how you interact with AirMenus, we may collect or process the following categories of information.

A. Merchant and Account Information

• Name;
• Business name and business category;
• Email address;
• Mobile number;
• Business and outlet addresses;
• Login credentials and account identifiers;
• Role, designation and authorised-user information;
• GST, FSSAI and other business registration information;
• Bank account and settlement information;
• Subscription, invoice and billing details; and
• Documents or information submitted during onboarding, verification or support.

B. Customer and Guest Information

When you interact with a Merchant using AirMenus, we may process:

• Name;
• Mobile number;
• Email address;
• Delivery or billing address;
• Date of birth, where voluntarily provided;
• Order history;
• Reservation and visit details;
• Product or menu preferences;
• Loyalty points, cashback or wallet balance;
• Feedback and ratings;
• Communication and marketing preferences; and
• Any other information voluntarily submitted through the Services.

C. Order, Reservation and Transaction Information

• Products or services ordered;
• Order value and transaction amount;
• Reservation date and time;
• Number of guests;
• Payment status and payment reference number;
• Refund and cancellation details;
• Discounts, offers and loyalty redemptions;
• Delivery instructions; and
• Transaction and invoice records.

Payments may be processed through third-party payment gateways such as Razorpay or other payment-service providers selected by AirMenus or the Merchant.

AirMenus does not ordinarily store complete debit-card details, credit-card details, UPI PINs, internet-banking credentials or other sensitive payment authentication information. Such information is processed directly by the relevant payment provider in accordance with its own terms and privacy policy.

D. Delivery and Location Information

Where delivery services are used, we may process:

• Pickup and delivery addresses;
• Approximate or precise location, where permission has been provided;
• Delivery status and tracking information;
• Rider or delivery-partner details;
• Delivery instructions; and
• Delivery-verification information, including delivery OTPs.

E. Device and Usage Information

When you access our website or Services, we may automatically collect:

• IP address;
• Browser type;
• Device type and operating system;
• Device identifiers;
• Pages or features viewed;
• Date and time of access;
• Referring URLs;
• Session and activity information;
• Cookie identifiers;
• Product-interaction information; and
• Error logs, diagnostic data and performance information.

F. Communications and Support Information

We may retain information provided through:

• Emails;
• Phone calls;
• WhatsApp messages;
• Support tickets;
• Demo and contact forms;
• Feedback submissions; and
• Other communications with AirMenus or a Merchant.

Where permitted by law and appropriately notified, customer-support calls may be recorded for quality assurance, training and dispute-resolution purposes.

3. How We Collect Personal Data

We may collect personal data:

• Directly from you;
• From Merchants using AirMenus;
• When you place an order, make a reservation, join a loyalty programme or submit feedback;
• When you communicate with AirMenus or a Merchant;
• Automatically through cookies and similar technologies;
• Through payment gateways, logistics providers and other integrations;
• From authorised business representatives; and
• From publicly available or legally permitted sources.

Merchants are responsible for ensuring that personal data submitted to AirMenus has been collected lawfully and that all required notices, permissions and consents have been provided.

4. How We Use Personal Data

We may use personal data to:

• Create and manage Merchant accounts;
• Provide, operate and maintain the Services;
• Create and display digital menus and ordering websites;
• Process orders and reservations;
• Facilitate payments, settlements, refunds and invoicing;
• Coordinate deliveries through third-party logistics providers;
• Manage loyalty programmes, cashback wallets and rewards;
• Enable customer-relationship management and customer segmentation;
• Send order, reservation, payment, delivery and loyalty-related communications;
• Send promotional communications where appropriate consent or lawful authorisation has been obtained;
• Provide customer support and resolve complaints;
• Verify identities, accounts and business information;
• Detect and prevent fraud, misuse and security incidents;
• Analyse performance and improve our products and Services;
• Develop new features and functionality;
• Prepare aggregated reports and business insights;
• Enforce our agreements and protect our legal rights;
• Comply with legal, tax, regulatory and accounting requirements; and
• Fulfil any other purpose communicated at the time the information is collected.

We may use aggregated or anonymised information for analytics, reporting, product improvement and business planning. Such information will not identify an individual.

5. Consent and Lawful Processing

Where consent is required, we will request it through a clear affirmative action. You may withdraw your consent at any time using the method communicated at the time of collection or by contacting us.

Withdrawal of consent will not affect processing already carried out lawfully before the withdrawal. It may, however, limit our ability to provide Services that require the relevant information.

We may also process personal data where such processing is necessary to:

• Provide a service requested by you;
• Perform our obligations under a contract;
• Comply with applicable law;
• Respond to emergencies or protect an individual’s vital interests;
• Prevent fraud, misuse or security threats; or
• Carry out other uses permitted under applicable law.

6. How We Share Personal Data

We may share personal data where reasonably necessary to provide the Services, comply with applicable law or protect legitimate interests.

Personal data may be shared with the following parties:

A. Merchants

Customer and guest information collected through a Merchant’s AirMenus-powered service may be made available to that Merchant.

The Merchant’s use of this information is governed by its own privacy practices, customer notices and applicable law.

B. Payment-Service Providers

Transaction-related information may be shared with payment gateways, banks, settlement partners and other financial-service providers to process payments, refunds and settlements.

C. Logistics and Delivery Providers

Delivery information may be shared with logistics providers, delivery partners and riders to fulfil and track orders.

D. Communication-Service Providers

Contact information and message-related data may be shared with WhatsApp, Meta, SMS, email and other communication-service providers to send transactional, service and permitted marketing communications.

E. Technology and Service Providers

We may engage cloud-hosting providers, analytics providers, security vendors, software providers, professional advisers, customer-support tools and other vendors that help us operate the Services.

Such providers are authorised to process personal data only for the services they provide and are expected to maintain appropriate confidentiality, privacy and security safeguards.

F. Government and Legal Authorities

We may disclose personal data where required:

• Under applicable laws, regulations or legal processes;
• In response to a valid request from a government, regulatory, judicial or law-enforcement authority;
• To investigate or prevent fraud, cyber incidents or unlawful activity;
• To enforce our agreements; or
• To protect the rights, property or safety of AirMenus, Merchants, users or others.

G. Business Transfers

Personal data may be transferred as part of a merger, acquisition, restructuring, financing, sale of assets or similar business transaction, subject to appropriate confidentiality and legal safeguards.

AirMenus does not sell personal data to third parties.

7. Merchant Use of Customer Data

Merchants using AirMenus may access customer information generated through their digital menus, orders, reservations, feedback forms, loyalty programmes and other customer interactions.

Merchants may use this information for:

• Order and reservation fulfilment;
• Customer service;
• Loyalty and rewards;
• Feedback management;
• Business analytics; and
• Marketing communications where the required consent or other lawful authorisation has been obtained.

Each Merchant is independently responsible for:

• Providing appropriate privacy notices to its customers;
• Obtaining valid consent where required;
• Respecting customer communication preferences;
• Keeping its AirMenus account secure;
• Restricting employee and authorised-user access appropriately; and
• Using customer data in compliance with applicable law.

If you have a question about how a particular Merchant uses your data, you should contact that Merchant directly. AirMenus will reasonably assist the Merchant with verified requests relating to personal data processed through our platform.

8. Marketing and Service Communications

AirMenus and Merchants may send:

• Order confirmations;
• Reservation confirmations and reminders;
• Payment and refund updates;
• Delivery tracking updates;
• Loyalty balance and expiry reminders;
• Service and account notifications;
• Feedback requests; and
• Promotional offers and marketing messages.

Marketing communications will be sent only where permitted by applicable law and relevant communication-platform policies.

You may opt out of marketing communications by using the unsubscribe or opt-out option provided in the message, contacting the relevant Merchant or contacting AirMenus.

Opting out of marketing messages will not prevent you from receiving essential transactional or service-related communications.

9. Cookies and Similar Technologies

We may use cookies, pixels, local storage and similar technologies to:

• Keep users signed in;
• Remember preferences;
• Maintain security;
• Understand website and product usage;
• Measure performance;
• Diagnose errors; and
• Improve the Services.

Some cookies are necessary for the Services to function. Where required, we will obtain consent before using non-essential cookies.

You can manage cookies through your browser settings. Disabling certain cookies may affect the availability or functionality of some parts of the Services.

10. Data Retention

We retain personal data only for as long as reasonably necessary to:

• Provide the Services;
• Fulfil the purpose for which it was collected;
• Maintain transaction and business records;
• Resolve disputes;
• Prevent fraud and misuse;
• Enforce our agreements; and
• Meet legal, tax, accounting and regulatory obligations.

Retention periods may vary depending on the type of information, the Merchant’s instructions, the nature of the relationship and applicable legal requirements.

When personal data is no longer required, we will delete, anonymise or securely dispose of it, unless its continued retention is required or permitted by law.

11. Data Storage and International Transfers

AirMenus and its service providers may store or process personal data on servers located in India or other jurisdictions.

Where personal data is transferred outside India, we will take reasonable measures to ensure that the transfer is undertaken in accordance with applicable data-protection laws and that appropriate contractual, organisational or technical safeguards are maintained.

12. Security Practices

AirMenus uses reasonable technical, operational, managerial and organisational safeguards designed to protect personal data against:

• Unauthorised access;
• Loss or misuse;
• Unlawful disclosure;
• Alteration;
• Destruction; and
• Other security threats.

These measures may include access controls, authentication mechanisms, encryption where appropriate, monitoring, backups and restrictions on employee and vendor access.

However, no internet transmission or electronic-storage system can be guaranteed to be completely secure. Users are responsible for maintaining the confidentiality of their account credentials and notifying AirMenus promptly of any suspected unauthorised access.

13. Your Rights

Subject to applicable law, you may have the right to:

• Request information about the personal data being processed;
• Access your personal data;
• Correct inaccurate, incomplete or outdated personal data;
• Request deletion or erasure of personal data;
• Withdraw consent;
• Opt out of marketing communications;
• Raise a grievance regarding the processing of personal data; and
• Nominate another individual to exercise your rights in circumstances permitted by law.

To protect your privacy, we may require sufficient information to verify your identity before processing a request.

Where AirMenus processes personal data on behalf of a Merchant, we may direct your request to that Merchant or assist the Merchant in responding to the request.

A request may be declined or limited where retaining or processing the information is required by law, necessary for an ongoing transaction, required for the establishment, exercise or defence of legal claims, or otherwise permitted under applicable law.

14. Children’s Privacy

The AirMenus business platform is intended for use by Merchants and authorised business representatives who are at least 18 years old.

We do not knowingly collect personal data directly from children for the purpose of creating Merchant accounts.

If a child accesses a customer-facing service provided by a Merchant, the Merchant is responsible for obtaining any verifiable parental consent or authorisation required by applicable law and for complying with requirements relating to children’s personal data.

If you believe that a child’s personal data has been collected or processed improperly, please contact us so that appropriate action can be taken.

15. Third-Party Services and Links

The Services may contain links to or integrations with third-party websites, payment gateways, logistics providers, communication platforms and other independent services.

AirMenus does not control the privacy practices, content or security of independent third parties. We encourage you to review their privacy policies and terms before providing personal data or using their services.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in:

• Our Services;
• Our data-processing practices;
• Applicable laws or regulations; or
• Security and operational requirements.

The updated Privacy Policy will be published on this page with a revised “Last Updated” date.

Where required, we may provide additional notice through the website, merchant dashboard, email, WhatsApp or other appropriate means.

Your continued use of the Services after an updated Privacy Policy becomes effective will be subject to the updated policy, to the extent permitted by applicable law.

17. Complaints and Grievance Redressal

If you have any questions, complaints, requests or concerns regarding this Privacy Policy or the processing of your personal data, please contact:

We will acknowledge and address grievances within the timelines prescribed under applicable law.

If you are not satisfied with our response, you may have the right to approach the relevant statutory, regulatory or adjudicatory authority in accordance with applicable law.

18. Governing Law

This Privacy Policy is governed by the laws of India, including applicable provisions of the Information Technology Act, 2000, the rules framed thereunder, the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and any amendments, replacements or successor legislation, to the extent such provisions are in force and applicable.