Privacy Policy

This policy explains what the Platform does with personal data about Customers, people a Merchant records as prospective customers, Merchants' staff and Merchants. Defined words have the meaning in clause 1 of the Terms of Service. A Merchant may also publish its own privacy notice, which governs what it does with your information for its own purposes.

This one policy applies wherever you are. Sections 1 to 17 apply to everyone; section 18 adds what the law of your country gives you, for India, the European Economic Area, the United Kingdom and Switzerland, the United States and the United Arab Emirates. Where section 18 gives you more, it applies.

1. Who is responsible

Cuscato. You can write to us at support@cuscato.com.

1.1 Your Orders and Bookings, and a Merchant's records of you. This includes the Merchant's customer record of you and, if the Merchant records you as a lead, its lead record (section 2.4). The Merchant decides why this information is collected and how it is used. Cuscato holds it for the Merchant and acts on its instructions. The Merchant is the Data Fiduciary (controller); Cuscato is its Data Processor (processor; under United States state privacy laws, its service provider).

1.2 Your account and our own records. For your Cuscato account and which Merchants it is linked to, the list of your own Orders across Storefronts that we show you in it, your sign-in details, sign-in code records, technical records, the Finder, the signed record of what you accepted, Merchant verification records, notices sent under our Notice and Takedown Policy, complaints and messages sent to us through our forms, requests to join from businesses in countries where sign-up is stopped, a Merchant's own business details and its subscription to Cuscato, the questions the assistant could not answer, kept to improve our services (4.2D), and the records of Cuscato's own staff, Cuscato decides the purpose and is responsible (the Data Fiduciary, or controller).

1.3 So if you ask us to change or delete Order, Booking, customer or lead data, we will pass your request to the Merchant, because the decision is theirs. Requests about the data in 1.2 we answer ourselves. Deleting your account yourself (section 10) is the exception: the Merchant has agreed that it also deletes your personal details in its records, as section 8 describes.

1.4 The law this follows. Cuscato runs the Platform from India. This policy is our privacy policy under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and our notice under the Digital Personal Data Protection Act, 2023 and its Rules, whose duties come into force in stages. Where this policy gives you a right under that Act, the right applies from the date the relevant provision is in force, and earlier where we say so. Where the data-protection law of another country applies to what we do with your data - for example the General Data Protection Regulation (GDPR) when you are in the European Economic Area - this policy is also our notice under that law, and section 18 says what it adds.

1.5 Where the Platform is offered. Merchants on the Platform are businesses established in India and in other countries. Anyone, in any country, may browse their Storefronts and order from them. While sign-up is stopped for a country, a business established there may ask to join early (section 2.9). A Merchant established outside India is responsible for its Customers' data under the law of its own country as well (section 18).

2. What we collect

2.1 Customers

A Merchant's staff may also record an Order or Booking for you, for example when you order by phone, in person or on WhatsApp, using the name, phone number and email address you give them. They may also record an Order they handle outside the Platform, paid directly to them; the Platform generates an Invoice for it only if the Merchant asks, with the details the Merchant recorded, and the Merchant may record your payments for it. A Merchant may also record a payment it received for a sale it never entered on the Platform: that record is attached to no Order and holds the amount, the method, the time, any reference number and the staff's note of what it was for. If a Merchant connects its own payment provider account (Razorpay, Cashfree, PhonePe, Paytm or Stripe), you may pay for your Order on that provider's own page: the Platform asks that provider, with the Merchant's keys, for a payment link for your Order, sending it the Order number, the amount and the Merchant's or outlet's name - and, where the provider requires a phone number on the link, the outlet's phone, never yours. What you enter on the provider's page goes to the provider, under its own terms and privacy policy, not to Cuscato. When the provider reports a payment made to the Merchant through that link, the Platform may record on the Order the amount, the method, the time and the reference number; it does not keep the payer's name, UPI ID or bank account number, or a card number. The Platform does not promise that every such payment is recorded, or when: if yours does not show, the Merchant can check its provider's records and record it. The Merchant may also send you a link to a pay page for your Order, which shows the Merchant's (or outlet's) name, the Order number, the amount and the Merchant's UPI ID, and nothing about you; anyone with the link sees the same. After paying, you may send the payment's UPI reference there, or, signed in, on your Order with a screenshot of the payment. We keep the reference, the screenshot (as a picture on your Order), the amount owed at the time, when you sent it, who sent it when you were signed in, and what became of it - the Merchant's decision with any reason it gives you, or, if the Merchant has not checked it within 7 days or the Order is cancelled, that it closed unchecked - so the Merchant can check its own UPI app or bank and record the payment. A screenshot can show your name, UPI ID and bank: add only what the Merchant needs. We do not check a reference with any bank or UPI app. A Booking's special-requests box is free text: if you write health information such as an allergy, it is shown to the Merchant's staff so they can serve you safely, and we treat it as sensitive. Write only what the Merchant needs.

If you order from a business through Swiggy or Zomato, the delivery platform sends that business your order: what you ordered, your instructions, the name you gave the platform and the platform's order number. Cuscato does not keep your phone number, address or payment details from the platform, does not create a customer record for you, and uses this only so the business can prepare your order and keep its books.

You can see and cancel your own Bookings. A request for someone else's Booking is answered as if it did not exist.

2.2 Merchant staff

For a staff, sales, delivery or owner login we hold an email address, mobile number, name (required for an owner who signs a business up, optional for a team member) and optional profile photo, role (such as staff, sales, delivery, administrator or owner), whether the account is active, when each contact was verified, the last time they signed in or renewed a "stay signed in" sign-in, and the same sign-in records as above. Cuscato is responsible for this data. If an owner or administrator connects an AI assistant to the business (section 7), we record which assistant it was (the name it gave itself and the site it returns to), who approved it, whether it may make changes, when it was approved, last renewed and ends, and when it was disconnected. Questions a team member types in the app's Ask box are answered and kept as 4.2D describes. While a team member has the Platform open and is signed in, the other members of that business's team (owners, administrators, staff, riders and salespeople) can see that they are online, with their name (or, without one, the part of their email address before the @), their role and when they came online. We work this out from the app's live connection and hold it only in the server's memory: it is not stored, it is gone within about 15 seconds after they close the app or sign out, and Customers never see it. Changes a staff member makes to an Order are recorded against their account in the Order's history of changes, and the leads a salesperson looks after and the notes they write are recorded against theirs. Notes and pictures they add to an Order or a custom order request, and the quotes they send, are recorded against their account too, are shown to that Order's Customer as coming from the business, and stay with the Order if they delete their own account. A salesperson sees only the leads assigned to them and the Orders they took. When delivery staff record a delivery step (picked up, out for delivery, delivered or not delivered), the Platform also records the device's position at that moment, but only if they allow location access in their browser. While an Order is with them (from the moment they mark it picked up until they mark it delivered or not delivered), the delivery person's device position is sent about every 10 to 60 seconds while the Platform's Deliveries page is open on their device, and shown to the business's staff and to that Order's Customer with an estimated arrival time. Sharing starts when the Order is marked picked up (by them or the business's team) and cannot be paused during the delivery from the Platform; it stops when they close the page, and the screen is kept on while it runs. If their browser blocks location or no position arrives for 3 minutes, the business's staff see that they are not sharing, with their name (we keep the time their browser blocked location with the position, deleted with it), and the Customer sees when they were last seen. Only the latest position is kept, with no route history; it is deleted when the delivery ends or at most two hours after the last update, and it is never collected in the background. The notification centre (the bell in the app) shows a team member what recently happened in their business that their role already lets them see - such as new Orders and Bookings from Customers, custom order requests, payment details sent for an Order, and, for owners and administrators, decisions about the business's verification and its web address. It is read from those records; nothing is copied for it, and we keep only when they last marked it as read, to count what is new. When an owner or administrator adds someone to the team, we email that person once from noreply@cuscato.com: who added them, the business, their role and the sign-in link. When a business is handed to a new owner, we email the new owner and the former owner once each from noreply@cuscato.com: who made the change, the business, and the other person's name and email address. A team member can turn on push notifications for new Orders, Bookings, custom order requests and payment details sent for an Order on a device (they appear even when the Platform is closed); on an owner's or administrator's device they also remind them that a document checked for the business's verification is about to expire or has expired. For each device that does, we hold its push address and the encryption keys its browser gives us, with their login, the sign-in it was turned on from, the business and when each alert was last sent. Alerts go to a device only while that sign-in lasts; the record is deleted when they turn alerts off, sign out on that device, leave the team or their login ends, within a day after that sign-in ends, or when the push service says the address no longer works. An alert carries only the Order, Booking or request number; for an Order, the amount, how it is fulfilled and any table; for a Booking, when it is for, the number of people and the seating area; for a custom order request, the date it is needed by; for a document reminder, which document and its date, never its number; and the outlet - never a Customer's name or contact details - and it is encrypted so only that device can read it. A Customer can turn on notifications about their own Orders on a device (on their Orders page, after placing an Order, or in Account). We then hold the same push record as for a team member. A notification is sent when the business accepts or readies the Order, hands it to its rider or a courier, sends it out, delivers or cancels it, or could not deliver it, or when the Order is cancelled automatically because the business did not confirm it in time, never for a change the Customer made; it carries only the Order number, its new status and the business's name, opens the Order, and is encrypted so only that device can read it. The record is deleted when they turn notifications off, sign out on that device, their login ends or changes role, within a day after that sign-in ends, or when the push service says the address no longer works. A signed-in Customer can tap Notify Me on a sold-out item of a Storefront. We then hold which item, their login and when they asked - nothing else, and no new contact detail. When the item can be ordered again we tell them once, the way they already reach us: a notification on a device where they turned notifications on, otherwise an email to their verified address (never a text message); it names only the item and the business. The request is deleted when that message goes, when they cancel it (on the Storefront, or in My Account on cuscato.com), 90 days after they asked, when their login ends, and when the business closes. The business does not see who asked. When a business closes, every login is deleted; the business's own email address and phone number are kept with its eight-year archive, only to confirm who is asking for a copy of it and to send it, and are deleted with it.

2.3 Merchants

For each Merchant we hold its brand and legal name, Storefront address, registered address, the owner's own contact email and phone (used by us to reach the business, never published), the phone and email the business gives as its contact for customers, any customer-care phone and email and website, the opening hours, its own UPI ID, its own payment link (a page at its own payment provider) and the note on how customers pay it, and, where an outlet takes its own payments, an outlet's own UPI ID, payment link and payment note, which replace the business's for that outlet (shown at checkout, after an Order and next to any advance), and its cancellation policy and what it says about refunds (none, or allowed, with its own note), which it shows customers on its Storefront, tax and licence numbers (such as GSTIN, PAN, FSSAI, CIN and trade licence numbers, for a business in the European Union, the United Kingdom or the Isle of Man its VAT number, which its bills and its Cuscato plan invoices print, and, if it exports or imports, its Importer-Exporter Code), documents it uploads if it is established in India (such as its GST certificate, and one for each outlet registered under a GSTIN of its own, PAN card, a masked Aadhaar card (its first 8 digits hidden; only its last 4 digits are kept as its number), trade licence, FSSAI licence, Importer-Exporter Code certificate, an RCMC from an Export Promotion Council or FIEO, proof of authority or a brand owner's authorisation), its logo, outlet details (including whether an outlet exports or imports), onboarding status, the country it is established in, currency and time zone, for a business outside India the name of the tax it charges (such as VAT), and its subscription to Cuscato (plan, payments, receipts, invoices and credit notes, section 7). Where the Merchant is an individual, these are personal data and we treat them as such.

When you sign up a business you may tell us how you heard about Cuscato, by choosing from a list or in a few words of your own. It is optional. We use it only to understand which channels bring businesses to Cuscato, keep it with the business account, include it in the business's export, and delete it when the business is closed.

If you submit a business signup but do not finish, we keep your name, email address, mobile number and what you entered about the business (its name, kind, Storefront address and how you heard about Cuscato), with why it did not finish, for 90 days after your last try, so our team can help you finish; we may contact you about it, by phone or email, and we keep a copy of any email we send you about it. It is deleted, with that copy, when you finish signing up, or earlier if you ask us.

When a business signs up, we email its name, Storefront address and kind, the owner's name, email address and phone number, how it heard about Cuscato (if answered), when it signed up and when its free trial ends to the same mailboxes as a contact-form message (clause 2.8), so that we can welcome the owner and help with setting up.

Seller information. Anyone who opens a Storefront's "Seller information" sees, for the business, its brand, its legal name (once verified, the one we checked), its registered address, its GSTIN or that it is not GST-registered or is on the composition scheme, its FSSAI number where it sells food and, where recorded, its CIN; the phone and email it gives as its contact for customers and any customer-care contact and, where the Merchant names one, its grievance officer's name, email address and phone number; and, for each outlet, the outlet's own legal name, postal address, GSTIN, trade licence and (where that outlet sells food) FSSAI number where it has its own (or that it uses the business's); and the cancellation policy and refund terms. It never shows the PAN, the Aadhaar, the Importer-Exporter Code, a document image, or the owner's own sign-in email or phone. A Storefront may also show that the business exports or imports, and whether its Importer-Exporter Code is on record or has been checked by us. An outlet's map position, directions and phone are shown on the Storefront, at checkout, on Orders and to search engines only if the Merchant's owner or administrator switches that on for the outlet; tax invoices carry the supplier's address whatever the choice, as the law requires, and the Verified badge shows the city and State of the Merchant's registered address (below).

Verification. Verification is offered only to Merchants established in India; a Merchant established elsewhere is not asked for these documents. Cuscato's reviewers check a Merchant's documents against the issuing authority's public records (such as the GST portal, the FSSAI licence search, company and Udyam records, the Trade Marks Registry, DGFT's Importer-Exporter Code records and Export Promotion Council or FIEO registers) and record what they saw, each check and decision, and each time a document was opened. Each time a Merchant sends its documents for review, we record that its owner or administrator ticked the declaration that they are genuine, current and truthful, when, and the version of the declaration and of the Merchant Agreement. If we later remove a Merchant's verification, we record who did it, when and why, and email the owners and administrators the reason. When a Merchant uploads a verification document, Cuscato reads it automatically - the PDF's own text or, for a scan or a photo, automatic text recognition (4.2C) - to fill in its form and to help our reviewers check it (for example that the GSTIN is valid, that it contains the Merchant's PAN and that the name matches the business). A reviewer still checks every document, and nothing is approved by the automatic reading alone. We keep only the details found (numbers, names, addresses, the type of business, the State, dates and whether an Aadhaar number is visible, never the Aadhaar number itself; for a masked Aadhaar a Merchant gives as its identity document, only its last 4 digits and the holder's name. We refuse a full Aadhaar number typed into any field, an Aadhaar card on which the full number shows is rejected and its file removed as soon as it is read, and we do not check an Aadhaar with UIDAI) and delete them with the document. We compare document numbers and files across businesses to spot the same document used twice, and we email the owners and administrators whose email address is verified about each decision, about each document a reviewer uploads, each change a reviewer makes to the business's or a document's details and each time a reviewer sends the form for review on the Merchant's behalf, 30 days, 7 days and 1 day before a checked document expires and when the business stops being shown as verified. When a Merchant sends its form for review, we email the business's name and Storefront address to the same mailboxes as a contact-form message (clause 2.8), so a reviewer picks it up; never a document or its details. Only Cuscato's reviewers, and the Merchant's own owner and administrators, see the documents themselves. A Merchant may instead email its documents to support@cuscato.com and ask a reviewer to upload them and fill in its form; each step is recorded under that reviewer's name, and the emailed copies are used only for this and deleted from the mailbox once uploaded. Once verified, the Storefront's Verified business badge shows the Merchant's legal name, trade name, type of entity, the city and State of its registered address or principal place of business, and the number, status and dates of the documents checked - never its PAN or Aadhaar, never its Importer-Exporter Code (only that it was checked) and never a document image. The Finder shows a Merchant's business name, its logo, the kinds of business and the cities its Storefront shows, its country, a link to its Storefront and whether it is verified. A Merchant chooses which other details appear on its Storefront and Invoices.

Web address. A Merchant's owner or administrator may ask to change the business's web address; it can be changed once. We keep the request - the old and new name, the reason they gave, who asked and when, and our decision with any note - with the business's records, and delete it with them; a change we make ourselves is kept the same way under the reviewer's name. We email the owner when the address changes or the request is refused.

2.4 People a Merchant records as leads

A Merchant's staff may record someone as a lead - a prospective customer - who may never have used the Platform: their name, phone number and email address, how they came to the Merchant (for example by referral or on WhatsApp), where they are in the Merchant's sales process, the reason if they were lost, the next follow-up date, who added them and which salesperson looks after them, and dated notes of calls and visits with who wrote each note. The record also keeps its history: how it was added (by which staff member, by an order, on the shop or by which import) and which of the Merchant's staff later changed which details, handed it to someone, added a note or switched it off, and when - naming the details that changed, without copying a name, number, email or note. Staff may also add leads and customers from a spreadsheet (Excel or CSV) or a contacts file, or pick them from the contacts on their own phone where the browser allows it; from a spreadsheet the name, phone number, email and (for customers) notes are taken, and from contacts only the name and phone number. The file and the phone's contacts are read on that staff member's own device: only rows that pass the browser's checks are sent to us to compare with the business's records, which keeps none of them, only the rows they then import are saved, and nothing is kept in step with the phone afterwards. Each import is logged with the staff member who ran it, the file's name and how many rows it added, filled in, skipped or refused. People added this way are recorded as imported and as not having agreed to hear from the Merchant, an existing record is only filled in where it was empty, and Cuscato sends them nothing because they were added. The Merchant decides why, and must tell the person as the law requires; we hold it for the Merchant (clause 1.1). To see, correct or delete it, ask the Merchant, or write to us and we will pass your request on. It is deleted when the business closes, and becomes part of the Merchant's customer record if the person orders.

Adding to the basket while signed in. If you are signed in at a Storefront and add an item to your basket, we record it for that Merchant at once: your name, the email address and phone number you have verified (whichever you have), the item you last added and when. If the Merchant already has a record of you, the item and the time are added to it. The Merchant sees you as a lead only if you leave the basket without ordering for the time it sets, counted from your last add: one hour unless it changes it, and it may choose to see it at once. If you order within that time, the Merchant never sees the basket as a lead, and the item and time are removed from its record of you. Once it shows, the Merchant's team sees it in its leads (a salesperson only once it is assigned to them) and may contact you about it. Nothing that identifies you is recorded while you are signed out - the add is only counted (see Product counts) - and the Storefront says next to the basket that the Merchant can see what you leave in it. Deleting your account clears it, as section 8 describes. A Merchant may also turn this off. Then nothing is recorded when you add an item to your basket at its Storefront, the Storefront does not say that the Merchant can see your basket, and any basket it has not yet seen as a lead is removed from its records.

Product counts. When you open a product on a Storefront, or add it to your basket, we add one to that day's count for the product: how many visitors opened it, and how many added it to a basket. We keep only these counts, for each Merchant, product, outlet and day (the shop's own calendar day). We do not keep who you are, your account, your network address, your device or the time. So that a visitor is not counted again and again, our server keeps a scrambled form of your network address (a keyed hash, of the first half of an IPv6 address) in its memory for that day only, at most two days, never written to disk or a database, and then forgets it; a restart of the server forgets it too, so the counts are close but not exact. This applies whether you are signed in or not; it sets no cookie and stores nothing in your browser. Search engines and other automated tools are not counted, and nor is the Merchant's own team while signed in. The Merchant sees the counts, with what it sold, to see which products interest its customers. The counts are kept 90 days, are in the Merchant's data export, and are deleted when the business closes.

2.5 Photos

Merchants upload photos of their products, of the options offered with them (up to two for each option), of their product labels and of their outlets, which anyone visiting the Storefront can see. They should not show identifiable people.

Every picture uploaded to the Platform, including a profile photo, a photo attached to an Order or a complaint, a delivery photo and a scanned document, is saved as a new copy made from the picture alone. Hidden details the original file carried, such as where and when it was taken and the camera or phone that took it, are not kept. Pictures that anyone can see (product photos, photos of a product's options and of product labels, outlet photos, a business logo and a profile photo) are also checked before they are saved, as section 4.2 describes.

The camera is used only when you choose to take a picture, with "Take Photo" or with the camera your phone offers when you choose a photo: the picture is taken on your device and is sent only if you choose to use it, and no video is recorded or kept.

On the counter screen a Merchant's team can print a bill straight to a Bluetooth printer. The browser asks which device to use; the bill is sent to that printer only, and Cuscato receives nothing about the device.

A Merchant's team can also pair a second screen, such as a tablet facing the customer, to show what you see at the counter: the items, the total, the tax lines and how to pay - never your name, phone number or other details. Pairing takes a 6-character code shown on the counter screen, which works for 10 minutes, or a signed-in team member turning their own device into the screen, which then signs that device out of the team's account. We keep the outlet, which team member paired it, the screen's last display, and only a scrambled form of the code and of the screen's key, so neither can be read back. The pairing ends 12 hours after the screen last showed anything, and is deleted when the screen is unpaired (from the counter, or on the screen itself when the team signs in there again), when it ends, when that team member's account is deleted, or when the business closes.

2.6 People who report a Storefront

If you send a notice under our Notice and Takedown Policy, we hold your name, email address, phone number and postal address, who you act for and your proof of authority, what you told us, the web addresses you reported, your signature and the network address the notice came from, and what we did about it. We send a copy of the notice, with your contact details, to the Merchant concerned so it can respond - except when you tell us that you are the person impersonated or shown, when your details are not sent. Cuscato is responsible for these records.

2.7 Cuscato's own staff

For the people at Cuscato who review Merchants and handle notices we hold their email address, name, role and the parts of the console they may use, when they last signed in, and a log of what each of them did, with the network address, so every decision about a Merchant can be traced to a person. If one of them turns on notifications on a device, we hold that device's push address and keys until they turn them off, sign out there, are no longer an administrator or the browser drops them.

2.8 People who file a complaint or write to us

If you use our complaint form, we hold whether you are a customer or a business, your name, email address and phone number, the business you name, the other person's name and contact details if you give them, the order or booking number and date, what you wrote, the pictures or documents you attach, the network address the complaint came from, and what we did about it. To resolve a complaint we may send it, with your name and the files, to the Merchant or Customer it is about. If you use our contact form - to bring your business, as an investor, from the media, to propose a partnership, for help as a customer of a shop, or with a feature request, a bug report or feedback - we hold your name, email address, phone number, the business or organisation you name, the web address you mention, your message and the network address it came from, with what that address and your browser tell us: the country the network is in, what kind of device sent it (a phone, tablet or computer, or an automated program), and the browser and operating system (not a fingerprint, and nothing stored on your device). We also send a copy of each message, with all of that, by email to Cuscato's own mailboxes - addresses at cuscato.com only, such as support@cuscato.com, hosted by Zoho Mail - so we can read and answer it; your address is set as the one our reply goes to. When we answer from our own console, we keep a copy of our reply (its subject and text, who sent it and when) with your message, and it is deleted with it. Cuscato is responsible for these records.

2.9 Businesses asking to join while sign-up is stopped for their country

If you ask for early access for a business established in a country where sign-up is stopped, we hold the business name, its country and city, your name, your contact email address and phone number (optional), what it sells, how many outlets it has, your message and the network address the request came from (with the same network country, device type, browser and operating system as clause 2.8), and what we did about it. We use them only to consider the request and to contact you about joining. A copy goes by email to the same mailboxes as a contact-form message (clause 2.8). Cuscato is responsible for these records; we keep them as section 8 says.

2.10 Demo shops

When a person asks, Cuscato's operators may set up a demo shop for them, and a customer login for trying it, using the name and email address that person gives. A demo shop is marked as one, is not listed in the Finder or shown to search engines, and tells visitors that orders there are for testing. No terms are accepted on anyone's behalf: each person accepts them at their first sign-in. A demo shop may be filled with made-up sample data - customers, a team, orders, bookings and requests under invented names, with Cuscato's own email addresses and phone numbers reserved for fiction - and nothing is sent to those made-up people. A demo shop is reset to its sample data every day at 00:00 UTC, unless we switch that off for it, and whenever we choose: everything added to it - orders, bookings, requests, payments, invoices, customers, leads, notes, reviews, pictures and files, including what a person trying it added - is deleted, and its products, outlets and areas are made again; the shop, its settings and logo and its logins are kept. We may also delete any one of those kinds of content from it at any time. A demo shop and everything in it, including its record as a business, are deleted at once when it is no longer needed. A record that a person accepted the terms there stays with that person's account, and a complaint about a demo shop is kept like any other (section 8). A demo shop that has paid, or started to pay, for a plan is not reset or deleted this way; it is closed like any other business. A payment or payment link made while our payment processor is in test mode takes no money and does not count: it may be deleted with the shop's content (section 8).

2.11 Businesses we set up or change for you

When a business asks, Cuscato's operators may set up its business and its owner's login, using the name and email address the owner gives, and may change the business's name, legal name or registered address. They may also choose its business type and add that type's ready-made product categories, as the owner can in Products; a category the business already has is never renamed or removed. On a written request from a business whose owner cannot do it themselves, they may also make another person its owner - a member of its team, or a new login made with the name and email address the business gives - and the former owner becomes an administrator. Each change is recorded with the operator who made it, the reason and what changed (for a change of owner, the former and new owners' email addresses and whether a login was made), and the business's owners are told by email (for a change of owner, the new owner and the former owner). No terms are accepted on anyone's behalf: the owner accepts the Merchant Agreement for that business at their first sign-in there, even if they have accepted it for another business, because each business accepts it for itself and the record names the business; and the Privacy Policy unless their account has already accepted its current version. Until the owner has accepted the Merchant Agreement for that business, it does not take orders or bookings.

2.12 What Cuscato's staff see of customer accounts

To give support - to a Customer, or to a Merchant about one of its Customers - the Cuscato staff given that part of our console can see each customer login: the name, email address and phone number, whether they were verified, when it was made and last signed in, and the business it belongs to. They can also see that person's orders at every business where they have a login: the order number, date, status, total and payment state, and the business, its web address and the outlet of the sale. They see this to answer a request (such as deleting an account, correcting a name, or a question about an order, a refund or a disagreement with a business), never to market to anyone, and each time one of them opens a customer's details or reads their orders it is recorded in the log of what our staff did (clause 2.7).

3. Location, and what we do not collect

• Your location. The Platform uses a Customer's device position in two cases only, and you never have to share it. First, ordering a delivery for yourself, when you tap "I'm at the Delivery Address - Check the Distance": your browser asks you, and the position is sent to us to check that the outlet delivers there (we tell you whether it does, and how far away the outlet is only when the Merchant shows that outlet's address on its Storefront) and kept on that Order, rounded to about a metre, for the Merchant's staff, its delivery staff and you to find the address by; if you change the delivery address afterwards, it is not used or sent. It is deleted when you delete your account or the business closes. You never have to share it: the PIN code is enough, and the position is not used for anything else. Second, on a shop's page: your device's location is used on your device only, to show how far that shop's places that publish their location are and to choose the nearest one for you; it is not sent to us or to the shop (nor which place was chosen for you that way), and it is not kept. The browser asks only when you tap "Use My Location"; if you have already allowed this site to use your location (for example for the distance check), the shop's page reads it when it opens, without asking again. You can withdraw that permission in your browser's settings. The Platform also stores coordinates of Merchants' premises, and the position of a Merchant's delivery staff when they record a delivery step and, while an Order is with them, their latest position (clause 2.2). During your own delivery you can see that position on a map, with an estimated arrival time. The maps come from OpenFreeMap, a free map service built on OpenStreetMap data: when a map is shown, your browser asks OpenFreeMap for the map of the area on screen, which covers the delivery address, the outlet and the rider and moves with the rider. That gives OpenFreeMap your network address, the address of the business's site (not the page) and that area, so it could tell roughly where a delivery is happening, never your name, the Order or an exact position.
• Your country, for prices. To show our prices in rupees, dollars or euros, we work out the country your connection comes from, from the country our network provider (Cloudflare) adds to the request or from an offline database of network addresses, and where neither gives an answer your browser may use its time zone. It is used only to choose the currency shown, to offer our pages in Hindi and Hinglish in India, to suggest your country on the business sign-up form, and to start the Finder at the businesses in your country (you can choose All Countries), and is not stored unless you send the form. The price a business pays depends on where it is established, not on this.
• Payment details. No payment for an Order or Booking is taken through the Platform; you pay the Merchant directly. The Platform has no field for a full card number, card expiry date, CVV, UPI PIN, UPI ID or bank account number, and none will be added. The Reserve Bank of India's card-on-file rules allow only the last four digits and the issuer's name to be kept for reconciliation. For each payment recorded, the Platform keeps only the amount, the method, when it was received and any payment reference, for the Merchant's reconciliation, and for a card payment its last four digits, issuer and authorisation code. A screenshot of a payment you choose to send (clause 2.1) may show some of these details; it is kept as a picture on your Order, never read into a field.
• Cookies and analytics. When you sign in, the Platform sets one strictly necessary cookie that keeps you signed in: cuscato_session on a Storefront's address, or cuscato_account on cuscato.com. It holds a random renewal key and nothing else, can be read only by our server (never by the page's scripts), is sent only when your browser renews or ends your sign-in, lasts at most 30 days from the last code you entered, is replaced each time it is used and is deleted when you sign out (if your device is offline at that moment, as soon as it is back online or at your next visit). Cuscato's own staff signed in to our review console get cuscato_operator instead: a signed renewal key naming the staff member, their role and when they entered their code, readable only by our server, sent only when the console renews its sign-in, lasting at most 9 hours from that code, and deleted, and of no further use, when they sign out. When such a staff member opens Razorpay's checkout on the console's payment gateway page to try a test payment, Razorpay's own script sets its cookie rzp_unified_session_id and keeps rzp_device_id, rzp_checkout_anon_id and rzp_stored_checkout_id in that browser, under Razorpay's privacy policy. The script is loaded only when they open that checkout, stays in that browser tab until it is closed or reloaded, and is allowed only on the staff console's pages, never on a Storefront or anywhere a Merchant or customer works. When an owner or administrator of a business established outside India pays its plan through Paddle (section 7), they are taken to one payment page on cuscato.com, the only page of the Platform that loads Paddle's checkout script (Paddle.js). That script keeps no cookie or browser storage for cuscato.com, and the page lets it load nothing but Paddle's own files and checkout window (not, for example, the separate subscription-retention script it asks for). Paddle's checkout window is Paddle's own page on paddle.com, and may set Paddle's own cookies and browser storage there, under Paddle's privacy notice, to run the checkout and prevent fraud. There is no fingerprinting, and there is no advertising or tracking pixel on a Storefront, in an account, in a Merchant's screens or anywhere a Storefront's customers use the Platform.
• Cuscato's own count of business sign-ups (no cookie). On cuscato.com's home page and business sign-up page only, the Platform counts how many visits reach each step of signing up a business: the home page shown, the sign-up form opened, the first thing typed into it (that something was typed, never what), a Sign Up press the form refused and which field it was (such as the mobile number; never what was typed), Sign Up pressed, the code sent, the code entered and the business created. With each step it keeps a random number the page makes for that browser tab (in the tab's session storage, cuscato.funnel, gone when the tab closes; in the European Economic Area, Switzerland and the United Kingdom only once you accept analytics in the cookie question, otherwise the number lives only in the open page and nothing is stored on your device), the ad or website named in the page address (its utm_source, utm_medium and utm_campaign tags; a tag that looks like an email address or a phone number is dropped), whether the address came from a Google or Meta ad click (never the click's identifier), the name of the website you came from (such as instagram.com), whether the device is a phone, a tablet or a computer, and the country our network provider reports. It keeps no network address, cookie, name, email or phone number, is not linked to an account and is not shared with anyone. When you finish signing up, your business keeps one line saying where its sign-up came from (for example "google / cpc / diwali" or "from instagram.com"). We use these counts, in our legitimate interest in knowing which of our pages and ads bring businesses, to improve them. Each step is deleted 13 months after it happened; the line on your business is deleted with the business.
• To see how the Platform is used and make it better, cuscato.com and the Storefronts on it use Microsoft Clarity, run by Microsoft (section 7). Clarity records how pages are used - pages visited, clicks, taps, scrolling and mouse movement, the device, browser and screen size, the country worked out from the network address - and can replay a visit as a recording and add many visits up into a heat map. Text you type is never recorded, and on the screens that show personal data (signing in and signing up, your account, the Storefronts with their baskets, checkout, Orders and Bookings, a Merchant's own screens, the kitchen screen, a receipt check and Cuscato's review console) all text is hidden from it as well. Every page asks the same one question about cookies, with the same three buttons: the strictly necessary cookies above (signing in and security) are always on, and each other category - Analytics and, on cuscato.com's own pages about Cuscato, Marketing - stays off until you choose "Accept All", or turn it on under "Choose", which names the tools in each category; "Reject All" keeps them all off. A page asks only about the categories it has a tool for. Clarity is part of Analytics: it is turned on only if you allow Analytics; with "Reject All", or until you answer, it is not loaded at all. Once on, it sets two cookies on our site (_clck, which tells a returning browser apart for up to a year, and _clsk, which joins the pages of one visit for a day), and Microsoft may set its own cookie, CLID, on its clarity.ms site for up to a year; your browser may block that one. Your answer is kept in your browser (section 5), and you can change it at any time with "Cookie Settings" at the foot of every page. Clarity keeps recordings for 30 days and the other usage data for up to 13 months, may process it outside India, and is told never to use it for advertising.
• Allowing Analytics also turns on Cloudflare Web Analytics, run by our network provider, Cloudflare (section 7), on the same pages, to count page views and see how fast pages load. For each page it receives the page address, the page you came from, your browser and device type, the country worked out from your network address, and how long the page took to load. It sets no cookie, stores nothing in your browser, does not follow you from site to site, and Cloudflare does not keep your network address for it. With Analytics refused, or until you answer, it is not loaded. Cloudflare keeps each page view in full for 7 days and after that only as totals, may process it outside India, and does not use it for advertising.
• Measuring Cuscato's own ads. On cuscato.com's own pages about Cuscato - the home page, Pricing, Features and business sign-up - and nowhere else, the same question also asks whether we may measure our own advertising (Marketing). Only if you choose "Accept All", or turn on Marketing under "Choose", do those pages load the Meta Pixel, run by Meta Platforms, and the Google tag for Google Ads, run by Google (section 7); with "Reject All", or until you answer, neither is loaded, and neither is ever loaded if your browser sends a Global Privacy Control signal. They tell Meta and Google which of those pages you visit and, when you sign up a business, that a sign-up happened, so we can see which of our ads lead to sign-ups and show them to people likely to sign up. Meta sets the cookies _fbp and, when you arrive from one of its ads, _fbc (each up to 90 days); Google sets _gcl_au (up to 90 days). When you sign up a business with Marketing on, our server also sends Meta that sign-up with your email address and mobile number in hashed form, your browser's description (user agent) and those Meta cookies, so Meta can match it to an ad; we send nothing else about you and nothing about your business. If you allow Analytics, the same pages also use Google Analytics, run by Google, which records the pages visited and sign-ups and sets _ga and _ga_ followed by an ID (up to 2 years); unless you also allow Marketing, Google is told not to use it for advertising (Google Consent Mode). Meta and Google use this data under their own terms and may process it outside India. On our हिन्दी and Hinglish pages the same question is asked in that language, and the buttons read "सब स्वीकार करें" / "Sab Accept Karein" (Accept All), "चुनें" / "Chunein" (Choose), "सब मना करें" / "Sab Reject Karein" (Reject All) and "ऑप्शन सेव करें" / "Options Save Karein" (Save Choices). You can change your choice at any time with "Cookie Settings" at the foot of those pages; turning Marketing off stops the tags from then on. Our network provider, Cloudflare (section 7), may also set security cookies of its own (__cf_bm, and cf_clearance after a check) that are strictly necessary to tell people from automated traffic, for example when it shows a check before a page opens; they are used for nothing else.

Before any of these changes, this policy will be updated and re-published under a new version.

4. Automated processing and AI

4.1 Customer tier and value. Each Merchant's record of you carries an estimate of how much you are likely to spend with that Merchant over the next year, and a tier (VVIP, VIP, Regular, Occasional, New, At Risk or Lapsed) cut from it. Both are worked out from how recently, how often and how much you have ordered with that Merchant, every day, after cancelled orders and refunds, measured against how often and how much that Merchant's customers usually order (which matters most while you have ordered only once or twice). The tier compares your estimate with the Merchant's other customers, so both can change when they order, or as time passes, even if you do nothing; At Risk and Lapsed mean you have not ordered for longer than is usual for you. They use no data from other Merchants or from outside the Platform, are seen only by the Merchant's owners, administrators and staff, are not shown to you, and do not affect any price, offer, Order or Booking. You may ask the Merchant what tier you hold. The tier and the estimate are part of the Merchant's customer records: the Merchant is the Data Fiduciary for them, and Cuscato works them out on the Merchant's behalf, as its Data Processor, and uses them for nothing of its own.

4.2 The picture check. Before a product photo, a photo of one of its options or of its label, an outlet photo, a business logo or a profile photo is saved, an automated check looks at it and refuses it if it appears to show nudity, gore, weapons or drugs, or if words in it are offensive. It uses two openly published machine learning models: one recognises what a picture shows, the other reads text in it. A refused picture is not kept; the scores the check gave are written to our technical records (section 6) without the picture; and pictures are not used to train any model today (4.3). The check can be wrong in either direction. If a picture is refused wrongly, write to support@cuscato.com.

4.2A Your Day, Explained. For each business, once a day, Cuscato writes a few sentences about the business's previous day from that business's own aggregate figures - sales, orders, average order, the margin where the business entered cost prices, discounts, samples, refunds, cancellations, credit notes, money still owed, the products that sold most and least, products viewed a lot but rarely bought, and the busiest hours. The figures contain no customer's name, phone number, email or address and no personal data. The sentences are written by a fixed template or by an AI model; they are not used to train any model today (4.3). AI-written text can be wrong and can differ each time. Owners and administrators see the figures and the sentences; staff see a version with counts only, and salespeople and riders do not see it. The text and its figures are kept 90 days, deleted when the business closes, and are in the owner's export.

4.2B Start from a photo. When a business adds a product, AI may suggest details from a photo the business chooses: what the product seems to be, a name, a category, a description and what a pack's label seems to say. One photo, such as a counter with a price tag under each tray, a collage with a caption on each picture, or a printed, painted or handwritten menu or rate card, may give suggestions for several products: the text in it, price tags, captions and a menu's item names, prices, sizes, section headings and descriptions included, is read to suggest each product's name and price, a menu item's sizes, section and description, and the part of the photo that shows it. A counter, shelf, jar display or box of items with no price tags may give a suggestion for each different item it shows: what it seems to be, a name, a category, how it may be sold and the part of the photo that shows it; no price is read, so the business enters each price. A photo may be turned or straightened so that its text can be read. When the automatic picture check would refuse a photo only for what it seems to show and the photo reads as a menu or rate card, its text may still be used for these suggestions, but no part of that photo is offered as a product photo. A PDF menu is opened in the business's own browser and pictures of its first pages are sent and read like photos; the PDF itself is not sent. When a photo that looks like a phone screenshot is read for several products, its status bar and the browser's bars are cut off first and their text is not used for those suggestions; the name of a stock-photo site seen anywhere in the photo is used only to warn the business. When a photo gives a suggestion for one product, the text read from the whole photo, a screenshot's bars included, may be used for that suggestion and is shown back to the business, as for any photo. The photo is used for that request only. Neither it nor the text read from it is kept, except that a photo, or a part of it, that the business adds to a product becomes a product photo and is checked like any other upload (4.2 applies). The business checks every suggestion before saving; AI results can be wrong and can differ each time.

4.2C Reading verification documents. When a Merchant uploads a verification document that is a scan or a photo, automatic text recognition reads it to fill in the Merchant's form and to pre-tick the checks our reviewers make (2.3). A reviewer decides every case; nothing is approved or refused by the reading alone, and only the details found are kept, never the document's whole text.

4.2D The assistant. The app and each Storefront have an Ask box. A question typed there is matched to the kind of question it is by an openly published machine learning model that runs on Cuscato's own server; it is not sent to any outside AI service and the model writes no text. The answer comes from what the person asking can already see in the app or on the Storefront - for a Customer, what the Storefront shows everyone and, when signed in, their own Orders and Bookings - and the assistant never changes anything. A question it answered is not kept; when one message asks several things, only the parts it could not answer are kept. A question it could not answer, or that is not about the business, is kept for 90 days. Before it is stored, the assistant removes every email address, UPI ID, PAN and GST number, order and booking number, and every run of six or more digits however it is written (a phone, Aadhaar, account, card or UPI reference number, a PIN code), and, from a question the business's team asked, the names of the business's customers, team and riders that the assistant knows, and it masks abusive words. Nothing else is removed automatically, so do not type other personal details (such as a name or an address) into the Ask box. It is kept with the business, whether a Customer or the team asked, the assistant's best guess and when; it is linked to the account that asked only so that it is deleted with that account. Cuscato uses these questions for a purpose of its own: to improve the services it provides to Customers and Merchants. Our team reads them, without seeing who asked, to make the assistant answer more questions, and they may be written into the examples it learns from (4.3). For this use Cuscato is the Data Fiduciary (1.2): ask us, not the Merchant, about them.

4.3 Artificial intelligence, at our discretion. We decide where and when the Platform uses artificial intelligence, and we may add, change or stop any AI feature at any time; 4.2, 4.2A, 4.2B, 4.2C and 4.2D describe how it is used today, not a promise that it will or will not be used elsewhere. Whatever we use: results that AI produces can be wrong and can differ each time, so check them; AI is used only for the purposes this policy already gives; and personal data goes to an AI service run by another company only after we name that company in this policy and have a written contract with it that forbids training on the data. Today nothing you or a business puts on the Platform is used to train a model, except the assistant's unanswered questions, with contact details and ID numbers removed, as 4.2D describes. We may decide to train or improve models in future; before any data is used for that, we will publish a new version of this policy saying what is used and how, and personal data will be used only with what identifies you removed, or with your consent where the law requires it.

5. Browser storage

The Platform stores up to sixteen items in your browser's local storage, and four in its session storage, which the browser deletes when the tab is closed:

The Platform also registers a service worker: a small script your browser keeps for this site, so it can be installed as an app and open without a connection. In the browser's cache it keeps our "you're offline" page, a copy of this site's pages as anyone gets them without signing in, and the app's own program files (scripts, styles and fonts, at most 400, the oldest dropped first) - none of which holds anything about you. After you open a Storefront, it also keeps one copy of that Storefront's public details - the business's name and kind, its outlets, and its categories, products, descriptions, prices, tax rates, options and food marks, exactly as anyone sees them without signing in, and no pictures - so the Storefront can still be read when you have no connection. The service worker fetches that copy itself, without your sign-in or any cookie; nothing you see while signed in is ever kept. The copy is used only when there is no connection, replaced on a later visit (at most every five minutes), deleted when the Storefront is no longer open to the public, and never shown once it is 30 days old (it is deleted the next time it is asked for). Nothing can be ordered, booked or paid from it: while you are offline the Platform refuses every change at once and keeps nothing to send later. It also shows the push notifications described in clause 2.2 if a team member or a Customer turned them on. It stores nothing about you; a new version of the app replaces these copies, and uninstalling the app or clearing the site's data removes them.

Your sign-in token is sent in a request header and kept only in the open page's memory; the renewal key that keeps you signed in is the cuscato_session or cuscato_account cookie (section 3), which scripts on the page cannot read. Signing out removes the cookie and your account details; clearing your browser's site data removes all of them. The other cookies are Microsoft Clarity's and Google Analytics', once you allow analytics; Meta's and Google's advertising cookies on cuscato.com's own pages, once you allow marketing; and our network provider's security cookies (__cf_bm and cf_clearance), as section 3 says.

6. Technical records

Like any web service, our servers receive what your browser sends with each request - network address, browser type, the page requested and the time - and it may appear in logs. We use it only to run and secure the Platform and fix faults, not to profile you or for advertising. Warnings and errors are recorded in our database and kept for up to 180 days. Our servers' own system log also holds the service's messages, including those warnings and errors, so that we can diagnose a fault, and keeps them for up to 180 days. Indian cyber-security directions require certain logs to be kept in India for 180 days. When a business's or an outlet's payment details (UPI ID, payment link, which of them customers see) or tax details are changed, we record who changed them, when, and what changed (with a UPI ID partly hidden, a payment link shown by its host only, and a PAN or an Importer-Exporter Code shown by its last four characters), and email the business's owners about it.

When something goes wrong in your browser or a request to us fails, the page sends us a short error report: the page address without anything after a "?", the error message and where in our code it happened (or, for a script from another site or a browser extension, that script's address without anything after a "?"), the app version, whether the page was open in a browser tab or as the installed app, how long since the page was last brought back to the screen, your browser's name and main version number, the time, and which shop's address it was on. It never includes your account, your network address, the full browser description or anything you typed; email addresses, phone numbers and long numbers are removed before it is sent. Repeats of the same error are counted, not stored again. We keep an error for up to 15 days after it last happens, to find and fix faults, and may delete it sooner.

7. Who we share it with

• The Merchant you dealt with sees your Orders, their Invoices and history, your Bookings and its own record of you. The Merchant may give an Invoice to tax authorities as the law requires.
• Other Merchants: never. Merchants are separated in the database itself, and a Merchant receives your details only after you agree to share them with it.
• A Merchant you report receives a copy of your notice, as clause 2.6 describes.
• The Merchant or Customer a complaint is about may receive the complaint, with the complainant's name and files, as clause 2.8 describes.
• The Merchant's own payment provider, when you pay through a link the Platform made on the Merchant's account: the Order number, the amount and the Merchant's or outlet's name, as clause 2.1 describes. The provider acts for the Merchant under its own terms.
• An AI assistant the Merchant connects (for example Claude or ChatGPT), only if the Merchant's owner or an administrator connects one and approves it: while connected it can read what that login can read in the Platform - Orders with the Customer's name, phone number, delivery address and notes, Bookings, products and sales figures - and, if they allowed changes, change an Order's status, a product's price or stock, or mark it sold out. The Merchant chooses the assistant and its provider, which acts for the Merchant under its own terms and is not run by us, so we are not responsible for what it does with the data it reads; we send nothing to an assistant the Merchant has not connected, and an owner or administrator can disconnect it at any time.
• The public sees a Merchant's Verified business badge details (clause 2.3). No Customer's personal data is published.
• Service providers who host the Platform or deliver our emails (today Zoho ZeptoMail, run by Zoho Corporation, for every email the Platform sends), and any service we use to look up a Merchant's documents in a public register, bound to use the data only for that service. Our hosting providers run the servers and the database that hold the Platform's data, in locations we choose (section 13).
• OpenFreeMap, which serves the maps shown during a delivery (section 3): your browser fetches the map of the area on screen from it directly, so it receives your network address, the address of the business's site and that area (around the delivery address, the outlet and the rider), never your name, the Order or an exact position.
• Our mailbox provider, Zoho Mail (Zoho Corporation), which holds the copies of contact-form and early-access messages we receive by email (clauses 2.8 and 2.9), and of the notices we send ourselves when a business signs up or sends its verification for review (clause 2.3).
• The push service of a team member's or Customer's browser - Google, Apple, Mozilla or Microsoft, chosen by the browser's maker, not by us - carries the push notifications described in clause 2.2. It receives the device's push address and each alert encrypted, which it cannot read.
• Our messaging providers deliver our SMS and WhatsApp messages, to serve and improve the experience of the businesses on Cuscato and their customers. Each provider receives the mobile number and the text of each message it carries (clause 2.1). A WhatsApp message also passes through WhatsApp's own business messaging service. We send SMS and WhatsApp messages for authentication (sign-in and verification codes), for service (messages about an account, an Order or a delivery) and, only with consent given by its own box or switch, for promotional and marketing purposes - those only to the business owner who agreed, never to a Merchant's Customers. SMS goes to numbers in India only.
• UrbanPiper (UrbanPiper Technology Pvt. Ltd.), which relays orders between delivery platforms and the businesses that use Cuscato's order channels: Cuscato sends it the business's menu, prices, stock, opening state and each platform order's status; it sends Cuscato the platform orders.
• A timestamping service, when it dates our daily record of acceptances, receives only a fingerprint of those records, never the records themselves.
• Our payment processors, Razorpay, Cashfree or PayPal (Razorpay Software Private Limited, Cashfree Payments India Private Limited, and PayPal (PayPal Payments Private Limited, which holds our account, and the PayPal company that serves the payer), for a business established outside India that pays in US dollars, euros or pounds sterling), only when a Merchant pays its subscription to Cuscato online. To create the payment link we share the paying owner's or administrator's name (the business's name when that login has none), email address and (for Cashfree) mobile number, and a description of the payment: the plan, the billing period, the number of extra outlets, the amount and the business's web address, which is also where the processor sends the payer back to. PayPal receives the description, the amount and its currency, our reference for the payment and that web address, but not the name, email address or mobile number: the payer signs in to PayPal, or gives PayPal their details, on PayPal's own page, and PayPal may process them outside India. The processor collects the payment details itself; we do not receive or keep card numbers, UPI IDs or bank account details. We keep a record of each subscription payment: the plan, period, amount, the processor's payment reference and who started it, the receipt number, and the business's name and legal name as they stood when the receipt was issued; we email a payment receipt for each payment we record to the business's owners, who can also see it later in the Platform. For each payment we record, other than a test payment or one through Paddle (below), we also issue an invoice, and a credit note for each refund of it, which keep the business's name, legal name (for a sole proprietor, a person's name), address, State, country, (for a business in the European Union, the United Kingdom or the Isle of Man) its VAT number, and (while the business is open) web address as they stood when the invoice was issued. The owners see the invoices, with their refunds, in Settings > Plan; we email an invoice when an owner asks for it there, and each credit note to the business's owners (for a business that has closed, both to the contact kept when it closed, with no link to the Platform). A payment we do not apply (another amount or currency, a second payment through a link already paid, or a late payment another payment already covers) is refunded in full and gets no receipt, no invoice and no credit note; we keep what the processor reported about it (amount, currency and its payment reference): for the first such payment on a link, with the payment link; for any further one, only in our error log, for as long as that log is kept (section 6). The processors receive none of the receipt, invoice or credit note details.
• Paddle, our reseller for plans outside India (Paddle.com Market Limited, or the Paddle company its checkout names). Where we offer it, a business established outside India buys its Cuscato plan from Paddle, which sells it as our reseller and merchant of record. We send Paddle a description of the payment (the plan, the billing period, the number of extra outlets and the business's web address), the amount before tax and its currency, our reference for the payment and the page of that web address the payer returns to; not the payer's name, email address or mobile number. On Paddle's checkout the payer gives Paddle their email address, country and, where Paddle asks, postcode, address, business name and tax number, and their payment details; Paddle uses them as a controller under its own privacy notice - to sell the plan, work out and account for the tax, issue the invoice and prevent fraud - and may process them outside India. Paddle tells us whether the payment was made, its amount, tax and currency, and its own references for it: we keep the amount, currency and Paddle's reference with the subscription payment, and the tax and total in our record of each call to Paddle (which holds nothing about the payer); we never receive card or bank details. When Paddle refunds such a payment, we keep a record of the refund with the payment: Paddle's reference for it, the amount before tax and with it, the currency, the reason and when Paddle made it, after checking them with Paddle. We issue no invoice or credit note for a payment through Paddle: Paddle issues them.
• Our network provider, Cloudflare, which carries and protects all traffic to and from the Platform: every request and response passes through it, including your network address and what you send and receive. It may handle that traffic outside India. It also stores our encrypted database backups (section 13), which it cannot read, and, if you allow analytics, counts page views with Cloudflare Web Analytics (section 3).
• Microsoft, for Clarity (Microsoft Corporation), which tells us how the Platform is used: it receives what section 3 describes, with text typed into forms, and all text on the screens that show personal data, hidden from it. We use what it shows us only to improve the Platform, and it is told never to use it for advertising.
• Meta Platforms, for the Meta Pixel and its Conversions API, and Google, for Google Ads and Google Analytics (Meta Platforms Ireland Limited and Meta Platforms, Inc.; Google LLC), on cuscato.com's own pages only and only with your consent: they receive what section 3 describes - the pages visited, that a business sign-up happened and, for Meta, the hashed email address and mobile number of the person signing up - so we can measure and improve Cuscato's own ads. They act under their own terms and privacy policies.
• Google Maps, only when someone follows a map link. The Merchant's staff and delivery people can open a delivery address, the location a Customer shared at checkout, or the position recorded at a delivery step, in Google Maps, and a Customer can open their own delivery address and shared location from their Order, and the map link of an outlet whose Merchant shows its location; following such a link sends that address or position to Google.
• Authorities, where the law or valid legal process requires it, or to protect life or safety or to establish or defend a legal claim. Where the law allows, we tell you and, for Merchant data, the Merchant.
• A successor in a merger or sale of our business, under equivalent protection.

We do not sell or rent personal data. Only with your consent, and only on cuscato.com's own pages, do we share the data section 3 describes with Meta and Google to measure and improve Cuscato's own ads - never data from a Storefront or about a Merchant's customers.

Requests from authorities. When a court, the police, a regulator or another public authority asks us for personal data, we: (a) check that the request is lawful and is made under a law or legal process that applies to us, such as a court order or a notice under India's criminal procedure or information technology laws, before we answer it; (b) refuse or challenge a request that we consider unlawful, too broad or not properly made; (c) give only the data the request lawfully requires and nothing more, for the person, Merchant or period it names; and (d) keep a record of each request, who made it, the legal basis it relied on, what we gave and why. Where the law allows, we tell the person concerned and, for a Merchant's data, the Merchant before we disclose it.

8. How long we keep it

Where the law requires a record to be kept, an erasure request cannot override it; we will tell you why.

Data deleted from the Platform can remain in our encrypted database backups until they expire, at most 40 days later, or 40 days after a copy delayed by an outage reaches our backup storage (section 13).

9. Security

There are no passwords: you sign in with a one-time code. Codes are random, stored only as a keyed hash, expire after a short time, work once, and are limited in how often they can be requested and guessed. The one exception is Cuscato's own test accounts on its demo shops: for as long as we run the demo, a reviewer we invite (for example a payment provider or an investor looking at the site) signs in to such an account with a fixed code we give them. It never works on a real shop, nor for an address that belongs to one. Asking for a code gives the same response whether or not an account exists. Your sign-in is renewed automatically, while a Cuscato page is open and when you come back to one, with the renewal key kept in your browser: each renewal replaces both the stored token and the key, and the old ones stop working at once. We keep only a keyed fingerprint of the key, never the key itself. A key that is used again after it was replaced (other than within seconds, as two tabs of one browser can) ends that sign-in and every token made from it, because only a copy could have been used again; two days after it was replaced it is no longer recognised and simply does not work. Signing out with only the short-lived token also ends the sign-in it came from. A sign-in lasts at most 30 days from the last code you entered, then you sign in again. Signing out ends the sign-in on our servers as well as in your browser on that device; a business deactivating you on its team or changing your role there ends it on every device. Merchants' data is separated by the database itself. Stored encrypted: the documents a business uploads for verification; the numbers as recorded with its PAN card, FSSAI licence or registration, trade and other licences and its other documents (not the GST and Importer-Exporter Code certificates); what our document reader read from each document; and the business's PAN. They are opened only when the Platform uses them: to show them to that business and to the Cuscato staff who review them, for our document reader (4.2C), in the business's own data export, and, for the licence numbers a verified business shows, on its public Verified badge (clause 2.3). Readable, and why: its GSTIN (which contains the PAN) and Importer-Exporter Code, TAN, CIN and TIN, which the law prints on bills, labels and shipping papers and which are in public registers; the FSSAI licence or registration numbers and trade licence numbers it enters on its business profile, its outlets and its product labels, which the law has it show to customers on its Storefront and labels; the results of looking a number up in a public register; and an Aadhaar's last 4 digits. No system is perfectly secure; these are the measures in place, not a guarantee.

10. Your rights

Wherever you are, you may ask for a summary or a copy of the personal data we hold about you and how it is used, ask for it to be corrected, completed, updated or erased, ask for a copy in a common electronic format, object to our using it, and withdraw a consent you gave. Some of these rights have limits in law (for example, records the law requires us to keep), and section 18 adds what the law of your country gives you. Where your account has a switch for it (such as order updates by SMS or WhatsApp) you can withdraw there; otherwise write to us as below. Withdrawing does not undo anything done before you withdrew. You may also nominate another person to exercise these rights for you if you die or become unable to. Write to support@cuscato.com with "Privacy" in the subject; we may ask you to confirm it is you. For Order or Booking data, clause 1.3 applies.

Stopping sharing with a Merchant. You can do this yourself: on its Storefront, sign in, open Your Account and, under Stop Sharing With the business, choose Stop Sharing and Delete My Details. A code sent to your email confirms it is you. This ends your link with that Merchant only and deletes your details in its records; your Cuscato account and your links with other Merchants stay, and you can link again later. Section 8 says what is deleted and what the law requires to be kept. To close your Cuscato account altogether, delete it in your account on cuscato.com, or write to us as above: that ends your link with every Merchant and deletes your details in each one's records as section 8 describes, and your list of Orders across Storefronts goes with it; each Order's items, amounts, taxes and Invoice stay with the Merchant as the law requires. If you own a business, the record of free trials already given (section 8) stays: it holds no address or number, only a keyed fingerprint with the business it was for and the date, and exists only to stop free trials being taken again and again. A record a Merchant's staff made of you that is not linked to your account, such as a lead, is the Merchant's: ask the Merchant to delete it.

If you are not satisfied with our answer, use the process on the Grievance page. Once the complaint provisions of the Digital Personal Data Protection Act, 2023 are in force, you may also complain to the Data Protection Board of India. Section 18 names the authority you may complain to in some other countries.

11. Emails and marketing

Sign-in codes and notices are sent by email from noreply@cuscato.com, which does not accept replies and is not monitored; so are a welcome email when you create an account or join a business, the order and booking emails described in clause 2.1 and, where a business switches it on, a daily summary of its figures to its owners and administrators, which begins with that day's Your Day, Explained (4.2A). Where they are offered, SMS and WhatsApp messages go for authentication and service purposes, and for promotional and marketing purposes only with your consent, which you can withdraw at any time (clause 2.1). Accepting these documents does not sign you up to marketing: a business owner gets offers and updates about Cuscato only by ticking the separate box at sign-up (never pre-ticked) or switching them on in Settings, and can switch them off there at any time. A Merchant records marketing consent separately, never pre-ticked, and you can withdraw it at any time.

12. Children

The Platform is not for anyone under 18: everyone who creates an account confirms they are 18 or older, and we do not knowingly collect children's data. If you believe we hold any, write to support@cuscato.com and we will delete it, except records the law requires us to keep.

13. Where data is held, and transfers

13.1 Cuscato is in India. The Platform's data is held on servers and a database that our hosting providers run for us, in locations we choose; a Merchant may ask us for the providers' names and locations. Backups of the database are encrypted on our server before they leave it and are kept in Cloudflare's storage service, which may hold them outside India, for up to 40 days from when each copy reaches it; only Cuscato holds the key that opens them. A copy is also kept on our server for about 8 days (up to 15 days for the copy the oldest of them starts from, and up to 40 days for a copy that could not yet be sent to Cloudflare). Where Indian cyber-security directions require logs to be kept within India's jurisdiction, we keep them as those directions require (clause 6). SMS and WhatsApp messages (clause 7) are handed to our messaging providers, and WhatsApp messages also to WhatsApp's own service, which may process the mobile number and the message outside India to deliver it; we use them only for authentication, service and, with consent, promotional and marketing messages. Traffic to and from the Platform passes through our network provider, Cloudflare (clause 7), which may handle it outside India, and how pages are used goes to Microsoft Clarity and Cloudflare Web Analytics (clause 3), which may also process it outside India; the marketing tags on cuscato.com's own pages send page visits and sign-ups to Meta and Google (clause 3), which may process them outside India; a map shown during a delivery is fetched from OpenFreeMap (clause 3), which may serve it from outside India. The push service of a team member's or Customer's browser (clause 7), chosen by the browser's maker, may handle the device's push address and the encrypted alerts outside India. A business established outside India that pays its subscription through PayPal (clause 7) pays on PayPal's own page, and PayPal may process that payment outside India; one that pays through Paddle (clause 7) pays on Paddle's checkout, and Paddle may process what the payer gives it outside India. Today the Platform's servers and its database are in the European Union, and Cuscato's team reaches them from India; a Merchant may ask us for the providers' names. We will update this section before moving them to another country.

13.2 If you are outside India. When you use the Platform from another country, your data comes to us in India and is held as 13.1 says. India has not been found by the European Commission, the United Kingdom or Switzerland to protect personal data to the same standard as their own law. Where the law of your country requires a safeguard for data leaving it, we use the one that law provides: for data a Merchant or Cuscato sends from the European Economic Area, the United Kingdom or Switzerland to Cuscato or to our service providers, the European Commission's standard contractual clauses (with the United Kingdom's addendum and the Swiss adjustments), as clause 13 of the Data Processing Agreement sets out. When you give your data to us directly from another country, that is not itself such a transfer, but we protect it as this policy says. You may ask us for a copy of the safeguard we rely on.

14. Breaches

We report cyber-security incidents to the Indian Computer Emergency Response Team as its directions require, and notify affected Merchants so they can make their own notifications. Once the Digital Personal Data Protection Act, 2023 requires it, we will also tell you, and the Data Protection Board of India, about a personal data breach that affects data we are responsible for, in the way the law sets out. Where the law of another country requires us to tell you or a regulator about a breach of data we are responsible for, we do so as that law requires; for data we hold for a Merchant, we tell the Merchant, which makes the notifications its law requires of it.

15. Links to other sites

A Storefront may link to other sites. Their own privacy policies apply, not this one.

16. Changes

Each version carries a number at the top of this page in the form major.minor.patch (for example 1.0.0), and a changed text is never published under an old number. The major number goes up when a change materially affects you; the minor number for a clarification, and the patch number for a correction such as a typo, neither of which changes what you agreed to. Before the Platform's public launch, every change, whatever its size, was published as a patch; since the launch, each change takes the number its size calls for. If a change materially affects you, we will ask you to read and accept the new version the next time you use your account, and record that you did as in section 2.1.

17. Contact

Write to support@cuscato.com with "Privacy" in the subject. Complaints are handled as described on the Grievance Officer page.

18. If you are in a particular country

Everything above applies wherever you are. This section adds what the law of some countries gives you. It applies where that law applies to what we do with your data; for your Orders, Bookings and a Merchant's records of you, the Merchant is responsible (section 1.1) and we help it answer you.

18.1 India

The Information Technology Act, 2000 and its Rules (including the SPDI Rules, 2011 and the Intermediary Guidelines, 2021), and the Digital Personal Data Protection Act, 2023 as its provisions come into force, apply as sections 1 to 17 describe: your rights in section 10, including nominating someone; our Grievance Officer and, once in force, the Data Protection Board of India (section 10); breach reporting (section 14); and the logs kept under the Indian cyber-security directions (clause 6). For a decision of ours on content, you may also appeal to the Grievance Appellate Committee, as the Grievance Officer page explains.

18.2 The European Economic Area, the United Kingdom and Switzerland

Who is the controller. For the data in clause 1.2, Cuscato is the controller; contact us at support@cuscato.com with "Privacy" in the subject. For your Orders, Bookings and a Merchant's records of you, the Merchant is the controller and Cuscato its processor (clause 1.1). We have not appointed a data protection officer, or a representative in the European Union, the United Kingdom or Switzerland, and none is appointed today. When we appoint one, we will name it here; until then, write to us at the address above, and you may complain to your local data protection authority.

Why we may use your data (our legal bases).

Where we rely on legitimate interests, we have weighed them against your interests and rights; you may ask us how. You need to give your email address to have an account, and a Merchant needs the details it asks for to fulfil an Order; everything else is optional.

Your rights. You have the rights of access, rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interests, and the right to withdraw consent at any time without affecting what was done before. Ask as in section 10. You may also complain to the data protection supervisory authority where you live or work or where you think the law was broken - in the United Kingdom, the Information Commissioner's Office, and in Switzerland, the Federal Data Protection and Information Commissioner.

Automated decisions. We make no decision based solely on automated processing that has a legal or similarly significant effect on you. The picture check (clause 4.2) and the email check (clause 2.1) decide automatically whether an upload or an address is accepted; you may ask a person to look again by writing to support@cuscato.com. The customer tier and value estimate (clause 4.1) are profiling done for the Merchant and change no price you are offered.

Transfers and retention. Your data is held and transferred as section 13 says, and kept for the periods in section 8.

18.3 The United States, including California

Where a United States state privacy law, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act, applies to us:

• What we collect, from where and why. In the last 12 months we have collected the categories in section 2: identifiers (name, email address, mobile number, network address, account identifiers); customer records (billing and delivery details); commercial information (Orders, Bookings, payments recorded and subscriptions); internet or other electronic network activity (technical records, device descriptions and how pages are used, section 3); geolocation (an approximate place worked out from the network address when you accept a document; a precise position only when you choose to share it, or while a Merchant's delivery staff carry your Order (clause 2.2)); visual information (photos, pictures and signatures); professional information (a staff member's role); and inferences (the customer tier and the estimate of your spend with a Merchant over the next year). We collect them from you, from Merchants and their staff, from your browser and, for Merchants' documents, from public registers. We use them for the purposes in sections 2 to 4, keep them as section 8 says, and disclose them for a business purpose only to the recipients in section 7.
• Sensitive personal information. A precise position, and any health information written in a special request, are used only to provide what was asked for, as section 3 and clause 2.1 say, and never to infer anything about you.
• We do not sell personal information. On cuscato.com's own pages, and only if you choose Marketing, the Meta Pixel and Google Ads receive what section 3 describes, which may be "sharing" for cross-context behavioural advertising; never with data from a Storefront and never for anyone we know to be under 16. You can opt out at any time with "Cookie Settings", and a Global Privacy Control signal is treated as an opt-out: with it the tags are never loaded and no sign-up is sent to Meta. We do not disclose personal information to others for their direct marketing.
• Your rights are to know what we collect and how we use and disclose it, to get a copy, to correct it and to delete it, and not to be treated differently for using these rights. Ask as in section 10; we may ask you to confirm it is you, for example with a code sent to your email address. An agent you authorise may ask for you, with your signed permission. If we refuse, you may appeal by writing to us with "Privacy appeal" in the subject.
• For your Orders, Bookings and a Merchant's records of you, the Merchant is the business and Cuscato its service provider: ask the Merchant, or write to us and we will pass your request on.

18.4 The United Arab Emirates

Where Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies (it does not apply in a free zone with its own data protection law, such as the Dubai International Financial Centre or Abu Dhabi Global Market, where that law applies), you may ask for information about the processing of your data, for a copy of it in a structured, machine-readable form, for it to be corrected or erased, and for its processing to be restricted or stopped; you may object to a decision based solely on automated processing that has legal effects for you; and you may complain to the UAE Data Office. Ask as in section 10.

18.5 Other countries

Wherever you are, you may use the rights in section 10, and nothing in this policy takes away a right the law of your country gives you that cannot be excluded.