How SARTHI collects, uses, shares and protects personal data - on this website and inside the platform.
[TO BE CONFIRMED] effective and last-updated dates
SARTHI is a hospitality and retail management platform used by hotels, restaurants, resorts, cafes and retail stores in India. This policy explains, in plain English, what personal data we handle, why we handle it, who we share it with, and what you can ask us to do about it.
It is written with India's Digital Personal Data Protection Act, 2023 and the rules made under it in mind. Where a detail depends on a company, contact or operational fact that has not yet been confirmed, this page says so explicitly rather than guessing.
This policy applies to personal data that [TO BE CONFIRMED] handles in connection with SARTHI. It covers this website, the SARTHI application, and the support and onboarding we provide around them.
By using SARTHI or submitting an enquiry through this website, you acknowledge that you have read this policy. Where the law requires your consent for a specific purpose, we ask for it separately and you may withdraw it.
This policy covers:
It does not cover the privacy practices of a subscribing business itself, or of any third-party website or service you reach from SARTHI. Those are governed by their own policies.
We collect only what we need for the purposes set out in section 4. The categories are:
The name, email address, phone number and password credentials used to create and access a SARTHI account, and the role assigned to each account.
Your business or trading name, business type, number of outlets, and the operational configuration you set up - items, menus, room types, rates and tax settings.
The name, phone or WhatsApp number, email address and business details you submit through an enquiry or demo-request form on this website, together with which call-to-action you used and any pricing plan you were viewing, so that the right person responds to you.
The billing name, address and tax details needed to raise a valid invoice, and a record of payments made. Card, bank and UPI credentials are handled by our payment provider ([TO BE CONFIRMED]) and are not stored by us - see section 9.
Where a subscribing business creates staff accounts in SARTHI, it may record employee names, contact details, roles and activity. That business decides what to record and why.
A subscribing business may record details of its own guests and customers - for example a name, phone number, billing address, GST details, reservation or stay details, and order or purchase history. See section 8.
Technical details your browser or device sends when you use SARTHI, such as IP address, browser and operating system type, and the device identifier where applicable.
Records of how the service is used - pages and modules accessed, actions taken, and the date and time of those actions. This includes the security and audit records the platform keeps for a subscribing business.
See section 10.
We use personal data to:
We do not sell personal data. We do not share it with third parties for their own advertising, and we do not use the guest or customer data a subscribing business records in SARTHI for our own marketing.
Depending on the situation, we handle personal data:
Where we rely on your consent, you can withdraw it at any time - see section 18. Withdrawal does not affect processing already carried out, or records we are required by law to keep.
Each SARTHI user has their own account. A subscribing business controls which of its staff have accounts, what role each account holds, and what that role can see and do.
You are responsible for keeping credentials confidential and for telling us promptly if you believe an account has been compromised. We will never ask you for your password, and we do not ask for bank credentials, card numbers or UPI PINs - SARTHI is not tied to any bank or payment provider and takes no commission on your transactions, so it has no reason to hold them.
The operational data a subscribing business puts into SARTHI - its menus, rates, bills, invoices, stock records, staff accounts and guest details - belongs to that business.
In relation to that data, the subscribing business is the Data Fiduciary and we act as a Data Processor on its behalf. We process it on that business's instructions, for the purpose of providing the service, and for no independent purpose of our own. The business decides what to collect, how long to keep it, and how to answer requests from the people it relates to.
A subscribing business can export its data at any time while its subscription is active.
If you are a guest of a hotel, or a customer of a restaurant or retail store that uses SARTHI, your details were recorded by that business, not by us.
Subscription payments are processed by [TO BE CONFIRMED]. Card, bank account and UPI credentials are entered with the payment provider and handled under its own terms and privacy policy - we do not receive or store them.
We keep the records needed for accounting and tax: invoice details, the amount, date and status of a payment, and a reference from the provider.
This website uses only the cookies necessary to serve the pages and to operate the anti-spam protection on our enquiry forms. It does not carry advertising or cross-site tracking cookies.
The SARTHI application uses a session cookie to keep a signed-in user signed in. Blocking that cookie will prevent the application from working.
You can clear or block cookies in your browser settings. The exact cookie names and lifetimes in use are [TO BE CONFIRMED].
Where we use analytics to understand how this website is used and to improve it, we do so on an aggregate basis rather than to build a profile of an individual visitor.
The specific analytics tools in use on this website, and the data each one receives, are [TO BE CONFIRMED]. This section will name them once confirmed.
We use a small number of service providers to run SARTHI. They act on our instructions and may use the data only to provide their service to us. They currently include:
Beyond the service providers in section 12, we share personal data only:
We take the security of the platform seriously and restrict access to production systems to the people who need it in order to operate and support the service.
SARTHI itself gives a subscribing business role-based access control, so cashiers, managers and owners see only what their role permits, keeps staff credentials under the business's own control rather than a vendor helpdesk, records discounts, voids and price overrides in an audit trail, and runs automated backups.
The specific technical and organisational measures we apply - including encryption in transit and at rest, backup frequency and retention, access-control procedures and any independent audit or certification - are [TO BE CONFIRMED]. We do not claim any particular security standard or certification on this page until it has been verified by our technical team.
No system can be made perfectly secure, and we cannot guarantee the security of data in transit over the internet or of equipment on your own premises.
We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.
You may ask us to delete personal data we hold about you, and we will do so unless we are required or permitted to keep it - for example a tax invoice, or data we need in order to defend a legal claim.
Where a subscribing business asks us to delete its account data, we delete it on the timeline in section 15, and the business is responsible for telling its own guests, customers and staff what has happened to data it recorded about them.
Requests should go to [TO BE CONFIRMED].
Subject to the conditions in the Digital Personal Data Protection Act, 2023, you may ask us to:
A subscribing business can additionally export its operational data at any time, in formats an accountant can work with.
Write to [TO BE CONFIRMED] to make a request. We may need to verify who you are before acting on it. Our target response time is [TO BE CONFIRMED]. If the request concerns data recorded by a business that uses SARTHI, we will direct it to that business - see section 8.
Where we rely on your consent, you may withdraw it at any time by replying to any message from us, or by writing to [TO BE CONFIRMED]. We will stop the processing that relied on that consent.
Withdrawing consent to marketing or enquiry follow-up does not affect the operation of a paid subscription, and does not remove records we are legally obliged to retain.
If you are unhappy with how we have handled your personal data, or how we have answered a request, you can raise a grievance with our Grievance Officer. Their name, designation and contact details are published in the contact block at the foot of this page and in the Sarthi Legal Settings maintained by us.
Our target acknowledgement and resolution times for a grievance are [TO BE CONFIRMED]. If we do not resolve your grievance to your satisfaction, you may escalate it to the Data Protection Board of India.
SARTHI is a business tool. It is not directed at children, and we do not knowingly collect the personal data of a child.
If you believe a child's personal data has reached us, write to [TO BE CONFIRMED] and we will delete it. Where a subscribing business records data about a child - for example a guest travelling with a family - that business is responsible for handling it lawfully, including obtaining any consent the law requires.
Whether personal data handled through SARTHI is stored or accessed outside India depends on where our hosting and service providers operate. The current position, including the countries involved and the safeguards applied, is [TO BE CONFIRMED].
This section will state the position precisely once our hosting and sub-processor arrangements are confirmed. We will not describe a transfer arrangement on this page that we have not verified.
We maintain a process for identifying and responding to security incidents that affect personal data.
If a personal data breach affects your data, we will notify you and the Data Protection Board of India in the manner and within the timelines the Digital Personal Data Protection Act, 2023 and the rules under it require. Where the breach affects data a subscribing business recorded in SARTHI, we will notify that business so it can meet its own obligations to the people concerned.
Our internal incident-response procedure and notification timelines are [TO BE CONFIRMED].
We may update this policy as the service, the law or our providers change. The effective date and the last-updated date at the top of this page always reflect the current version.
Where a change materially affects your rights, we will notify active customers directly as well as updating this page.
Our full contact details, including the operating entity, registered address, privacy contact and Grievance Officer, are in the contact block at the foot of this page.
For any question about this policy, or to exercise the rights described in it, contact us using the details below. If you are not satisfied with our response, you may escalate the matter to our Grievance Officer, and after that to the Data Protection Board of India.