Privacy Policy

MANEMAA is a South Indian restaurant at GF-40/77 & 40/54 Tower-D, Ground Floor Spectrum@Metro, Sector-75, Noida, UP-201301, run by Javira Hospitality Private Limited.

Under India's Digital Personal Data Protection Act, 2023 (the DPDPA) we are the Data Fiduciary for the personal data described below, and you are the Data Principal. This policy covers www.manemaa.in, our counter and self-ordering screens, our kitchen and queue displays, and the WhatsApp messages we send you about an order.

When you place an order with us, at the counter or on an ordering screen:

• Your name — optional. We ask only so the counter can call you when the order is ready.
• Your mobile number — required. It is how we send your receipt and tell you the order is ready, and how we find your order if you call back.
• Your order — items, quantities, options, amount, time, and the token number printed on the queue display.
• A payment reference — the method used and the gateway's transaction ID. Never your card number, UPI PIN, CVV or bank login; those do not reach our systems at all.
• Your WhatsApp consent — whether you ticked the box, and the date and time you ticked it.

On this website: nothing. There is no account, no ordering, no payment, no analytics, no advertising pixel and no tracking of any kind here. Our host keeps ordinary server logs, as every web host does.

We do not collect your address, your date of birth, your email, your government IDs, or any of the sensitive categories such as health, religion or biometrics.

• To prepare, number and hand over your order.
• To send you your receipt and your order-ready message.
• To answer you when you call or message us about an order.
• To keep the invoices and records that Indian tax and company law require us to keep.
• To count, in aggregate, what the kitchen sold — how many dosas went out on a Sunday. These counts carry no names or numbers.

Our legal basis is the consent you give at the point of ordering, together with the “certain legitimate uses” the DPDPA allows for completing a transaction you asked for and meeting our legal obligations.

We do not sell your data. We do not share it with advertisers or data brokers. We do not use it to train AI or machine-learning models, and we do not profile you.

We message you on WhatsApp only at the number you gave with an order, and only after you tick the consent box. What we send:

• Your receipt, as a PDF, once, after the order is paid for.
• Your order status — most usefully, that it is ready to collect.
• A reply, if you message us first.

We do not send promotional broadcasts, offers or bulk marketing on WhatsApp unless you separately and expressly opt in to them.

To stop: reply STOP to any message from us, or tell us at the counter, or write to the address in Contact and grievances. We clear your opt-in within one business day and send you nothing further.

WhatsApp is operated by Meta. Messages you exchange with us also pass through their service under their own terms, which we do not control — see the WhatsApp Privacy Policy.

Card, UPI and wallet payments are handled by Razorpay and, at the counter, by a Pine Labs terminal. Both are PCI-DSS compliant payment processors, and both handle your card and UPI credentials directly. Those credentials never touch our systems.

What we keep is the transaction reference, the method and the amount — enough to match a payment to an order and to refund it. Cash orders are recorded as an amount and nothing else.

Only the service providers who need it to run the restaurant, each bound to use it for us and for nothing of their own:

• Razorpay and Pine Labs — to take and settle payments.
• WhatsApp / Meta — to deliver your receipt and order-status messages.
• Our hosting, database and file-storage providers — to run the ordering system and to hold receipt PDFs.
• Our accountants, and government authorities where the law requires us to produce records.

If you order from us through Zomato or Swiggy, the details you give that app belong to that app and their privacy policy governs them. We receive only what they pass us to cook and pack the order.

• Orders and payment records — eight years, which is what Indian tax and company-law record-keeping requires.
• Your name and mobile number — until you ask us to remove them.
• Receipt PDFs — twelve months, then deleted.

Withdrawing consent stops every future message and removes you from our customer list. It cannot erase an invoice we are legally required to retain.

This website sets no cookies and runs no analytics — there is nothing here to consent to.

Our ordering screens set a small number of strictly necessary cookies: one to hold your cart together while you order, and one to keep a staff member signed in at the counter. There are no advertising or cross-site tracking cookies anywhere in our systems.

Everything travels over HTTPS and is encrypted at rest. Access to the ordering system is restricted by role, protected by a PIN and a rate-limited login, and held to OWASP practice. We take regular backups. If a breach ever affects your data we will tell you and report it to the Data Protection Board of India, as the DPDPA requires.

Under the DPDPA you may, at any time and free of charge:

• Ask what personal data of yours we hold, and what we have done with it.
• Have it corrected, completed or updated.
• Have it erased, where we are not required by law to keep it.
• Withdraw the consent you gave — as easily as you gave it.
• Nominate another person to exercise these rights for you if you die or become unable to.
• Raise a grievance with us, and take it to the Data Protection Board of India if we do not resolve it.

Write to us from, or quoting, the mobile number on the order — that number is how we identify an order as yours. We will acknowledge within 72 hours and resolve within 30 days.

Our ordering systems are meant for adults. We do not knowingly collect the personal data of anyone under 18, and we do no tracking, profiling or targeted advertising at all, to children or to anyone else. Order for your family by all means — we only ask that the mobile number on the order is an adult's.

If we change what we collect or what we do with it, we will update this page and change the date at the top of it. Anything material will also be flagged at the counter and on the ordering screen before it takes effect.

Questions, corrections, removals and complaints all go to the same place. We would rather hear from you than have you wonder.

If we have not resolved your grievance to your satisfaction, you may complain to the Data Protection Board of India under section 13 of the DPDPA.