India compliance notes

This page explains how RestroSetu is built with reference to Indian law, so a restaurant using it can have an informed conversation with its own advisor. It is not a legal opinion or a certification. Laws referenced here (the DPDP Act 2023, IT Rules, CGST Rules and CCPA guidelines) are described as of this page’s last-updated date.

RestroSetu is a hosted service run by Awixt. When your restaurant records customer or staff details in RestroSetu, your restaurant is the Data Fiduciary for that data, and Awixt acts as your Data Processor: we store and process it only to provide the service to you, never sell it, and never use it for our own marketing.

Features that help your restaurant meet its obligations to customers:

• Customer records (name, phone, visit history, loyalty points) can be corrected or deleted by staff with the right permission — supporting correction and erasure requests.
• Only the fields needed for billing, loyalty and campaigns are collected.
• Role-based permissions control which staff can see customer contact details and order history.
• Each restaurant's data is stored in a separate database of its own, so it can never appear in another restaurant's account.
• You can download your restaurant's data at any time.

• Passwords are hashed with bcrypt and never stored or logged in plain text.
• Sign-in is rate-limited, email addresses are verified with a one-time code, and two-factor sign-in is available.
• Session cookies are httpOnly, Secure and SameSite-restricted; all traffic uses HTTPS.
• Prices, tax, discounts and totals are always calculated on the server, never trusted from a device.
• Uploaded files are checked by their actual content and stored with random, non-executable names.
• Databases are backed up every night and backups are encrypted.
• Subscription payments go through a certified payment gateway; card details never reach our servers.

Receipts show your branch’s GSTIN (when entered in Settings), an itemised CGST/SGST breakup and an invoice number. Whether the numbering and layout meet every requirement for your registration and turnover (for example HSN/SAC codes) should be confirmed with your chartered accountant.

RestroSetu does not use fake urgency, invented counters or pre-ticked consent boxes. Prices are shown in full, all inclusive, before you pay.

Questions about how RestroSetu handles data? Write to support.restrosetu@gmail.com. For your restaurant’s own legal or GST obligations, please consult a qualified lawyer or chartered accountant.