Privacy policy

Who we are

gito is run by 36TLabs Software Solutions (“we”). This policy covers the gito guest app (the pages that open when you scan a gito QR code or visit gito.app) and the gito Partner app that businesses use. It explains what we collect, why, who sees it, and the choices you have under India’s Digital Personal Data Protection Act, 2023.

When you order from or book with a business through gito, that business also receives your order or booking. It uses those details to serve you, and its own privacy practices apply to what it does with them.

What we collect from guests

• Sign-in. To order in the app or book, you sign in with Google (we receive your name and email address) or with your phone number and a one-time SMS code. Sign-in is handled by Google Firebase.
• Orders and bookings. What you order, the place you ordered at (for example a table), the name and phone number you give, your delivery address for delivery orders, any notes, and the bill.
• At the counter. When you pay at a business that uses gito, the bill is kept the same way. If you give the cashier your phone number or name, it’s saved on that bill. Giving it is up to you.
• Bills in a business’s name. If you ask for a GST bill for your company, the business records its GSTIN and name on that bill, as GST law requires.
• Bills sent as a link. If the business sends you your bill as a link, anyone with the link can open it. It shows what the printed bill shows (never your phone number or address), so share it only with people you want to see it.
• Notifications. Only if you tap “Notify me”: a notification token for your browser, so we can tell you when your order or booking changes.
• Feedback you send us. To send it without signing in, your browser gets an anonymous sign-in from Google Firebase: a random id with nothing about you, used only to limit how many messages one browser can send. We keep your email or phone with the message only if you tick “You may contact me about this”.
• Error reports. When a page fails, a technical report (the page, the error, your browser and device type). It never includes your cart, your bill or your sign-in details.
• Counts. How many times the checkout and sign-in steps were opened, per business and day. These are numbers only, with nothing that identifies you.

Your cart, a copy of the menu and any order waiting for a connection are kept on your own device, in your browser’s storage, so the app keeps working on a weak connection. Clearing your browser data removes them. While you have an open order at a table, one cookie remembers that order, so opening the business’s page takes you back to your table; it expires within 12 hours. When you scan a table’s QR code, the business sees that the code was scanned (a count, nothing about you), and one cookie holds that code for 30 minutes so scanning it again isn’t counted twice. We don’t use advertising cookies or trackers.

What we collect from businesses and their staff

• Your name, email address and photo from Google sign-in, and your phone number if you add it.
• Business details: name, address, contact details, menu or catalog, prices, GST details (GST status, GSTIN, legal name, rates and HSN/SAC codes), the UPI ID guests pay to, places and QR codes, staff, orders, bills, payments recorded, bookings and reports.
• Your gito plan and what you paid for it. Plan payments are made on PhonePe’s payment page: we receive the payment’s status, amount, method and transaction reference, never your card or bank details.
• Photos you take or choose for items. If you use menu scanning, the photo of your menu is sent to Google’s Gemini AI service to read the items from it.
• The camera is used only when you choose to scan a QR code or take a photo, never in the background.
• Crash and performance reports from the app (Firebase Crashlytics), identified only by an account id.

Why we use it

• To send your order or booking to the business, and to show you its status.
• To let businesses run their orders, bills, bookings and reports.
• To keep accounts secure and stop misuse, such as fake orders.
• To find and fix problems, and to understand where people get stuck (using the counts above).
• To keep records that tax and accounting law requires.

We don’t sell personal data, and we don’t use it for advertising.

Who we share it with

• The business you order from or book with sees your order or booking, with the name, phone number and delivery address you gave.
• Service providers who run parts of gito for us and may only use the data to do so: Google Firebase (sign-in, notifications, crash reports), Google Gemini (menu scanning, for businesses that use it), Neon (database), Fly.io (servers), Cloudflare R2 (item photos), Sentry (error reports) and PhonePe (payments for gito plans).
• Authorities, when the law requires us to.

Where it's stored

Our servers and database are in Singapore. Our service providers may process data in other countries. Wherever it is processed, we require it to be protected the way this policy describes.

How long we keep it

• Your account, until you delete it.
• Orders, bills and payment records, for as long as Indian tax and accounting law requires a business to keep them (generally up to 8 years). If you delete your account, they are kept without your name, phone number, email address or sign-in.
• Notification tokens, until you sign out, turn notifications off, or they stop working.
• Error reports, for up to 90 days.

Your rights

You can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct or complete it;
• delete it (delete your account), except what the law requires us to keep;
• withdraw your consent, for example by turning notifications off or deleting your account;
• name someone to act for you if you die or can’t act yourself.

Write to us at info@36tlabs.com. We aim to reply within 30 days. If you’re not satisfied with our answer, you can complain to the Data Protection Board of India.

Deleting your account

Go to gito.app/account-deletion and sign in with the account you want to delete. We remove your sign-in and notification tokens, and remove your name, phone number and email address from your past orders and bookings. If you sign in with your phone number, this includes bills where a business saved that number at the counter. Business owners and staff are handled by our team, because a business’s records may depend on their account.

Children

You must be 18 or older to sign in to gito. If you’re younger, a parent or guardian should place orders and bookings for you.

Security

Data is encrypted on its way to us and stored with providers who encrypt it at rest. Sign-in uses Firebase, so we never see a password. No system is perfectly secure; if a breach affects your data, we’ll tell you and the Data Protection Board as the law requires.

Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use data you have already given us, we’ll tell you in the app before it takes effect.

Contact and grievances

36TLabs Software Solutions (registered address available on request). Email: info@36tlabs.com

Questions, requests and complaints about personal data go to the email address above.