Privacy Notice

Effective 1 October 2026 · Version v1.0

Salt & Pepper ("S&P", "we", "us") respects your privacy. This notice explains what personal data we collect, why we collect it, how long we keep it, who we share it with, and what rights you have under India's Digital Personal Data Protection Act 2023 (DPDP Act).

1. Who collects your data

Salt & Pepper Foods Pvt Ltd, Guwahati, Assam, India. We are the Data Fiduciary for the data described below.

2. What we collect

Category	What	Why
Phone number	Mobile number in E.164 format	To sign you in via OTP and notify you about your bookings
Name & city	Display name and city of residence	To personalise your experience and surface relevant kitchens
Event preferences	Event types you care about (wedding, conference, puja, etc.)	To recommend kitchens and venues that fit
Notification token	Firebase Cloud Messaging device token	To send push notifications about bookings and orders
Location	Approximate location at the time of browse (optional)	To show kitchens that can serve your area
Order data	Bookings, payment status, contracts, reviews	To deliver the service you have booked

3. Why we are allowed to collect it

Your consent for everything captured at sign-up (the rows above).
Contract performance for order data — we cannot fulfil a booking without it.
Legitimate interest for fraud prevention, security logs, and aggregate analytics.

4. How long we keep it

Orders, contracts, payments: 7 years from the event date (Income Tax Act requirement).
Profile data: until you delete your account. After deletion, a 30-day grace period for recovery, then hard-deleted.
Notification token: until you sign out or uninstall the app, whichever is sooner.
Marketing preferences: until you withdraw consent.

5. Who we share it with

We do not sell, rent, or trade your data. We share specific data with named processors only so we can deliver the service you booked:

Processor	What they receive	Purpose
Razorpay	Phone, order amount, payment metadata	Process payments (Standard) and payouts (X)
MSG91	Phone, booking-related message text	OTP delivery and WhatsApp notifications
Firebase Cloud Messaging (Google)	Notification token, push payload	Deliver push notifications
AWS (Hyderabad + Mumbai)	All operational data	Hosting and storage; data resides in India

We never share your data with advertisers, data brokers, or unrelated third parties.

6. Your rights under the DPDP Act

You can, at any time:

Access the data we hold about you — in the app: Profile › Settings › My Data.
Correct inaccurate data — in the app: Profile › Edit.
Withdraw consent for marketing communications — in the app: Profile › Notification preferences.
Delete your account and your data — in the app: Profile › Delete account. Active orders block deletion until they are completed or cancelled. After deletion, a 30-day grace period applies; you can sign in during this window to recover.
Grievance redressal — write to the Data Protection Officer below. We will respond within 30 days, as required by the DPDP Act.

7. Children

The S&P app is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, write to the DPO and we will delete it.

8. When we change this notice

If we materially change this notice, we will:

Bump the version (currently v1.0)
Surface the change in the app the next time you sign in
Ask for fresh consent before processing under the new terms

9. Data Protection Officer

Email: customer@saltpepper.ai
Address: Salt & Pepper Foods Pvt Ltd, Guwahati, Assam, India