Privacy Policy

Harkara AI Private Limited | CIN U62013RJ2026PTC112471 | 38/164 Kiran Path, Mansarovar, Jaipur 302020, Rajasthan, India | team@harkara-ai.in | harkara.in / harkara-ai.in

1. Introduction and Scope

1.1 Harkara AI Private Limited (“Company”, “We”, “Us”, “Our”), a company incorporated under the Companies Act 2013, is committed to protecting and respecting the privacy of all individuals who use the Harkara platform at harkara.in / harkara-ai.in (“Platform”). This Privacy Policy explains how We collect, use, store, share, and protect personal data in connection with Your use of the Platform and its Services.

1.2 This Privacy Policy is published in compliance with the Digital Personal Data Protection Act 2023 (“DPDPA 2023”), the Digital Personal Data Protection Rules 2025 (“DPDP Rules”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (“SPDI Rules”), and other Applicable Laws governing the protection of personal data in India.

1.3 When You sign in to the Harkara app for the first time, You are asked to agree to this Privacy Policy and the Terms of Service before continuing. By agreeing, You consent to the processing of Your personal data for the purposes described in Clauses 5.1, 5.2 and 5.4. Processing that is optional, namely location access (Clause 3.3) and offers and reminders (Clause 5.3.2), is asked for separately, and You can use the Platform without it. You may withdraw any consent at any time as set out in Clause 10.4. If You do not agree to this Privacy Policy, please do not create an account.

1.4 This Privacy Policy should be read together with the Company’s Terms of Service, Cookie Policy, and Disclaimer, which collectively govern Your use of the Platform.

1.5 We may update this Privacy Policy from time to time to reflect changes in our practices, the Services offered, or Applicable Law. The updated Privacy Policy will be posted on this page with the date of the update. Where We make significant changes, We will endeavour to inform You, for example through a prominent notice on the Platform or by email. Where Applicable Law requires Your fresh consent for a change, We will ask for it and will not treat Your continued use of the Platform as that consent. Subject to this, Your continued use of the Platform after an update takes effect constitutes Your acceptance of the updated Privacy Policy.

1.6 You may ask for this Privacy Policy in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to team@harkara-ai.in.

2. Definitions

In this Privacy Policy, the following definitions apply:

3. Personal Data We Collect

3.1 Data Provided by You

We collect the following categories of personal data that You voluntarily provide to Us:

• Registration Information: Your full name, email address, and mobile phone number when You create a User account on the Platform.
• Order and Reservation Information: details of food orders and reservations placed through the Platform, including items ordered, special requests, transaction history, the number of guests included in a reservation, and any cover charge paid, adjusted, refunded, or forfeited in connection with a reservation.
• User Content: reviews, ratings, photographs, and feedback submitted through the Platform.
• Communications: the content of messages and correspondence You submit to Us through customer support channels, feedback forms, or email.
• Payment Data: limited payment information necessary to initiate transactions; full payment card details are processed directly by Razorpay and are NOT stored by the Company.
• Referral Information: if You use or share a referral code, the code, who referred whom, the mobile number used to claim the code, and how the code reached You (typed in, opened from an invite link, or passed on by the Google Play Store when You installed the app from an invite link).
• Requests You Send Us: if You ask Us to bring Harkara to Your area or suggest a restaurant, the details You enter and the location attached to that request.

3.2 Data Collected Automatically

When You use the Platform, We may automatically collect the following technical and usage data:

• Device Information: device type, model, operating system, browser type and version, unique device identifiers, the push notification token of Your device, and app version.
• Crash Reports: when the app crashes, a technical report of what failed, with the device and app details above.
• Log Data: IP address, date and time of access, pages viewed, referring URLs, and clickstream data.
• Usage Data: features accessed, search queries, interaction patterns, and session duration on the Platform.
• Cookies and Tracking Technologies: data collected through cookies, web beacons, and similar technologies, as more fully described in Our Cookie Policy.

3.3 Location Data

3.3.1 With Your permission, the Platform uses Your device’s location to: (a) show You restaurants near You; and (b) for Takeaway Orders and Dine-In Pre-Orders, work out how far You are from the Restaurant Partner and how soon You will arrive, so that the kitchen starts preparing Your food at the right time.

3.3.2 Your exact GPS coordinates are used on Your device to make these calculations. They are not sent to or stored by the Company, and they are never shared with the Restaurant Partner. The Restaurant Partner receives only the instruction to start preparing Your Order.

3.3.3 To check that Orders reach the kitchen at the right time, and to fix problems when they do not, We keep the following records, linked to Your account: (a) for each Order, Your distance from the Restaurant Partner, rounded to the nearest 0.5 km, the estimated travel time in minutes, and when each was checked; (b) when Your Order was sent to the kitchen and what triggered it (for example, You approaching the Restaurant Partner, a scheduled time, or You tapping “Start cooking”), and when You were recorded as nearby; (c) whether location permission was granted, and whether the app was open or closed at the time; and (d) Your device model, operating system and app version. These records are kept for up to ninety (90) days and then deleted, and are deleted earlier if You delete Your account.

3.3.4 When You place a Takeaway Order, We also keep Your distance from the Restaurant Partner at that moment, rounded to the nearest 500 metres, with the Order, to estimate what You saved compared with delivery. It is kept with Your Order records (Clause 8).

3.3.5 For an Order, location is used only from when You place it until it is sent to the kitchen or You arrive, and for no more than eighteen (18) hours. If You choose “At a time” at checkout, We do not use Your location for that Order at all.

3.3.6 You may turn off location access at any time in Your device settings. Some features, such as starting Your Order automatically as You approach, will then not work; You can still start it yourself.

3.3.7 The only exact location We store is the one attached to a request You choose to send Us (Clause 3.1, “Requests You Send Us”).

3.4 Data from Third Parties

3.4.1 We may receive personal data about You from third-party sources, including: (a) Razorpay, in connection with payment processing and fraud prevention; and (b) analytics providers, in relation to anonymised or aggregated usage analytics.

3.5 AI-Generated Data

3.5.1 Menu descriptions and estimated nutritional information are generated by Google Gemini API using menu item names and descriptions provided by Restaurant Partners. The Company transmits menu data to Google for this purpose but does not transmit any User personal data to Google in this context.

3.6 In-App Activity and Notification Data

3.6.1 When You use the Harkara app while signed in, We record the following activity, linked to Your account: when You open the app; which restaurants and dishes You view; dishes You add to Your cart; when You start checkout; what You search for and how many results were found; which home-screen offers You tap; restaurants You save as favourites; and whether Your device currently allows notifications from Harkara.

3.6.2 For each notification We send You, We record when it was sent and whether You opened it. For each offer or reminder, We also record whether You placed an Order within a set period afterwards.

3.6.3 We keep a record of Your choice about offers and reminders (Clause 5.3.2): whether You opted in or out, when, from which screen, and which version of the notice You saw.

3.6.4 We use this activity to run and improve the app: to understand which screens and features are used, to find and fix problems, to check whether a change made the app better, and to keep the Platform secure and prevent misuse. If You opt in to offers and reminders, We also use it as described in Clause 5.3.3; if You switch them off, We stop using it for that purpose. We do not sell it or share it with Restaurant Partners.

4. Legal Basis for Processing Personal Data

Under the DPDPA 2023, We process Your personal data on one of the following grounds:

• Your Consent (Section 6 of the DPDPA 2023): given when You agree to this Privacy Policy (Clause 1.3) for running, securing and improving the Platform, including the in-app activity in Clause 3.6; and given separately for optional processing, namely location access and offers and reminders. You may withdraw any consent at any time (Clause 10.4).
• Certain Legitimate Uses (Section 7 of the DPDPA 2023): where You voluntarily provide personal data for a specified purpose and have not indicated that You do not consent to its use, for example Your name, mobile number and Order details when You place an Order or make a Reservation, which We use and share with the Restaurant Partner to fulfil it; and where processing is needed to comply with any law, judgment or order in force in India, such as keeping tax records.

5. How We Use Your Personal Data

We process Your personal data for the following specified and lawful purposes:

5.1 Service Delivery

• To enable You to register and maintain an account on the Platform.
• To process and facilitate food Orders, Pre-Orders, and Reservations.
• To communicate Order confirmations, updates, status notifications, and receipts to You.
• To share relevant Order and contact information with Restaurant Partners to enable fulfilment.
• To enable GPS proximity-based kitchen preparation trigger notifications for Takeaway Orders and Dine-In Pre-Orders (Your exact GPS coordinates are not stored, and are never shared with Restaurant Partners; see Clause 3.3).
• To check that Orders reach the kitchen at the right time and to fix problems when they do not, using the order-timing records described in Clause 3.3.3.

5.2 Platform Operations and Improvement

• To maintain, administer, and improve the technical functionality and user experience of the Platform.
• To conduct internal research, analytics, and testing to develop new features and Services.
• To monitor and enforce compliance with these Terms and Applicable Law.
• To detect, investigate, and prevent fraudulent transactions, security incidents, and misuse of the Platform.

5.3 Communications

• To send transactional notifications, service updates, and responses to Your enquiries and support requests.
• To send You marketing or promotional communications with Your prior consent, which You may withdraw at any time.

5.3.1 Order and Reservation updates (for example, that Your Order has been accepted or is ready) are sent as part of the Services and do not depend on Your marketing choice.

5.3.2 Offers and reminders. If You opt in (in the app under Profile → Notifications → “Offers and reminders”, or when the app asks after Your first Order), We may send You push notifications about offers, new dishes and restaurants, and reminders when You may want to order again, such as Your usual dish. We send at most one such notification a day and none between 10 pm and 9 am. You are opted out unless You choose to opt in, and You can switch this off at any time in the same place, with immediate effect.

5.3.3 To decide which offer or reminder is relevant, and when, We use Your Order and Reservation history, the activity described in Clause 3.6, and any reviews You have left, to estimate, for example, whether You have ordered recently or have had a problem with a recent Order. These estimates are used only to choose and time these notifications. They have no legal or similarly significant effect on You, and they are not shared with Restaurant Partners.

5.3.4 To understand whether these notifications are useful, a small randomly chosen share of eligible Users does not receive a particular offer or reminder, and We compare Order activity between the two groups. Offers that include a discount are funded by the Company and appear in Your Coupon Vault.

5.4 Legal and Regulatory Compliance

• To comply with Applicable Law, court orders, regulatory directions, or to respond to lawful requests from competent authorities.
• To exercise or defend legal claims.

6. Disclosure and Sharing of Personal Data

7. International Transfers of Personal Data

7.1 Your personal data is stored and processed on Supabase servers located in Mumbai, India. We do not transfer Your personal data outside India for storage. Certain service providers described in Clause 6.5, including providers of email delivery, SMS one-time-password delivery, and analytics services, may process limited personal data on infrastructure located outside India in the course of providing those services.

7.2 The Company takes reasonable steps to ensure that all cross-border transfers of personal data are conducted in compliance with the DPDPA 2023 and any applicable regulations governing international data transfers issued by the Government of India. We ensure that recipients of transferred personal data are contractually bound to standards of data protection equivalent to those required under Indian law.

8. Data Retention

8.1 We retain Your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, comply with Our legal obligations, resolve disputes, and enforce Our agreements.

8.2 Typical retention periods applicable to different categories of data are as follows:

• Account data (name, email, mobile number): retained for the duration of account activity and for a period of three (3) years following account closure, or as required by Applicable Law.
• Transaction and Order data: retained for a minimum of seven (7) years in compliance with applicable tax, accounting, and consumer protection laws. This includes records We are required to maintain in Our capacity as an electronic commerce operator liable to pay Goods and Services Tax under Section 9(5) of the Central Goods and Services Tax Act 2017, and as a deductor of tax at source under Section 194-O of the Income-tax Act 1961.
• GPS/location data for Takeaway Orders and Dine-In Pre-Orders: not stored by the Company. GPS data is processed transiently for proximity calculation only and is not retained on any server or device of the Company.
• User Content (reviews, ratings): retained for the duration of platform availability unless removed by Us or upon a valid erasure request.
• Order-timing records (Clause 3.3.3): up to ninety (90) days, then deleted.
• Log and technical data: retained for up to ninety (90) days for security and debugging purposes, or for longer where Applicable Law (including the DPDP Rules) requires.
• In-app activity data (Clause 3.6): retained for up to twelve (12) months, then deleted.
• Notification records (Clause 3.6.2): which notifications were sent to You and opened are deleted after twelve (12) months. Records of which offers or reminders You were sent, and whether an Order followed, are kept after twelve (12) months only in de-identified form, as counts that no longer identify You.
• Estimates used for offers and reminders (Clause 5.3.3): the current estimate is kept while Your account is active; its daily history is deleted after twelve (12) months.
• Records of Your marketing choice (Clause 3.6.3): retained for as long as Your account is active and for three (3) years after account closure, as evidence of Consent.
• Referral claims: the mobile number used to claim a referral code is kept with that claim, including after account deletion, so that the same number cannot claim a referral reward again.
• Requests You send Us (Clause 3.1), including the location attached: retained until Your account is deleted.

8.3 Upon expiry of the applicable retention period, We shall securely delete or anonymise Your personal data in accordance with Our data disposal procedures.

8.4 When You delete Your account (in the app under Profile → Delete Account), We erase Your name, email address, mobile number and other profile details, Your sign-in details, Your in-app activity, Your order-timing records (Clause 3.3.3), notification history, the estimates in Clause 5.3.3, the requests You sent Us, and any unused personal offers. We keep only what Applicable Law requires or what other people rely on: Order, Reservation and payment records for the periods in Clause 8.2 (without Your name or contact details), Your reviews and ratings on the Restaurant Partner’s page (without Your name), offers You have already used on an Order, the records of Your marketing choice and referral claims described above, and offer results in de-identified form.

9. Data Security Measures

9.1 The Company implements reasonable technical, organisational, and administrative security measures designed to protect Your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of personal data in transit (using TLS/SSL protocols) and at rest.
• Access controls restricting access to personal data to authorised personnel on a need-to-know basis.
• Regular security assessments and vulnerability testing of the Platform.
• Data processing agreements with all Data Processors requiring equivalent security standards.
• Cloud infrastructure hosted on Supabase, which maintains SOC 2 Type II certification.

9.2 While the Company takes all reasonable precautions, no method of electronic transmission or storage is entirely secure. We cannot guarantee absolute security of Your personal data. In the event of a personal data breach, We shall inform affected Users without delay, and notify the Data Protection Board of India within seventy-two (72) hours in accordance with the DPDPA 2023 and Rule 7 of the DPDP Rules, detailing the nature of the breach, likely consequences, mitigation steps taken, and recommendations for Data Principals to protect themselves.

10. Your Rights Under the DPDPA 2023

As a Data Principal under the Digital Personal Data Protection Act 2023, You have the following rights with respect to Your personal data:

11. Children’s Privacy

11.1 The Platform is not directed at or intended for use by children under the age of eighteen (18) years, and by creating an account You confirm that You are eighteen (18) or older. We do not knowingly collect personal data from minors. If We become aware that We have inadvertently collected personal data from a person under the age of eighteen (18) without appropriate consent, We shall take prompt steps to delete such data.

11.2 Parents and legal guardians who believe that their child’s personal data may have been collected through the Platform are encouraged to contact Us immediately at team@harkara-ai.in.

12. Cookies and Tracking Technologies

12.1 The Platform uses cookies, web beacons, and similar tracking technologies to enhance user experience, analyse usage, and facilitate certain Services. A detailed description of the types of cookies used, their purposes, and Your options for managing them is set out in Our Cookie Policy, which is incorporated into this Privacy Policy by reference.

12.2 Where cookies require Your Consent under Applicable Law, We shall seek Your Consent prior to deploying such cookies. You may manage Your cookie preferences through Your browser settings or through Our Cookie Preference Centre, if available.

13. Third-Party Services and Links

13.1 The Platform may contain links to or integrations with third-party websites and services. This Privacy Policy does not apply to such third-party services, and We are not responsible for the privacy practices of third parties. We encourage You to review the privacy policies of any third-party services You access through the Platform.

14. Changes to This Privacy Policy

14.1 We reserve the right to update or modify this Privacy Policy at any time. The revised Privacy Policy shall be published on the Platform with the date of the most recent update. We will endeavour to inform registered Users of significant changes through a prominent notice on the Platform or by email.

14.2 Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes Your acceptance of the changes. If You do not agree to the revised Privacy Policy, You must cease using the Platform and may submit an erasure request in accordance with Clause 10.3.

15. Data Protection Officer

15.1 The Company has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the DPDPA 2023 and related data protection obligations. The DPO can be reached at:

16. Grievance Officer and Contact Information

16.1 In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 and the DPDPA 2023, the Company has appointed a Grievance Officer to address data privacy complaints and grievances from Users:

16.2 All grievances shall be acknowledged within twenty-four (24) hours of receipt and resolved within fifteen (15) days, or within such period as may be prescribed under Applicable Law. If Your grievance is not resolved to Your satisfaction, You may complain to the Data Protection Board of India under the DPDPA 2023.

16.3 For any general enquiries regarding this Privacy Policy or Our data practices, please contact Us at team@harkara-ai.in.