How we handle your data.

Last updated 21 October 2026.

1. Who we are

Apron is run by [missing: legal entity name], [missing: registered address] ("we", "us"). For any question about this policy, write to hello@theapron.in.

Grievance officer: [missing: grievance officer's name], [missing: grievance officer's email].

2. This website

This website sets no cookies, uses no analytics and loads no third-party scripts.

"Book a demo" opens your own email app with your details filled in. Nothing reaches us until you send that email to hello@theapron.in. We use what you send to contact you about a demo and keep it for [missing: how long demo emails are kept].

Our web server records each request's IP address, time, page address (without any query string) and browser, to run and secure the service.

3. The app

• Your account: name, email address and, if you add it, phone number. Passwords and PINs are stored only as hashes. Two-factor sign-in is available.
• Sign-in records: the time, IP address and browser of each sign-in, kept for 400 days. Each sign-in session expires 30 days after you sign in.
• In your browser, the app keeps its sign-in tokens in local storage and may keep orders on the device until they reach our servers. It sets no cookies.
• A log of sensitive actions (who did what, and when), kept for the restaurant's records.
• Technical error records, kept for 90 days.
• Plan payments are made through Razorpay. We pass Razorpay your name, email and phone so its checkout is filled in; card details are entered with Razorpay, not with us.

4. Data restaurants keep in the app

A restaurant using the app may keep details of its customers (such as name, phone, email, birthday, GSTIN, addresses and marketing consent), guests who order by QR code (an optional name and phone), online-order customers (name, phone and delivery address) and its workers (name, phone, wages and attendance). The restaurant decides what it keeps; we hold and process it to provide the service to that restaurant. If you are a restaurant's customer, contact the restaurant first; we will help it answer.

5. Where it is stored and for how long

The service runs on servers in Amazon Web Services' Mumbai region, in India. Backups are taken every hour and kept on the server for 7 days; off-site copies are kept for up to 30 days; daily server snapshots are kept for 7 days.

When an account closes: [missing: what happens to a closed account's data, and when]

6. Who receives it

Only the service providers that run the service, for that purpose: Amazon Web Services (hosting), Razorpay (plan payments) and the provider that delivers the app's emails.

If a restaurant connects its own payment gateway (Razorpay, Cashfree or Paytm) or its own Anthropic key for the AI assistant, that service receives what it needs, under the restaurant's own account. The AI assistant works only once a restaurant adds its key: its figures assistant sends calculated figures, and its help assistant sends the user's question with phone numbers masked. Voice ordering uses your browser's own speech recognition, which may send audio to the browser's provider (for example Google, in Chrome).

[needs your confirmation] We do not sell personal data.

We disclose information when the law requires it.

7. Your choices

You can see and correct most account and restaurant information in the app. To ask for access, correction or deletion of your personal data, or to raise a grievance, write to [missing: grievance officer's email]. We reply within [missing: response time].

8. Security

Passwords and PINs are stored only as hashes, two-factor sign-in is available, all traffic uses HTTPS, and access inside a restaurant follows roles and permissions.

9. Changes

We will post any change to this policy on this page and update the date at the top.