Privacy Policy

OutletPilot is a Restaurant Operating System used by restaurant and cloud kitchen businesses (“tenants”) to run point-of-sale, kitchen display, inventory, staff, payroll, loyalty and related operations. This policy applies to data processed through OutletPilot's web dashboard, mobile apps and APIs. If you are a customer of a restaurant that uses OutletPilot, your restaurant (the tenant) is responsible for its own privacy practices toward you; this policy describes how OutletPilot, as the platform operator, handles data on their behalf and on our own behalf. This policy works alongside our Terms of Service.

• Account and business data: business name, outlet details, staff names, roles and contact details, provided by the tenant when setting up OutletPilot.
• Operational data: orders, bills, menu items, inventory, vendor bills, payroll and attendance records, SOP evidence, and similar records generated through day-to-day use of the product.
• Customer data (on behalf of tenants): names, phone numbers and order history of a tenant's own customers, collected for billing, loyalty and order history features. This data belongs to the tenant; OutletPilot processes it as a service provider.
• Media uploads: photos and short videos uploaded for specific features — SOP evidence, staff clock-in/out selfies, vendor bills, delivery confirmation photos, expense receipts and cash deposit receipts.
• Payment information: processed directly by our payment partners (Stripe, Razorpay, Cashfree, Tap Payments, Xendit); OutletPilot does not store full card numbers.
• Device and usage data: IP address, device/browser type, and basic usage logs for security and reliability.

We use collected information to:

• Operate the core product — billing, kitchen display, inventory, staff and payroll management, reporting and the features a tenant has enabled.
• Send transactional messages (order updates, OTPs, receipts) via WhatsApp, SMS or email.
• Provide customer support and respond to requests.
• Maintain security, prevent fraud, and keep an audit trail for financial and compliance records.
• Improve the product based on aggregated, de-identified usage patterns.

We do not sell personal data to third parties.

Core application data is stored in our hosted database infrastructure. Photos and videos for specific features (SOP evidence, staff selfies, vendor bills, delivery photos, expense and cash receipts) are stored either in OutletPilot's shared cloud storage, or — if a tenant has connected it — in that tenant's own Google Drive account, under a folder created and managed by OutletPilot. Menu photos, category photos and business logos are always stored in OutletPilot's shared cloud storage. Where a tenant connects their own Google Drive, OutletPilot accesses only the files and folders it creates on the tenant's behalf, and never reads, lists or modifies any other content in that Google account.

OutletPilot optionally connects to Google Drive using Google's OAuth sign-in. When a tenant chooses to connect their own Google account, OutletPilot requests exactly one permission: the drive.file scope (https://www.googleapis.com/auth/drive.file). This scope only ever gives OutletPilot access to files and folders that OutletPilot itself creates in that Google account — it does not grant, and OutletPilot never requests, access to any other file, folder, photo or document already in that Drive.

With this access, OutletPilot:

• Creates a single app-managed folder (and subfolders) in the tenant's Drive to hold uploads for specific features — SOP evidence, staff clock-in/out selfies, vendor bills, delivery photos, expense receipts and cash deposit receipts.
• Uploads files into that folder when a tenant's staff submits one of the above.
• Sets each uploaded file to be viewable via link, so it can be displayed back inside OutletPilot.
• Deletes files from that folder when the corresponding record is removed, or when an automatic retention period expires (for example, SOP evidence photos/videos after 30 days by default).

OutletPilot does not read, search, list, download or share any other content in a connected Google account, and does not use Google user data for advertising. The authentication tokens used to access a tenant's Drive are encrypted at rest and are only ever used to perform the actions listed above. A tenant can revoke this access at any time from within OutletPilot's Drive Storage settings, or directly from their Google Account permissions page; OutletPilot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We rely on a small number of trusted third parties to operate the service, including:

• Payment processors (Stripe, Razorpay, Cashfree, Tap Payments, Xendit) for card and digital payments.
• Cloud storage providers (including Google Drive, where a tenant connects their own account) for photo and video uploads.
• Messaging providers (WhatsApp Business API, SMS gateways) for order and account notifications.
• Infrastructure providers for hosting, database and backup services.

Each of these processors is bound by its own terms and only receives the data needed to perform its function.

Operational and financial records are retained for as long as a tenant's account is active, and for a reasonable period afterward to meet accounting and legal obligations. SOP evidence photos and videos are automatically deleted after a configurable retention window (30 days by default). A tenant may request deletion of their account data at any time; see “Your rights” below.

Depending on where you are located, you may have rights to access, correct, export or delete your personal data. Tenants can request an export or erasure of their business and customer data through OutletPilot's data privacy tools, or by contacting us directly (details below). We respond to verified requests within a reasonable time frame as required by applicable law (including GDPR and India's DPDP Act, where relevant).

We use industry-standard safeguards — encrypted credential storage, tenant-scoped data isolation, and access controls by staff role — to protect data against unauthorized access, alteration or loss. No method of transmission or storage is 100% secure, and we continually work to improve our safeguards.

OutletPilot is a business tool and is not directed at children. We do not knowingly collect personal information from children.

We may update this policy from time to time. Material changes will be reflected by updating the “last updated” date above, and significant changes will be communicated to tenants directly.

Questions about this policy or a data request can be sent to support@outletpilot.com.