Privacy Policy

Coda is operated by Oneiros Coda Private Limited, registered in India and based in Ottapalam, Kerala. For anything in this policy, reach us at jishnu.tp@codaos.in or +91 81118 55276. We are a small team and we answer our own mail.

Under the Digital Personal Data Protection Act 2023, a restaurant using Coda is the Data Fiduciary for its own guests. We act as its Data Processor. For staff accounts and for the operation of the platform itself, we are the Data Fiduciary.

Staff and owners. Name, email address, phone number and role, held to create your account and decide what you are allowed to see. Authentication is handled by Clerk; we never see or store your password.

Guests ordering through a QR menu. Name, phone number and email address from sign-in, the orders placed, and loyalty balance and history. If a birthday is entered, it is used for loyalty offers and nothing else.

Operational data. Orders, table assignment, timings, payment status and amounts, staff attendance, vendor bills and stock movements. This is the restaurant's business record and belongs to the restaurant.

Technical data. Error reports and performance timings, used to keep the system running. These are not used to build a profile of anyone.

Card numbers, UPI PINs and banking credentials. Payments are processed by PhonePe and Razorpay, who are PCI-DSS compliant. Coda receives only the result of a payment: whether it succeeded, the amount, and a reference. Card details never reach our servers.

To take and fulfil an order, route it to the right kitchen station, produce a correct GST invoice, run the loyalty programme a guest chose to join, keep the restaurant's books and stock accurate, and meet tax record-keeping obligations under Indian law.

We do not sell personal data. We do not share it with advertisers. We do not use it to train models.

Clerk for authentication. Supabase for the database, hosted in the ap-south-1 Mumbai region, encrypted at rest and in transit over TLS 1.3. PhonePe and Razorpay for payments. Resend for transactional email such as order receipts. Sentry for error reporting. Inngest for scheduled background jobs. Vercel for hosting.

Each is bound by its own terms and processes data only to deliver the function it is used for.

Order and invoice records are retained for eight years, matching the retention period Indian tax law expects of the restaurant. Guest profile and loyalty data is kept while the account is active. Error logs are kept for 90 days.

When a restaurant stops using Coda, its data is exported to it on request and then deleted, save for records we are legally required to retain.

Under the DPDP Act 2023 you may ask for access to your personal data, correction of anything inaccurate, erasure where we are not legally required to keep it, and you may nominate someone to exercise these rights if you are unable to.

Guests should raise these with the restaurant they ordered from, since it holds the relationship. If it cannot resolve the matter, write to us directly and we will act on the restaurant's instruction or, where the law requires, on our own.

A session cookie set by Clerk keeps you signed in. Your cart is held in your own browser's local storage so it survives a refresh, and the table you scanned is held in session storage for the length of your visit. We do not run advertising or cross-site tracking cookies.

Coda is not directed at children. We do not knowingly create guest accounts for anyone under 18. If you believe a child's data has been entered, write to us and we will remove it.

Jishnu T P is our Grievance Officer, reachable at jishnu.tp@codaos.in or +91 81118 55276. We acknowledge complaints within 48 hours and aim to resolve them within 30 days, as the DPDP Act requires.

If this policy changes materially, we will update the date at the top and tell active restaurants by email before the change takes effect.