Privacy Policy

Tavvlo is a restaurant intelligence platform. Restaurant owners connect the delivery-platform accounts they already own — Swiggy Partner and Zomato Partner — and Tavvlo turns that data into reports, alerts, reputation management and an analytics assistant delivered over WhatsApp, email and the web.

This policy explains, in plain terms, what information we collect, why we collect it, who we share it with, how long we keep it and how you can have it deleted. If anything here is unclear, write to privacy@tavvlotech.com and we will explain it.

1. Who we are

“Tavvlo”, “we”, “us” and “our” refer to the business operating the Tavvlo platform at tavvlotech.com and its associated services, including the Tavvlo dashboard, the Tavvlo Intelligence Chat assistant on WhatsApp and the web, and the reports we send by email and WhatsApp.

For the purposes of India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), Tavvlo is a Data Fiduciary in respect of the account information of the restaurant owners and staff who use our service. Where the UK or EU General Data Protection Regulation applies to a user, Tavvlo acts as a controller for account data and as a processor for the business data we retrieve from your delivery-platform accounts on your instruction.

2. Scope of this policy

This policy applies to:

• The Tavvlo website at tavvlotech.com, including sign-up, onboarding, checkout and the customer dashboard.
• The Tavvlo Intelligence Chat assistant, whether you use it on WhatsApp or in the browser.
• Tavvlo reports and alerts delivered by email and WhatsApp.
• The Tavvlo Customer Reputation Suite, Menu Intelligence Report and Performance Reporting Suite.

It does not apply to Swiggy, Zomato, WhatsApp, Meta, or any other third-party service you use. Those services have their own privacy policies. Tavvlo is an independent product and is not affiliated with, endorsed by, or operated by any of them.

3. Information we collect

3.1 Information you give us directly

3.2 Business data we retrieve on your instruction

Once you connect an outlet, Tavvlo retrieves operational data that already exists inside your Swiggy Partner and Zomato Partner accounts. This is your business data, not ours. It includes:

• Order and sales records — order values, item names, timestamps, discounts, taxes and cancellations.
• Payout and settlement statements.
• Customer ratings, reviews and review text, and the replies posted to them.
• Customer complaints and their resolution status, including refund amounts where applicable.
• Advertising spend and campaign performance.
• Menu, item availability and stock-out information.
• Operational metrics such as preparation time, delivery funnel and outlet online time.

Reviews and complaints originate from your customers on Swiggy and Zomato. We receive them in the form the platforms provide, we use them only to produce your reputation analytics and to help you respond, and we do not attempt to identify, profile, contact or market to those end customers.

3.3 Information we collect automatically

• Technical data — IP address, browser type, device type, pages viewed and timestamps, collected through standard web server logs and privacy-friendly analytics.
• Service logs — records of jobs run on your account, for example “daily report generated” or “review reply posted”, used for troubleshooting and audit.
• Message delivery status — whether a WhatsApp message or email we sent you was delivered, failed or bounced.

3.4 Information we do not collect

• We do not collect or store your card, UPI or bank details. Payments are handled entirely by our payment processors on their own systems.
• We do not use Facebook Login, and we do not request or receive Facebook profile data, friend lists or advertising identifiers.
• We do not collect location data from your device, access your camera or microphone, or read your device contacts.
• We do not knowingly collect sensitive personal data such as health, biometric, religious or political information.

4. How we use information

We use the information described above only for the following purposes:

• To provide the service — connecting your outlets, generating your daily, weekly and monthly reports, computing analytics, and answering your questions in the Tavvlo assistant.
• To deliver messages you asked for — sending reports, alerts and assistant replies to your WhatsApp number and email address.
• To perform actions you have authorised — where you enable it, replying to reviews and responding to customer complaints on the delivery platforms on your behalf, within the limits and budgets you configure.
• To operate your subscription — processing payments, applying plan entitlements, and sending renewal and billing notices.
• To support and secure the service — diagnosing faults, preventing abuse and unauthorised access, and keeping audit records.
• To meet legal obligations — retaining invoices and tax records, and responding to lawful requests.
• To improve the service — understanding which features are used, using aggregated and de-identified statistics that do not identify you or your outlets.

We do not use your data to build advertising profiles, and we do not supply it to advertising systems.

5. Consent and legal basis

We process personal data on these bases:

• Your consent — given when you create an account, when you connect a Swiggy or Zomato outlet, and when you provide your WhatsApp number to receive messages. Consent can be withdrawn at any time (see Your rights and choices).
• Performance of a contract — processing necessary to deliver the plan you have subscribed to.
• Legitimate interests — keeping the platform secure, preventing fraud and abuse, and maintaining service records, balanced against your rights.
• Legal obligation — retention of financial records under applicable Indian tax and company law.

6. WhatsApp and Meta platform data

Tavvlo delivers reports, alerts and assistant conversations over the WhatsApp Business Platform, through an authorised Meta Business Solution Provider. This section explains exactly how we handle that channel.

• How you opt in. We message a WhatsApp number only after the account owner has given it to us during sign-up or onboarding, or has messaged our WhatsApp business number first. We do not buy, scrape or import WhatsApp numbers from any other source, and we do not send unsolicited messages.
• What we send. Only content related to your own restaurant account: scheduled reports, operational alerts you enabled, replies to questions you asked the assistant, and service notices about your subscription.
• What we receive and store. Your WhatsApp display name and number, the messages you send to the assistant, our replies, and delivery status. Conversation history is retained so the assistant can follow the thread of a conversation and so you have a record of what was asked and answered.
• How we use it. Message content is used solely to understand your question, retrieve the relevant data from your own account, and reply to you. It is not used for advertising, not used to build audiences, and not shared with advertisers or data brokers.
• How you opt out. Reply STOP to any Tavvlo WhatsApp message, turn off WhatsApp delivery in your Tavvlo settings, or email privacy@tavvlotech.com. We will stop messaging that number. You can continue to use the dashboard and email reports.
• No Facebook Login. Tavvlo does not use Facebook Login or the Facebook Graph API for consumer profile data. We hold no Facebook profile information, friend data or advertising identifiers.

7. Use of AI systems

Parts of Tavvlo use large language models to interpret your questions, draft review replies, summarise complaints and write report commentary. You should know the following:

• We send an AI provider only what is needed to complete the task — typically your question and the relevant slice of your own business data.
• Our AI providers are engaged as service providers. Under those terms your content is not used to train their public models.
• AI-generated output is a draft based on your data. Where an automated action can affect money or your public reputation — a review reply, a complaint refund — it operates within limits and budgets you set, and can be switched off entirely in your settings.
• You remain responsible for content published under your restaurant’s name. We recommend reviewing your automation settings periodically.

8. How we share information

We share information only with the service providers needed to run Tavvlo, and only to the extent needed. Each is bound by contract to protect the data and to use it only on our instructions.

We may also disclose information where we are legally required to do so by a competent authority, where necessary to establish or defend a legal claim, or to prevent fraud or a threat to safety. If Tavvlo is ever involved in a merger, acquisition or transfer of assets, your data may transfer to the successor entity under the same commitments, and we will notify you before it happens.

9. We do not sell your data

Tavvlo does not sell, rent, licence or trade your personal data or your restaurant’s business data. We do not share your outlet-level performance with your competitors. We do not disclose one customer’s data to another customer. Any benchmark or market figure we publish is aggregated across many outlets and cannot be traced back to an identifiable restaurant.

10. How long we keep data

11. How we protect data

• All traffic between you and Tavvlo is encrypted with TLS, and data at rest in our cloud infrastructure is encrypted.
• Delivery-platform credentials are held in encrypted secret storage with restricted access.
• Access to production data is limited to the small number of people who need it to operate the service, and is authenticated and logged.
• Every customer’s data is isolated by account, and our systems enforce that boundary on every query.
• We keep audit trails of automated actions taken on your behalf.

No system can promise perfect security. If a personal data breach occurs that is likely to affect you, we will notify you and the relevant authority without undue delay and in accordance with applicable law.

12. Your rights and choices

Subject to applicable law, you have the right to:

• Access a copy of the personal data we hold about you.
• Correct data that is inaccurate or incomplete — much of this you can do yourself in your Tavvlo profile.
• Delete your data — see our data deletion instructions.
• Withdraw consent at any time, including disconnecting a delivery platform or stopping WhatsApp messages. Withdrawing consent does not affect processing already carried out, and may mean parts of the service can no longer work.
• Object to or restrict certain processing, and to portability of the data you provided, where those rights apply to you.
• Nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.
• Complain — to us first at privacy@tavvlotech.com, and to the Data Protection Board of India or your local supervisory authority if you are not satisfied.

We respond to rights requests within 30 days. We may ask you to verify your identity — usually by writing from the email address registered to the account — before we act, so that nobody else can request your data.

13. Deleting your data

You can ask us to delete your Tavvlo data at any time, for any reason, at no cost. Full step-by-step instructions, including what is deleted and what we are legally required to keep, are on our dedicated page:

14. International transfers

Tavvlo primarily serves restaurants in India, and your data is stored on Google Cloud infrastructure. Some of our service providers — for example our language-model and payment providers — process data outside India. Where data is transferred across borders we rely on providers that offer appropriate contractual safeguards, including standard contractual clauses where required, and we transfer only the minimum data necessary for the service concerned.

15. Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary — to keep you signed in and to keep your session secure. These cannot be turned off without breaking the service.
• Preference — to remember choices such as your selected outlet or date range.
• Analytics — aggregate, privacy-friendly measurement of page performance and usage.

We do not use advertising cookies, cross-site tracking pixels or third-party ad networks on tavvlotech.com. You can block or clear cookies in your browser; strictly necessary cookies are required in order to sign in.

16. Children

Tavvlo is a business tool intended for restaurant owners and their staff. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has provided us data, write to privacy@tavvlotech.com and we will delete it.

17. Changes to this policy

We may update this policy as the service changes or the law changes. The “Last updated” date at the top of this page always reflects the current version. If a change materially affects how we use your data, we will notify you by email or WhatsApp before it takes effect. Continuing to use Tavvlo after a change means you accept the updated policy.

18. Contact and grievances

For any question, request or complaint about privacy and data protection, contact us. We read every message and we reply.

If you are not satisfied with our response, you may escalate to the Data Protection Board of India under the DPDP Act, 2023, or to the supervisory authority in your jurisdiction.

---

Related: Terms of Service  ·  Data Deletion Instructions