Skip to content

Legal

Policy.

What we collect, why, and how we protect it. Written for humans, aligned with the Digital Personal Data Protection Act, 2023.

KodSpot is operated by Kishan Ashok Thorat (Sole Proprietorship), based in Belagavi, Karnataka, India. This policy explains what data we collect, why, and how we protect it.

What we collect

  • Trial requests (prospective customers): When you submit a trial request from our website, we collect your restaurant name, city, phone number, and email (optional). We also record the date and time you consented to this Privacy Policy and our Terms of Service. This data is used solely to process your request and set up your account. If your request is not approved, this data is automatically deleted within 90 days. If approved, it is deleted within 30 days of account creation.
  • Hotel owners (our customers): Name, city, phone number, email (optional), and an 8-digit PIN for login.
  • Menu visitors (your customers): We do not use cookies or third-party analytics. To count unique daily visitors per hotel (required for plan limits), we store a one-way hash derived from the visitor's IP address, the date, and a secret salt. No raw IP address is ever stored. These hashes are automatically deleted after 90 days and cannot be used to identify any individual.
  • Menu content: Category names, item names, prices, descriptions, and images you upload.
  • Activity logs: We log administrative actions (menu edits, login events, account changes) for security and troubleshooting. These logs may include details of changed fields (e.g. previous and new values of hotel name, phone, or email). Logs are retained for the lifetime of the account and deleted within 30 days of account deletion.
  • Security metadata: When you request a PIN reset, we temporarily store your IP address, browser type, and device fingerprint to prevent abuse. This data is automatically deleted 7 days after the OTP expires.
  • Payment records: We store transaction IDs, amounts, and payment method type (not card or bank details) for each subscription payment. These are retained as required by Indian tax and accounting regulations.

Why we collect it

  • To process trial requests and set up new accounts.
  • To create and manage your hotel account.
  • To display your menu to your customers.
  • To contact you about your subscription (if you provided an email).

How we store it

  • Account data is stored in a PostgreSQL database hosted on a secure server in India.
  • Images are stored on Cloudflare R2, a globally distributed cloud storage service.
  • Your PIN is hashed — we cannot see it.
  • All connections use HTTPS encryption.
  • Automated daily database backups are maintained for disaster recovery.

Who can see your data

  • Only you (the hotel owner) and the platform admin can access your account details.
  • Your menu content (items, prices, images) is public — that's the point of the service.
  • We do not sell, share, or give your data to anyone else.

Your rights

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

  • Know what data we hold about you.
  • Correct inaccurate data.
  • Request deletion of your account and data.

To exercise any of these, email us at kishan@kodspot.com or message us on WhatsApp.

Data retention

We keep your data as long as your account is active. If you ask us to delete your account, we will remove all your data within 30 days.

Third-party services

We use the following services to operate KodSpot. Your data is shared with them only as needed to provide the service:

  • Razorpay (payment processing) — processes your subscription payments. We do not store card or bank details.
  • Cloudflare R2 (image storage) — stores menu images you upload.
  • Amazon SES (email) — sends OTP and notification emails to hotel owners only.

Changes to this policy

If we update this policy, we'll change the date at the top. For major changes, we'll notify you by email (if provided).

Data breach notification

In the event of a data breach affecting your personal data, we will notify you and the Data Protection Board of India as required under the Digital Personal Data Protection Act, 2023. We aim to provide such notification within 72 hours of becoming aware of the breach.

Grievance Officer

As required under the Digital Personal Data Protection Act, 2023, the Grievance Officer for KodSpot is:

Kishan Ashok Thorat (Sole Proprietorship & Grievance Officer)
Email: kishan@kodspot.com
WhatsApp: +91 76766 99291
Response time: Within 15 days of receiving your complaint.