Privacy policy

BubblePOS is software that restaurants use to take orders and bills, run their kitchen, stock and staff, and pay their team. It is a product of BriteBridge Solutions Private Limited ("BriteBridge", "we", "us"), Madhapur, Hyderabad, Telangana, India. This policy explains what personal data BubblePOS handles, why, who else sees it, how long it is kept, and the choices you have.

It covers bubblepos.com, each restaurant's own address (like yourrestaurant.bubblepos.com) and its online ordering page, the BubblePOS apps for Android, iOS, Windows and Mac, the store hub, and the partner panel at resellers.bubblepos.com. We handle personal data under Indian law, including the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and its rules as they come into force. Using BubblePOS is also governed by our terms and conditions.

Who is responsible for your data

Restaurants are our customers. When a restaurant keeps details about its staff or its guests in BubblePOS, the restaurant decides why and how that data is used, and we process it on the restaurant's behalf. Under the DPDP Act the restaurant is the Data Fiduciary for that data and BriteBridge is its Data Processor.

BriteBridge is the Data Fiduciary for the data it collects for itself: enquiries sent from our website, the people who sign restaurants up and look after their BubblePOS account and billing, support requests, and our partners.

If you work at a restaurant that uses BubblePOS, or you are one of its guests, please contact the restaurant first about your data. We will help the restaurant answer you.

What we handle

• Website enquiries: when you chat with us or fill in the form on bubblepos.com, your name and mobile number, your city and state (worked out approximately from your internet connection's IP address, unless you type them), what you tell us about your restaurant (such as its name, the kind of place, how many outlets it has and what it bills with today), what you type in the chat, the page you were on, and any campaign tags in that page's address. Your browser keeps the campaign tags for 30 days, so an enquiry can say where you found us.
• Restaurant accounts and billing: the owner's name, mobile number and email; the restaurant's business name, address and GSTIN; and its plan, price, billing cycle, renewal date, invoices and the payments it makes to us.
• Staff accounts: name, email, phone number, role, the outlets you work at, and your password (stored only as a one-way hash). When a sign-in fails we record the time and the IP address, to stop password guessing.
• Attendance: clock-in and clock-out times. If your restaurant turns them on, your location at the moment you clock in (to check you are at the outlet) and a selfie taken when you clock in. Selfies are deleted after 35 days.
• Pay (only if your restaurant uses BubblePOS Payroll): the details needed to pay you and file statutory returns, including what a new hire enters in the restaurant's joining form, such as PAN, the last four digits of your Aadhaar (never the full number), UAN and ESIC numbers, bank account and IFSC, date of birth, address, nominee, salary, attendance, leave, tax declarations, advances and payslips.
• Restaurant guests: what a restaurant records about its guests, such as name, mobile number, email, orders and bills, loyalty points, bookings, preferences and feedback, and a GSTIN for a business bill, including what guests enter on the restaurant's ordering page, at a table's QR code or through its feedback link. When a guest orders delivery from a restaurant's ordering page, the delivery address, and the position of their phone at that moment if they press the "Use my current location" button (the page never reads it before then), are kept with that order so the rider can find them.
• Online payments: when a restaurant takes payment on its ordering page through its own Razorpay, PhonePe or Paytm account, you pay on the payment company's own page. We keep the amount, the status of the payment and the payment company's reference with the order, and never your card, UPI or bank details.
• Messages: if a restaurant connects its own SMS or WhatsApp account to BubblePOS, the mobile numbers its message rules send to, a log of the messages sent, and the numbers that have asked not to be messaged.
• Support requests: what you write when you ask for help from inside BubblePOS (Help & support), with your name, contact details and restaurant, and our replies.
• Partners: for our affiliates and resellers, the name, contact person, email, phone and city; the details we need to pay commission; the restaurant leads they send us, with the contact details they give; and their commission statements and payouts.
• Business records: menus, orders, bills and payments (the payment method and amount, never card numbers), stock, suppliers and accounts.
• Technical data: the cookies described below, and the IP address and device type that every web request carries, in our hosting providers' logs.

Our apps

• The apps show the same BubblePOS as the web and store the same data, in the same place.
• Camera: used only when you take a selfie to clock in, if your restaurant requires one.
• Location: read only when you clock in, if your restaurant checks that you are at the outlet. The apps do not track your location in the background.
• Files: reports and statements you download are saved on your device or shared only where you choose.
• Store hub: a computer kept in the restaurant can hold a copy of the restaurant's data, so billing and kitchen tickets carry on when the internet drops. The restaurant controls that computer.
• The apps remember which restaurant you use. They do not access your contacts, show advertising, or use an advertising identifier, and they do not track you across other companies' apps or websites.

Cookies and your browser

• A session cookie keeps you signed in. BubblePOS cannot work without it.
• On bubblepos.com, a cookie can remember which country's site you chose, and your browser keeps campaign tags for 30 days, as described above.
• We do not use advertising or analytics cookies, and we do not track you across other companies' websites.
• How-to videos: the videos inside BubblePOS play from YouTube, in its privacy-enhanced mode (youtube-nocookie.com). Nothing is loaded from YouTube until you press play. Once a video plays, YouTube (Google) receives your IP address and device details and may store data in your browser, under its own terms and privacy policy.

Why we use it

• To provide BubblePOS to restaurants and their staff: orders, billing, kitchen, stock, attendance, payroll and reports.
• To answer enquiries, arrange demos and sell BubblePOS subscriptions. Enquiries go to our sales team, in our own sales system, and to the sales executive for your state.
• To set up restaurants, bill them for their subscriptions and keep our accounts.
• To send the messages a restaurant sets up, through the restaurant's own SMS or WhatsApp account.
• To run our partner programme and pay commission.
• To keep accounts secure, prevent misuse and fix problems.
• To give support when a restaurant asks for it.
• To meet legal obligations, such as tax and employment record-keeping.

We use personal data with consent, which can be withdrawn at any time, or where the DPDP Act allows it without consent, such as for the purpose someone gave it to us for, or to meet a legal obligation. The DPDP Act's duties come into force on dates the Government of India has set; until they apply, the Information Technology Act's rules on sensitive personal data (such as passwords and bank details) govern how we handle it. We do not sell personal data, and we do not use it for advertising.

Who else sees it

• The restaurant you work for or visit, according to the roles it gives its staff.
• Our own team, where their work needs it: sales, onboarding and support. Support staff can view a restaurant's account only in a support session that is time-limited and logged.
• Our service providers, under contract: the companies that host BubblePOS and its database for us (such as Vercel and Neon), and an email delivery service for partner notices.
• The payment companies and message providers a restaurant chooses and connects with its own account (such as Razorpay, PhonePe, Paytm, MSG91, Twilio or Meta's WhatsApp Business Platform). They handle the data under their own terms and privacy policies.
• Authorities, where the law requires it.
• If BriteBridge or BubblePOS is reorganised, merged or sold, the new owner, who must keep the promises in this policy.

Some things, such as a joining link, are shared from a staff member's own phone or email app. Apart from emails to our partners, BubblePOS sends messages itself only through an SMS or WhatsApp account a restaurant has connected.

Our hosting providers store and process the data outside India, currently in the United States. We do not transfer personal data to any country to which the Government of India restricts transfers under the DPDP Act.

How long we keep it

For as long as the restaurant's account is open, except clock-in selfies, which are deleted after 35 days. When an account is closed, we keep its data for 30 days so the restaurant can ask for a copy, and then delete it, apart from records the law requires to be kept, such as tax invoices and pay records, which are kept only as long as the law requires.

Website enquiries and partner leads are kept while we are in touch about them, and deleted when they are no longer needed, unless the law requires us to keep them.

Security

Over the internet, BubblePOS is used only over encrypted connections (HTTPS); inside a restaurant, phones and tills can reach its store hub over the restaurant's own network without that encryption. Passwords are stored as one-way hashes, each restaurant's data is kept separate from every other restaurant's, staff see only what their role allows, the keys that connect a restaurant's payment account are stored encrypted, and important changes are recorded in an activity log.

If a personal data breach affects data we hold for a restaurant, we tell the restaurant without delay, so it can inform the people affected. For data we hold for ourselves, we inform the people affected and the authorities, as the law requires.

Your choices and rights

• Access: ask for a summary of the personal data we hold about you and what we do with it.
• Correct and update: staff can update their own name, phone, email and password under My profile. Other corrections go through the restaurant, or to us for data we hold for ourselves.
• Erase: ask us to delete data that is no longer needed, or that you no longer consent to us keeping, except what the law requires us to keep.
• Withdraw consent: as easily as you gave it, for example by telling us you no longer want to hear from our sales team.
• Nominate: name someone to use these rights for you if you die or become unable to.
• Complain: raise a grievance with our Grievance Officer (below). If you are not satisfied with the answer, you may complain to the Data Protection Board of India once those provisions of the DPDP Act apply.

For data a restaurant keeps about you, please ask the restaurant first; we will help it answer you. We reply to other requests within 30 days.

Delete your account

Staff can delete their own account in the app or on the web: open My profile and choose Delete your account. A restaurant's only owner asks us to close the restaurant's account from the same place. The steps, what is kept, and what to do if you can't sign in are on Delete your BubblePOS account.

Children

BubblePOS is for businesses and their staff. It is not meant for anyone under 18, and we do not knowingly collect data from children. Restaurants must not use BubblePOS to track children or to show them targeted advertising.

Grievance Officer and contact

For privacy questions, requests and grievances, contact our Grievance Officer, BriteBridge Solutions Private Limited, Madhapur, Hyderabad, Telangana, India: grievance@bubblepos.com or +91 99631 30526. We acknowledge a grievance within 24 hours and resolve it within 15 days. For anything else, write to sales@bubblepos.com.

Changes

If we change this policy, we will update it here and change the date at the top. If a change affects how we use data you have already given us, we will tell you in BubblePOS or by email before it takes effect.