Privacy Policy
Last updated: 18 August 2026
This policy explains what personal data Vattam collects, why we collect it, where we store it, and what rights you have. Vattam is operated by Sidharth Nedumangattu Babu, a sole proprietor in Kerala, India ("we", "us"). We are a Data Fiduciary under the Digital Personal Data Protection Act, 2023.
1. Who this policy covers
Two groups of people:
- Restaurant owners who subscribe to Vattam.
- Diners who earn loyalty points at a restaurant that uses Vattam.
2. What we collect and why
From restaurant owners
| Data | Why |
|---|---|
| Name, business name, email, phone | To create and support your account |
| Business address | Invoicing and account verification |
| Payment provider account identifier | To read payment notifications for your outlet |
| Subscription and billing records | To bill you and meet tax obligations |
From diners
| Data | Why |
|---|---|
| A one-way encrypted reference derived from your UPI ID | To recognise you as a returning diner and credit your points. This reference is different at every restaurant, so your visits cannot be linked across businesses. |
| Payment amount and date | To calculate points earned |
| Points balance and reward history | To operate the loyalty programme |
| Mobile number and display name (only if you choose to claim your points) | To let you sign in and see your balance |
We do not collect your bank account number, card details, UPI PIN, or any payment credential. We never see them. We do not track your location, and we do not build a profile of you across restaurants.
3. Consent
Before we collect your mobile number or name, we show you a clear notice describing exactly what we will store and why, and we ask for your consent. You may withdraw that consent at any time, and withdrawing it is as easy as giving it. Points earned before withdrawal remain usable at the restaurant until you ask us to delete your record.
4. Where your data is stored
All personal data and all payment-related data is stored on servers located in India (Mumbai region). Payment-related data is not stored outside India, consistent with the Reserve Bank of India's directive on Storage of Payment System Data dated 6 April 2018.
5. Who we share it with
- The restaurant you visited sees your loyalty activity at their outlet only — visit count, points and spend. They do not see your UPI ID.
- Our infrastructure provider (Google Cloud / Firebase, India region) stores data on our behalf under contract.
- Our payment provider processes payments and subscriptions.
- Government authorities, where we are legally required to disclose.
We do not sell personal data. We do not share it for advertising.
6. How long we keep it
Diner loyalty records are kept while the restaurant's subscription is active and for 12 months afterwards, then deleted. Billing records are kept for 8 years as required by Indian tax law. If you ask us to delete your data, we do so within 30 days, except where law requires us to keep it.
7. Your rights
Under the Digital Personal Data Protection Act, 2023 you may:
- Ask what personal data we hold about you
- Ask us to correct or complete it
- Ask us to erase it
- Withdraw your consent
- Nominate another person to exercise these rights if you are unable to
- Raise a grievance with us, and escalate to the Data Protection Board of India
To exercise any of these, email contact@vattam.space with the subject "Data request". We respond within 30 days.
8. Deleting your account and your data
If you are a restaurant owner
Email contact@vattam.space from your registered address with the subject line "Delete my account". We acknowledge within 2 working days and complete deletion within 30 days.
Cancelling your subscription does not delete your data. If you want your data erased, ask us explicitly. We can export your records for you first — ask before you request deletion, because we cannot recover anything afterwards.
| What we delete | What we must keep, and why |
|---|---|
|
Your account and login Your name, email and business contact details Your business address and outlet settings Your payment provider account reference All diner loyalty records belonging to your outlet Your analytics history |
Invoices and payment records for your subscription, for 8 years, as required by Indian tax law. These are moved to a restricted archive used only for tax and audit purposes. They are not used for any other purpose, and no diner personal data is kept in them. |
If you are a diner
Email us with the subject line "Delete my points", or use the Delete my data option on your points page. We delete your mobile number, your name, your points balance, your reward history and the reference derived from your UPI ID, within 30 days.
Your points are lost when you do this and cannot be restored. The restaurant keeps only anonymous totals — such as how many visits it received in a month — which cannot identify you.
If a restaurant leaves
When a restaurant stops using our service, the diner records for that outlet are deleted 12 months later, whether or not anyone asks.
9. Security
Data is encrypted in transit and at rest. UPI identifiers are stored as one-way hashes with a per-restaurant salt. Access is restricted to the operator of Vattam. If a personal data breach occurs, we will notify affected individuals and the Data Protection Board of India as required by law.
10. Children
Vattam is not intended for anyone under 18. We do not knowingly collect data from children.
11. Changes
If we change this policy we will update the date above and, for material changes, notify account holders by email.
12. Grievance contact
Sidharth Nedumangattu Babu
Nedumangattu House, Elackad P.O., Vayala, Kottayam, Kerala 686587, India
Email: contact@vattam.space