Privacy Policy

BARESTO ("BARESTO", "we", "us", "our") provides a bar & restaurant point-of-sale (POS) system sold as a licensed, on-premise desktop application, together with a small set of cloud-hosted companion apps and services — the BARESTO CaptainApp (for waiters and captains), the BARESTO MenuApp (customer-facing QR ordering), and the BARESTO AdminPortal (used by our own vendor staff to issue licenses and manage restaurant accounts). This Privacy Policy explains what information we collect, how we use and protect it, and the choices available to restaurant owners, restaurant staff, and restaurant customers across our website (baresto.in), our desktop application, and our companion apps.

1. Scope of this policy

This policy covers three categories of BARESTO offerings:

• The on-premise desktop application (installed on a restaurant's own PC), which stores orders, billing, inventory, staff, and customer records locally in a SQL Server database that BARESTO does not routinely access.
• Our cloud-hosted companion services — the BARESTO MenuApp and its supporting relay functions, the BARESTO CaptainApp, the BARESTO AdminPortal, and the Maharashtra excise-portal automation feature — each of which necessarily handles a defined, limited set of data to do its job.
• Our marketing website at baresto.in, including any demo request or contact form you submit.

2. Information we collect

2.1 From restaurant owners and licensees

When you enquire about, purchase, or activate a BARESTO license, we (or our authorized sales representatives) collect your name, restaurant/business name, phone number, email address, business address, and the machine fingerprint of the PC the license is issued to. We also retain a record of your license status, expiry, and billing history for support and renewal purposes.

2.2 From restaurant staff using the app

Staff login credentials (stored as salted hashes), names, roles (Admin, Manager, Waiter, Bartender, Kitchen) and shift records are created and stored in your restaurant's own local database when your Admin sets up staff accounts. This data is not transmitted to BARESTO's cloud infrastructure in the ordinary course of operating the app.

2.3 From your customers, via the BARESTO MenuApp

A customer scanning a table QR code to order food, or paying via a UPI link, interacts with our cloud relay (because a customer's phone has no way to reach your restaurant's private network directly). This creates a short-lived draft order and, where UPI is used, a payment-status record — both automatically relayed to your on-premise system and purged from our cloud storage by scheduled cleanup jobs once no longer needed. We do not build customer profiles from this data.

2.4 AI-assisted features

Features such as Voice Ordering, AI Menu Translation, and Menu Photo Import send the specific input you provide — a voice recording, a menu photograph, or menu text — to an AI processing service solely to fulfil the requested transcription, translation, or extraction. This content is used only to return the result to your restaurant and is not used to train models on your proprietary menu or business data without your separate consent.

2.5 Automatically collected data

Like most websites, baresto.in may log standard technical data (IP address, browser type, device information, pages visited) for security and analytics purposes. Our cloud services similarly log request metadata (timestamps, machine identifiers, error traces) to operate and troubleshoot the relay and licensing infrastructure.

2.6 Statutory excise filings

Where a restaurant enables the Excise Portal automation feature, the desktop application uses excise-portal credentials supplied and authorized by the restaurant to submit the restaurant's own statutory liquor-sales data (FLR-3 / FLR-4 / FLR-1A) to the Maharashtra Government excise portal, strictly at the restaurant's direction and for that compliance purpose only.

3. How we use information

• To provide, operate, and support the BARESTO desktop application and companion apps
• To issue, verify, and manage software licenses tied to a specific machine
• To relay QR orders and UPI payment status between a customer's phone and a restaurant's on-premise system
• To fulfil AI-assisted features (voice transcription, translation, menu photo import) that a restaurant actively triggers
• To submit statutory excise returns on a restaurant's behalf, only where that feature is enabled and authorized
• To send license, billing, and product-update communications
• To respond to support requests and demo enquiries submitted via our website or contact channels
• To detect, investigate, and prevent fraud, abuse, and security incidents
• To comply with applicable law and respond to lawful requests from authorities

You may opt out of non-essential marketing communications at any time by emailing us or using the unsubscribe link in the message.

4. Where your data lives

Operational data generated by day-to-day use of the desktop app — orders, bills, inventory, staff records, reservations, and customer records entered by your staff — is stored in a SQL Server database on your restaurant's own PC/server, under your control. Backups of this database, if configured under Settings → Backup, are written to a local folder or external/USB drive you choose — never automatically to a BARESTO cloud destination.

Data that genuinely needs to pass through the cloud — license records, QR-ordering drafts, UPI payment-relay status, and AI-processing requests — is held on Microsoft Azure cloud infrastructure, only for as long as needed to complete that specific function, before being relayed to your on-premise system or purged by an automated cleanup job.

5. Sharing with third parties

We share the minimum data necessary with:

• Cloud infrastructure providers (e.g. Microsoft Azure) hosting our companion apps and relay services
• Payment/UPI providers, to relay payment status for QR-based orders
• AI service providers, to process voice, image, or text inputs for AI-assisted features you trigger
• Telegram, only if a restaurant configures its own Telegram Bot Token and Chat ID to receive bill-settled and daily-summary notifications — we relay messages using credentials the restaurant supplies and controls
• The Maharashtra Government excise portal, only when a restaurant has enabled and authorized statutory return submission
• Professional advisors and authorities, where required by law, regulation, or legal process

We do not sell personal information to third parties.

6. Data security

We use reasonable technical and organizational measures to protect the data we handle, including RSA-signed license verification, per-install encrypted (DPAPI-protected) signing keys, and access controls on our cloud infrastructure. No method of electronic storage or transmission is 100% secure, and restaurant owners remain responsible for safeguarding their own staff login credentials, backup destinations, and physical access to their POS PC.

7. Data retention

Cloud-relayed data (QR-ordering drafts, UPI relay status) is retained only for the short window needed to complete the relay and is then purged by scheduled cleanup jobs. License and account records held on the AdminPortal are retained for as long as a license is active, plus any period required by applicable law. On-premise operational data is retained according to each restaurant's own settings and backup practices, as BARESTO does not control that database.

8. Your rights & choices

Depending on your relationship with BARESTO, you may request access to, correction of, or deletion of personal information we hold about you by contacting us using the details below. Because most operational and customer data lives on a specific restaurant's own on-premise system, requests relating to that data (for example, a customer asking about an order placed at a particular restaurant) should generally be directed to that restaurant, which controls that record.

Under India's Digital Personal Data Protection Act, 2023, BARESTO has designated a Grievance Officer to receive and respond to complaints or questions about how we handle personal data. See section 13 below for contact details.

9. Cookies

Our website (baresto.in) may use cookies and similar technologies for basic functionality and analytics. You can control cookies through your browser settings; disabling them may affect some website features.

10. Children's privacy

BARESTO is a business tool intended for restaurant owners, staff, and their adult customers. We do not knowingly collect personal information from individuals under 18 years of age, and will delete any such information if we become aware of it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. We will post the revised policy on this page with an updated "Last updated" date, and material changes will be communicated to restaurant licensees by email where appropriate. Continued use of BARESTO after a change constitutes acceptance of the revised policy.

12. Governing law

This policy is governed by the laws of India. Any disputes arising from or relating to this policy shall be subject to the exclusive jurisdiction of the courts having competent jurisdiction in Maharashtra, India.

13. Contact us

If you have questions about this Privacy Policy or wish to exercise any of the rights described above, please reach out using the details above and we'll respond as soon as we reasonably can.