Your data, and what we do with it

Ontabee is operated by Ontabee Solutions Pvt. Ltd., 09, Om Ganesh Nagar 3rd Cross W, East, Vadavalli, Coimbatore, Tamil Nadu 641041, India. For questions about this policy or your data, contact [email protected].

From restaurants (our customers): account and contact details, business information, and the payment/SMS/email provider credentials you configure — stored encrypted. From your diners (processed on your behalf): names, contact details, delivery addresses, and order history. Payment card data is handled by your own payment provider — we never store card numbers.

When you send us an enquiry through the contact form, we also record your IP address, the country it places you in, your browser’s time zone, and how you reached the site (the page you landed on, the site that referred you, and any campaign tags in the link). We use this to route and answer your enquiry and to understand which of our pages are useful. It goes to our sales inbox and our CRM (HubSpot) — never to advertising networks. Ask us at [email protected] to see or delete it.

To provide the ordering platform, process and route orders, send transactional messages through your configured providers, bill our subscription, provide support, prevent fraud and abuse, and keep the service secure. We do not sell personal data, and we do not use your customers' data to market to them on our own behalf.

You can export your data and your customers' data at any time from the dashboard (Compliance → Data requests), and you or your customers can request deletion. Deletion anonymizes personal details while retaining the financial records the law requires us and you to keep. Email [email protected] for any request you can’t complete in the dashboard; we respond within 30 days.

Production data is hosted in cloud regions selected per tenant at onboarding — EU tenants can be hosted in the EU, Indian tenants in India, and GCC tenants in the UAE/GCC region — so your data can stay in your jurisdiction where you require it. Backups remain within the same region.

Only the sub-processors needed to run the service: our cloud hosting provider and the platform-tier email service used solely for account verification, password resets, and our subscription invoices. Your customer-facing payment, SMS, email, maps, and push run through your own configured providers under your agreements with them, not ours.

Separately, sales enquiries you send us are stored in our CRM (HubSpot) so we can follow them up. Your diners' data is never sent there.

This marketing site also shares visit data with Google (Analytics and Ads) and Tawk.to, subject to the cookie choice below. None of them receives anything about your diners.

Account and menu data: for the life of your account plus 90 days. Order and payment records: 7 years, to meet tax and accounting obligations (yours and ours). Server logs: 90 days. Sales enquiries: 24 months from your last contact with us, unless you ask us to delete them sooner. When you leave, you can export everything during a 30-day offboarding window; we then delete or anonymize your data on this schedule.

Encryption in transit (TLS) and at rest, provider credentials stored encrypted in a secrets vault and never logged, role-based access controls, audited administrative access (including any support impersonation), and rate limiting. We never store card numbers — payments are processed by your own payment provider. We do not currently hold SOC 2 or ISO 27001 certification and won’t claim otherwise; our engineering practices are built toward those standards.

Your ordering surface — the storefront where your diners order — uses only essential cookies and storage: their session and their cart. No advertising or cross-site tracking runs there.

This marketing site is different, and we would rather say so plainly. ontabee.com loads Google Analytics 4, a Google Ads tag we use to measure which campaigns bring restaurants to us, and a Tawk.to chat widget. All three set their own cookies.

If you are in the EEA, the UK or Switzerland, none of them run until you accept: they are denied by default and we ask first. Elsewhere they load by default. Either way you can change your answer whenever you like — including now:

Change my cookie choice Cleared — the banner will ask you again.

We’ll post updates here with a revised date and notify you of material changes.