Privacy Policy

Ronavi Curations Private Limited, operating as Cafe South Central ("we", "us", "our"), runs this website and our outlets. This policy explains what personal data we collect, why we collect it, who we share it with, where it is stored, and the choices you have. It is written to comply with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023.

1. What we collect

1.1 Information you give us

1.2 Payment information

• Payments are processed by Razorpay. Your full card number, CVV, UPI PIN and bank login details are entered in Razorpay's payment window and never reach or are stored on our servers.
• We receive only what we need to confirm the payment: the transaction ID, amount, payment method type and status.

1.3 Collected automatically

• Device and browser information, such as browser type, operating system and device type.
• IP address and server logs, used for security, fraud prevention and fixing errors.
• Push notification subscription, only if you allow notifications.

• Visit counts. We use Cloudflare Web Analytics to count visits to the customer pages of this website: the page viewed, the site that sent you here, your browser and device type, your country and how fast the page loaded. It sets no cookies and stores nothing on your device, and it is not linked to your name, mobile number or account. You can turn it off (see section 3).

We do not collect your GPS location, and we do not use advertising or cross-site tracking tools such as Facebook Pixel. We do not use Google Analytics or any other analytics service. If we ever do, we will update this policy first.

2. How we use it

• To create and manage your account and verify your identity.
• To take, prepare and hand over your orders, and to send confirmations and status updates by SMS, push notification or on screen.
• To process payments, refunds and wallet credit.
• To provide customer support and handle complaints.
• To prevent fraud, misuse and security incidents.
• To keep accounting and tax records, and to comply with the law.
• To understand which dishes are popular and improve our menu and service.
• Marketing: occasional offers, sent only with your consent. You can opt out at any time (see section 7). Order updates are not marketing and will still be sent.

We process your data because you asked us to provide a service, because you consented, or because the law requires it.

3. Cookies and local storage

• Essential cookie: a secure sign-in cookie keeps you logged in for 30 days (see section 6.1). It cannot be read by scripts in the page.
• Local storage: your cart and a copy of the menu are kept in your browser, so the site keeps working on a weak connection and your cart survives a refresh.
• No advertising or analytics cookies are used.
• Your choice on the cookie banner: choosing Decline turns visit counting off in that browser from then on. Your answer is kept in local storage, so clearing it brings the banner back.

You can clear cookies and local storage in your browser at any time. If you do, you will be signed out and your cart will be emptied.

4. Who we share it with

We never sell your personal data, and we never share it with advertisers.

We share data only with the service providers that run the website, and only what each one needs:

Outlet staff see your name, token, order details and instructions so they can prepare and hand over your order.

Legal disclosures. We may disclose data where the law requires it, for example to courts, tax authorities, food-safety or consumer-protection authorities, or the police in cases of fraud or crime. We do not share your information with the administration of the campus where an outlet is located unless the law requires it.

5. Where your data is stored

Your personal data is stored in India: our website, main database and cache are hosted in Bengaluru and Mumbai. Pages and images are delivered through a global content-delivery network, visit counts are processed on Cloudflare's global network, push notifications pass through your browser's own push service, and sign-in code emails are sent through Resend in the United States, so limited data may be processed outside India. Any such processing is done in line with Indian law, including any restrictions the Government of India notifies under the Digital Personal Data Protection Act, 2023.

6. How we protect it

• All connections to the website are encrypted (HTTPS/TLS).
• Data is encrypted at rest by our database and hosting providers.
• Only authorised staff can access customer data, and each staff member sees only what their role needs.
• Sign-in uses one-time codes, with limits on repeated attempts (see section 6.1).

No system is completely secure. If a breach affects your personal data, we will inform you and the relevant authorities as the law requires.

You can help: never share your sign-in code, and sign out on shared devices.

6.1 Sign-in codes

You sign in with your mobile number and a six-digit one-time code. There is no password on a customer account.

• The code is generated by a cryptographically secure random generator, so it cannot be guessed or predicted from other codes.
• It is valid for 10 minutes and can be used once. After that it is deleted automatically.
• Codes are held only in our temporary cache (Upstash, Mumbai) for those 10 minutes. They are never stored in your account record and are not visible to our staff, including administrators.
• Three wrong attempts locks sign-in on that number for 15 minutes. You can request at most 3 codes in 5 minutes and 20 in a day, and there are further limits per network and across the site as a whole. These limits exist to stop someone else attacking your account and to prevent bulk-messaging abuse.
• Where the code is sent. Indian carriers require every SMS template to be registered under the TRAI DLT scheme, and our registration is still in progress. Until it is approved, codes are sent by email through Resend, and we ask for your email address for that purpose alone. Once SMS is approved the code will arrive by SMS instead. Your mobile number identifies your account either way — an email address is only a delivery route.
• Staying signed in. A successful sign-in sets a secure, script-inaccessible cookie that keeps you signed in for 30 days, after which you sign in again. Signing out clears it immediately.
• We will never ask you for your code — not by phone, SMS, email or in person. Nobody at Cafe South Central needs it, and anyone who asks for it is not us. A code reaching you when you did not ask for one means somebody has entered your number: do not share it, and tell us.

Staff and administrator accounts are separate and held to a higher bar: staff sign in with a phone number and password, and administrator access additionally requires a Google sign-in plus a code from an authenticator app. Administrator sessions are short and are not covered by the 30-day customer session above.

7. Your rights and choices

We reply to requests within 7 business days.

When you delete your account: your profile, saved addresses, saved card references, favourites and notification subscriptions are removed within 30 days. Any wallet balance or credit is forfeited. Order and payment records are anonymised, meaning they are no longer linked to your name or number, and are kept only for accounting and tax purposes.

8. How long we keep it

9. Children

Our services are for people 18 years or older. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete it. A parent or guardian can contact us to request this.

10. Changes to this policy

We may update this policy. Changes are posted on this page with a new "Last updated" date, and we will notify registered users of significant changes by SMS or email.

11. Grievance Officer and contact

Grievance Officer
Ronavi Curations Private Limited
Email: [email protected]
Phone: 9493903300
Registered office: 5-1211001337, Sai Ambica Colony, Phase 1, Block C, Near Gokul Grand Apartment, Ameenpur, Sangareddy, Telangana – 502032

We acknowledge complaints within 48 hours and resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is operational.

12. Governing law

This policy is governed by the laws of India, including the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023, and the Consumer Protection Act, 2019. The courts at Hyderabad, Telangana have exclusive jurisdiction.