Last updated: 8 November 2026

This Privacy Policy explains how Rasoyum Technologies Pvt. Ltd. (“Rasoyum”, “we”, “us”) collects, uses, stores, shares and deletes information when you visit rasoyum.com (the “Website”) or use the Rasoyum dashboard, alerts and related services (together, the “Service”). The Service is a business tool for restaurant brands, cloud kitchens and their teams (“Clients”).

1. Information we collect

Information you give us

Contact and demo requests: name, work email, phone number, brand name, city, number of outlets and any message you send.
Account information: the names, email addresses, phone numbers and roles of the Client users we create dashboard logins for.
Delivery-platform access: where a Client asks us to, the merchant-portal credentials or sessions for third-party delivery and dining platforms. These are stored encrypted and used only to collect that Client’s own business data.

Information we collect for Clients from connected services

Delivery-platform data: orders, payouts and deductions, menus and item availability, ratings and reviews, complaints and refunds, ad campaigns and outlet status for the Client’s outlets. This can include limited customer information that the platform shows to the merchant (such as a customer’s first name in a review or complaint).
Google Business Profile data: described in detail in section 2.
Report and alert recipients: the phone numbers of the Client’s team members who receive reports and alerts, and delivery status of those messages.

Information collected when you use the Website

The Website does not use advertising or analytics cookies. It stores one setting in your browser’s local storage (your light or dark theme choice), which never leaves your device.
Our hosting provider may record standard server logs (IP address, browser type, pages requested, time) for security and reliability. The Website is delivered through Cloudflare and the Service is hosted on Amazon Web Services in India; these logs are kept for up to 30 days.

2. Google user data (Google Business Profile)

If you choose Connect Google in the Rasoyum dashboard, you sign in with Google and grant Rasoyum access to the Google Business Profile accounts and locations that your Google login manages. We request the scope https://www.googleapis.com/auth/business.manage plus openid and email. We do not request access to Gmail, Drive, Contacts, Calendar or any other Google data. As an alternative to signing in, you can instead add our agency Google account as a Manager of your Business Profile; the same rules below then apply to the data we access through that role.

What we access and why

Data	What it includes	Why we use it
Business accounts and locations	The Business Profile accounts and locations your Google login can manage: names, location IDs, addresses, verification and open/closed status.	To let you choose which locations to connect, and to match each one to your outlet in Rasoyum.
Reviews and review replies	Customer reviews of your connected locations (star rating, text, reviewer display name and photo URL as shown publicly by Google, dates) and existing owner replies.	To show your reviews in your dashboard, send you alerts, and post or update replies on your behalf when you or your account settings ask us to (see “Actions we take for you”).
Performance metrics	Aggregated Business Profile Performance data: profile views and searches (Maps / Search, mobile / desktop), calls, direction requests, website clicks, bookings, food orders and monthly search keywords.	To show trends and reports for your locations next to your delivery-platform data.
Profile fields	Business information on the profile such as name, categories, hours, phone, website, description, attributes, menu, photos and posts.	To show the profile in your dashboard, flag inconsistencies, and make edits you request.
Google account identity	The email address and Google account ID of the person who clicked “Connect Google” (scopes openid and email).	Only to record which Google login a connection belongs to, so you can see and disconnect it.

Actions we take for you

With the access you grant, Rasoyum can write to your Business Profile only in these ways, and only for locations you have connected and we have activated:

Review replies: posting, updating or deleting replies to customer reviews. Replies may be written by our team or drafted automatically by an AI model according to the reply settings for your location. Automatic replies can be switched off per location at any time by contacting us or in your settings. We never overwrite a reply that already exists unless you ask us to.
Profile updates: changes to profile fields, menu, photos or posts that you request.

How we use Google user data

We use Google user data only to provide and improve the user-facing features of the Service described above: showing your reviews, metrics and profile in your dashboard, alerts and reports, and the actions you ask us to take.
We do not sell Google user data.
We do not use or transfer Google user data for advertising, including retargeting or personalised ads.
We do not use Google user data to determine credit-worthiness or for lending purposes.
We do not use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models. When an AI model drafts a review reply, the review text is sent to that model only to produce the reply for you. The AI provider is Google (Gemini API), used under terms that do not allow the provider to use this data to train its models.
Our staff do not read Google user data except (a) with your permission, for example to write a reply or handle a support request, (b) where necessary for security, such as investigating abuse, (c) to comply with the law, or (d) in aggregated, anonymised form for internal operations.
We do not transfer Google user data to others except as needed to provide the Service (to the service providers listed in section 4, under contracts that require them to protect it), to comply with the law, or as part of a merger or acquisition with notice to you.

How we store and protect Google user data

The OAuth refresh token that Google issues when you connect is encrypted at rest with AES-256-GCM. Each token is cryptographically bound to its own connection record and the encryption key is kept separate from the database. Access tokens are short-lived and are never shown to users.
All data is sent over encrypted connections (TLS).
Access inside the Service is role-based: Client users see only the locations mapped to their own outlets.

Retention and deletion of Google user data

When you disconnect, we immediately revoke the token with Google and delete the encrypted token. We keep a record that the connection existed (without the token) for security auditing.
Reviews and replies, performance metrics, search keywords and profile history that we have stored are kept while your Rasoyum account is active and then deleted according to our retention schedule (for example, performance metrics for up to 25 months).
You can ask us to delete all Google user data we hold for your business at any time by emailing support@rasoyum.com. We will complete the deletion within 30 days, except where the law requires us to keep something.

How to revoke access

In the Rasoyum dashboard, open the Google connection and choose Disconnect; or
Go to your Google Account at myaccount.google.com/permissions, select Rasoyum and remove its access; or
If you added our agency account as a Manager, remove it from your Business Profile’s user list.

After access is revoked we can no longer read or change your Business Profile. Data already stored is handled as described above.

Limited Use disclosure

Rasoyum's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use information

To provide the Service: dashboards, payout audits, availability alerts, review management, and reports and alerts.
To respond to demo requests and support questions.
To keep the Service secure, prevent abuse and fix problems.
To meet legal, tax and accounting obligations.
To send Clients service messages about their account. We send marketing messages only where permitted, and you can opt out.

We do not sell personal information. We share information only:

With service providers that run parts of the Service for us, under contracts that limit their use of the data: cloud hosting and databases, the messaging provider that delivers reports and alerts, and the AI model provider used to draft review replies. These are Amazon Web Services (hosting and databases, India), Google (e-mail and the AI model, United States and other countries), Cloudflare (website delivery, worldwide) and our messaging provider (United States).
Within the Client’s organisation, with the users the Client authorises.
With the platforms you connect, when we act on your instructions (for example, posting a review reply to Google).
For legal reasons, to comply with law or valid legal process, or to protect rights, property or safety.
In a business transfer, such as a merger or acquisition, with notice to Clients.

5. Retention and deletion

We keep information only as long as needed for the purposes above. Client business data is kept while the Client’s account is active and is deleted or anonymised according to our retention schedule after the account ends, unless the law requires longer retention. Demo-request details are kept for up to 24 months unless you become a Client. Google user data follows section 2.

6. Security

We use encryption in transit and at rest for credentials and tokens, role-based access controls, audit logs for sensitive actions and least-privilege access for our staff. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

7. Your rights and choices

Depending on where you are, including under India’s Digital Personal Data Protection Act, 2023, you may have the right to access, correct or erase your personal data, to withdraw consent, to nominate another person to exercise your rights, and to raise a grievance with us and then with the Data Protection Board of India. To use these rights, email support@rasoyum.com. If we process your data on behalf of a Client, we will pass your request to that Client.

8. Children, international transfers and changes

The Service is for businesses and is not directed at children under 18. We do not knowingly collect their data. Information may be processed in India and in other countries where our service providers operate, with appropriate safeguards. We will post any changes to this policy on this page and update the date above; material changes will be notified to Clients in advance.

9. Contact and grievances

Rasoyum Technologies Pvt. Ltd.
For privacy questions, requests and grievances, e-mail support@rasoyum.com. We acknowledge grievances within 24 hours and resolve them within 15 days.