Privacy Policy

This Privacy Policy explains how Catermonk Foodtech, trading as Book My BBQ ("Book My BBQ", "we", "us" or "our"), collects, uses, shares, retains, and protects personal data when you use bookmybbq.com, create an account, contact us, or order our food, catering, delivery, pickup, BBQ setup, or grill rental services.

For personal data processed for these purposes, Book My BBQ is the Data Fiduciary or controller. Our principal place of contact is VMGC+52, Bangalore, Karnataka, India. Contact details and the privacy grievance process appear in section 14.

1. Personal data we collect

Information you provide

Account and identity details, including name, Indian mobile number, optional email address, user ID, and account metadata.
Delivery and venue details, including address, city, PIN code, landmark, address label, contact person, phone number, and selected Google Place identifier.
Booking details, including date, time slot, guest count, service type, pickup or delivery choice, catering package and menu selections, equipment selections, quantities, customisations, coupons, and instructions you give us.
Optional catering context, including the occasion you select. An occasion may indicate cultural or religious context; providing it is optional, and we use it to prepare and support the event rather than for advertising or profiling.
Dietary preferences, allergy information, access directions, or other event requirements that you choose to include in booking or support messages. Please provide only information needed to safely fulfil the booking.
Communications, complaints, cancellation requests, verified-purchase ratings and reviews, optional reviewer name, review contact and publication choices, and other information you send through the website, email, phone, WhatsApp, or customer support.

Information created during transactions

Order records, including order number, status, totals, discounts, fulfilment details, selected advance or full-payment option, amounts paid, refund-window dates, and refund status.
Cancellation records, including the selected reason, optional customer note, request and review status, estimated refund eligibility, refundable amount, and staff review notes.
Payment records, including Razorpay order and transaction identifiers, amount, currency, payment method category, payment status, and failure information. We do not receive or store your full card number, CVV, banking password, or UPI PIN.
Authentication and security records, including OTP delivery and verification events, session information, timestamps, and records used to prevent fraud or unauthorised access.

Information collected from your device or use of the website

Approximate or precise location when you choose location detection and permit your browser to share it. You can instead type and select a Bangalore address.
Location search text and results used to validate that an address is in our Bangalore service area.
Technical and security data that our website, hosting provider, or service providers ordinarily generate, such as IP address, browser and device type, request time, referring page, error logs, and security events.
Website usage data collected through Google Analytics and PostHog, including pages viewed, booking-funnel interactions, approximate location, device and browser information, traffic source, campaign parameters, and pseudonymous identifiers.
When you are signed in, we may associate PostHog events with your internal Book My BBQ account ID so that we can understand whether the booking and payment flow works across a session. PostHog may receive event properties such as package, guest count, booking flow, amount, currency, internal or Razorpay transaction identifiers, and payment outcome. We do not intentionally send PostHog your name, email address, mobile number, delivery address, OTP, payment signature, or payment credentials.
Privacy-masked session recordings used to understand navigation and checkout usability. Form inputs and designated customer-detail areas are masked, the secure administration area is excluded, and we do not intentionally record payment credentials.
Browser storage described in section 7, including cart contents, total, booking flow, date, guest count, selected location, Place ID, legacy saved addresses, and authentication session information.

2. How we use personal data

Create and secure your account, send and verify WhatsApp OTPs, and maintain your signed-in session.
Search and validate service locations, save addresses at your request, prepare quotations, accept payment, confirm bookings, and fulfil delivery, pickup, catering, setup, and rental orders.
Plan catering quantities, ingredient purchasing, menu preparation, staffing, travel, venue access, and setup based on the event date, guest count, address, occasion, package, and menu selections.
Communicate transactional updates, respond to support requests, manage cancellations and refunds, and resolve disputes.
Link purchase reviews to the invoiced items, improve our menu and service, contact you about a review only when you request it, and publish your first name, rating, and comments only when you give the separate publication permission shown on the review form.
Apply promotions, detect repeat or fraudulent use, verify payment, protect customers and staff, and secure the website and accounts.
Maintain business, tax, payment, food-safety, accounting, complaint, and audit records and comply with lawful requests.
Diagnose errors, measure reliability, improve menus and Services, and create aggregated or de-identified business insights that do not reasonably identify you.
Send promotional communications only where we have the consent or other permission required by applicable law. You can opt out at any time without affecting transactional messages.

3. Grounds for processing

Depending on the context and applicable law, we process personal data with your consent; at your request to provide the Services; for permitted uses such as voluntarily supplied data; to comply with law; and to establish, exercise, or defend legal claims. Where consent is the basis, you may withdraw it using the method in section 9. A withdrawal does not affect processing already lawfully completed and may prevent us from providing a feature that requires the data.

We seek to collect only data reasonably necessary for a stated purpose. Required fields are identified in the relevant form. If you do not provide data necessary for account verification, payment, delivery, safety, or legal compliance, we may be unable to provide the requested Service.

4. How we share personal data

We do not sell personal data. We share only what is reasonably necessary with the following recipients:

Supabase, which provides account authentication, session management, database, and related infrastructure. Customer profiles, addresses, carts, catering selections, orders, cancellation requests, and payment records may be processed through Supabase.
Razorpay and participating payment providers, which process checkout, verify payments, prevent fraud, and administer refunds. Razorpay receives order amount, currency, contact and transaction information needed for payment.
Google Maps Platform, which processes location search terms, Place identifiers, addresses, and coordinates needed for autocomplete, geocoding, and service-area validation.
Google Analytics, which processes website usage, device, traffic-source, and approximate-location data to help us understand and improve the website.
PostHog, which processes pseudonymous website interaction, booking-funnel, campaign-attribution, device, and privacy-masked session-replay data to help us identify usability issues and improve checkout completion. Signed-in events may use our internal account ID as a pseudonymous identifier, and verified checkout events may include booking and Razorpay transaction identifiers, amount, currency, and payment status. You can review PostHog's own privacy information at posthog.com/privacy.
Meta's WhatsApp platform and our configured messaging provider, which process your mobile number and OTP message information to deliver account verification codes and customer communications.
Resend, which processes your email address and the order details included in transactional booking confirmations when you provide an email address.
Hosting, networking, monitoring, communications, professional, accounting, and security providers that support our operations under appropriate contractual or legal duties.
Our authorised staff, cooks, delivery personnel, venue-support personnel, and contractors who need relevant order, menu, dietary, venue-access, and contact details to fulfil or support your booking.
Government, regulatory, law-enforcement, court, tax, food-safety, or consumer authorities when disclosure is legally required or reasonably necessary to protect rights, safety, and security.
A successor or adviser involved in a proposed merger, reorganisation, financing, or sale, subject to confidentiality and applicable law.

These providers may process data under their own privacy notices when acting independently, particularly when you interact with a payment, maps, browser, or messaging service directly.

5. International processing

Our PostHog project is configured to use PostHog's European Union cloud ingestion endpoint. Some technology providers, their personnel, or their subprocessors may nevertheless process or make support access to data available outside India or the European Union. Where this occurs, we require appropriate contractual, technical, and organisational safeguards and comply with restrictions notified under applicable Indian law. Provider location and subprocessor arrangements may change over time.

6. Retention and deletion

We keep personal data only as long as reasonably necessary for the purpose collected and for applicable legal, accounting, tax, food-safety, payment, fraud-prevention, complaint, and dispute periods. Retention depends on the record:

Profile and saved-address data is generally kept while your account remains active or until you delete an address or request account closure, subject to records we must retain.
Order, catering-selection, cancellation, invoice, payment, refund, complaint, and audit records are retained for the period required to meet tax, accounting, consumer-protection, payment, and legal obligations.
OTPs are short-lived. Related authentication, fraud, and security logs may be kept longer where necessary to protect accounts and demonstrate compliance.
Browser-stored information remains until the website removes it, you clear site data, or the applicable session expires.
Your optional analytics preference is stored for up to 180 days so that we can respect your choice on later visits.
Analytics events and privacy-masked session recordings are kept according to our configured provider retention periods and may subsequently be deleted or aggregated. We may retain aggregate statistics that no longer reasonably identify a person.

When retention is no longer necessary, we delete, anonymise, or securely isolate the data. Backups and fraud-prevention records may take additional time to expire and will not be used for unrelated purposes while retained.

7. Cookies, sessions, and browser storage

The website uses essential browser storage and may use essential cookies or similar technologies to keep you signed in, protect requests, remember your cart and booking details, migrate older saved addresses, and complete checkout. This includes local storage for cart items and totals, booking type, date, guest count, location text and Place ID, and authentication session data.

Google Analytics and PostHog cookies, local storage, scripts, and similar pseudonymous identifiers are optional. We do not load these analytics tools, start PostHog session replay, identify your account to PostHog, or send server-side PostHog events unless you select "Accept analytics". They measure visits, page views, traffic sources, booking-funnel interactions, and privacy-masked sessions; we do not use them for third-party behavioural advertising.

Selecting "Reject optional" does not affect authentication, your cart, booking, security, Razorpay checkout, or payment verification. You can change or withdraw your choice at any time through "Cookie settings" in the website footer. Withdrawal stops future optional analytics collection and clears Google Analytics cookies accessible to this website. You can also block or clear browser storage in your browser; clearing essential site data may sign you out or remove your cart, location, and incomplete booking. Contact us using the Privacy Request process in section 9 to object to analytics processing or request deletion of analytics data associated with your internal account ID, subject to applicable law and records we are entitled to retain.

8. Security

We use reasonable technical and organisational measures appropriate to the nature of the data, including OTP-based authentication, access controls, row-level database restrictions, server-side payment verification, restricted administrative access, transport security, logging, and service-provider controls. No system is completely secure, so protect your OTP and device and notify us promptly of suspected account misuse.

If a personal-data breach occurs, we will investigate, mitigate harm, and notify affected individuals and authorities when required by applicable law.

9. Your choices and rights

Subject to applicable law and necessary verification, you may:

ask for a summary of personal data we process about you;
access and correct profile details and add, edit, or delete eligible saved addresses through your account;
request correction, completion, updating, or erasure of personal data that cannot be managed through your account;
withdraw consent or opt out of promotional communications without affecting essential order and service messages;
request account closure, subject to records we are legally entitled or required to keep;
raise a grievance and, when applicable, nominate another individual to exercise your data rights in the event of death or incapacity; and
complain to the Data Protection Board of India or another competent authority when that remedy is available.

Email a request to hello@bookmybbq.com with the subject "Privacy Request". Describe the right you want to exercise and include the mobile number associated with your account. We may verify your identity and authority before acting. We will acknowledge and respond within the period required by applicable law. You may withdraw a consent-based request with comparable ease by using the same contact method.

10. Children's privacy

The Services and customer accounts are intended for adults aged 18 or older. We do not knowingly create customer accounts for, contract with, or intentionally process personal data from a person under 18 without the verifiable consent of a parent or lawful guardian where processing is permitted and required by law. If you believe a child provided data to us, contact us so we can investigate and take appropriate action.

11. Other people's information

If you provide another person's name, mobile number, venue, or delivery details, you confirm that you are authorised to do so and have made this Privacy Policy available to them. Do not provide unnecessary personal or medical information in free-text messages.

12. Automated decisions

We use automated checks to validate service area, prices, coupon eligibility, cart limits, authentication, payment status, and an initial cancellation refund-window estimate. Cancellation and refund requests remain subject to staff review. These checks support transactions and fraud prevention; we do not currently use customer data to make solely automated decisions that produce a similarly significant legal effect. Contact us if you believe an automated check was incorrect.

13. Changes to this policy

We may update this Privacy Policy to reflect legal, technology, provider, or Service changes. We will publish the updated date and, where required, provide prominent notice or seek fresh consent before using personal data for a materially different purpose.

14. Privacy contact and grievance process

Privacy and Grievance Contact: Customer Care Lead, Book My BBQ / Catermonk Foodtech
Address: VMGC+52, Bangalore, Karnataka, India
Email: hello@bookmybbq.com
Phone: +91 96203 93201

Include enough information for us to understand the issue without sending unnecessary identity documents. We aim to acknowledge consumer grievances within 48 hours and resolve them within one month, or within any different period required by applicable data-protection law.

This Privacy Policy should be read with our Terms of Service and Cancellation and Refund Policy.