Cookie Policy

1. Preamble, Corporate Identity, and Scope of Agreement

Welcome to DineBuddy. This comprehensive Cookie Policy ("Policy") establishes a binding technical and legal framework governing the collection, storage, retrieval, reading, and management of data stored on or accessed from the terminal equipment, mobile devices, computing hardware, or web browsers of all individuals and business entities (collectively, "Users," "you," or "your") interacting with DineBuddy Technologies Private Limited (operating under the trade name "DineBuddy," "we," "us," or "our").

This Policy extends comprehensively to all software surfaces, interfaces, digital touchpoints, and technical environments engineered, maintained, or licensed by DineBuddy, including without limitation:

• Our primary public domain and corporate portals hosted at https://dinebuddy.ai, including all associated subdomains, documentation pages, developer consoles, and landing directories.
• Our proprietary, in-venue Quick Response (QR) code dining portals accessed by restaurant diners, hotel guests, and patrons by scanning physical table standees, table tent cards, digital kiosk displays, or printed bills at affiliated food and beverage establishments.
• Our comprehensive administrative software suite, including the Restaurant Management Portal (/admin), the Kitchen Display System (KDS), digital captain consoles, POS synchronizers, and analytics workstations.
• Our conversational generative Artificial Intelligence (AI) Waiter engine, voice-assisted ordering modules, dynamic menu recommendation algorithms, and automated guest query widgets.

Incorporation and Precedence: This Cookie Policy operates as an inalienable, integrated schedule to the DineBuddy Terms of Service and the DineBuddy Privacy Policy. Any capitalized term not expressly defined herein shall bear the definition and interpretation ascribed to it in our Terms of Service or Privacy Policy. In the event of any irreconcilable discrepancy between the general terms of our Privacy Policy and the specific technical provisions of this Cookie Policy regarding the operational mechanics of cookies and local storage keys, the provisions of this Cookie Policy shall govern.

2. Definitions and Interpretative Standards

For the purposes of this Policy, the technical and legal terms set forth below shall have the following unambiguous meanings:

• "HTTP Cookie" or "Cookie"means an alphanumeric string or text data file delivered via HTTP/HTTPS response headers from a web server and stored within the client-side file system or memory of a User's browser. The cookie is subsequently returned by the browser in subsequent HTTP request headers to preserve state across stateless network transactions.
• "Session Cookie" refers to an ephemeral cookie stored in volatile memory that is destroyed and purged immediately upon termination of the active browser session, closing of the browser window or tab, or conclusion of the maximum dining session threshold established by the restaurant partner.
• "Persistent Cookie"refers to a non-volatile cookie that remains resident on the User's terminal equipment beyond the termination of an individual browsing session, persisting until its designated expiration timestamp elapses or until manually deleted by the User through browser administrative settings.
• "First-Party Technology" means any cookie, script, or storage key originated, placed, set, and directly controlled by the host domain (e.g., dinebuddy.ai) operated by DineBuddy Technologies Private Limited.
• "Third-Party Technology"means any cookie, beacon, script, or storage token placed on a User's terminal equipment by an authorized external third party, such as a secure payment gateway aggregator, cloud infrastructure provider, or DDoS mitigation network.
• "Local Storage" (localStorage) means persistent client-side key-value web storage defined under the W3C HTML5 Web Storage specification, allowing client applications to store structured JSON strings up to 5MB to 10MB per origin without incurring bandwidth overhead on every HTTP request header.
• "Session Storage" (sessionStorage) means non-persistent client-side key-value web storage under the HTML5 specification that maintains data exclusively for the duration of the originating page tab session and is instantly destroyed upon tab closure.
• "QR Table Token" means a cryptographically generated, venue-specific and table-specific transient identification token embedded in a QR code URL and verified via client session headers to anchor a diner to a designated dining table.
• "Session Duration Window" means the administrative time limit (e.g., 2 hours, 4 hours, 6 hours, or 24 hours) configured by a Restaurant Partner within the DineBuddy workstation that governs the automated expiry of active customer table ordering sessions.
• "Device Fingerprinting" refers to the practice of harvesting hardware, font, canvas, and audio characteristics to covertly identify devices without cookies. DineBuddy explicitly prohibits and does not engage in cross-site device fingerprinting.
• "AI Waiter Assistant" means our proprietary conversational intelligence engine deployed within the digital menu that answers culinary questions, recommends pairings, and calculates custom dietary modifications.

3. Technical Architecture & Core Operating Principles

DineBuddy operates on a philosophy of Purpose Limitation and Data Minimization. While commercial ad-tech networks deploy third-party trackers across hundreds of disparate domains to construct behavioral advertising profiles, DineBuddy's technical architecture deploys cookies and browser storage solely to enable real-time dining operations, secure administrative workstations, and prevent culinary fraud.

3.1 Zero Cross-Site Behavioral Advertising

DineBuddy maintains an absolute, corporate-wide commitment: We do not sell, license, monetize, or barter diner behavioral data, order records, or device identifiers to third-party ad exchanges, data brokers, or retargeting networks. Our cookies and storage mechanisms are confined strictly to the functional perimeter of our platform. When you dine at a participating restaurant and scan a DineBuddy QR standee, you are not tracked across unrelated third-party websites or social networks.

3.2 Contactless Guest Dining & Accountless Table Authentication

We recognize that restaurant diners demand immediate, frictionless access to digital menus without undergoing mandatory, invasive registration flows. When a diner scans a physical table QR code:

• The client browser executes our lightweight single-page application (SPA), establishing an ephemeral table session identifier (dinebuddy_table_session).
• This identifier links the diner's browser to the physical table number (e.g., Table 12 at Venue #89) on our server-side WebSocket router.
• This technical binding guarantees that items added to the cart, special dietary modifications requested, and bills generated are routed with zero latency directly to that specific table's kitchen ticket on the KDS console.
• Diners are not required to download native apps from app stores or submit permanent passwords, drastically shrinking their digital attack surface.

3.3 Cart Persistence and Network Resilience

Hospitality environments frequently experience dead zones, congested cellular bands, or unstable guest Wi-Fi networks. To prevent catastrophic data loss during meal selection, DineBuddy utilizes HTML5 localStorage (dinebuddy_cart) to maintain unsubmitted dish selections locally on the diner's device. If a diner refreshes their browser, receives an incoming phone call, or temporarily loses connectivity while reviewing the wine list, their uncommitted food choices, portion sizes, and spice selections are instantaneously reconstituted without data corruption.

3.4 Anti-Collision Session Locking & Fraud Mitigation

Because table QR codes exist in public physical dining rooms, malicious actors outside the premises could theoretically attempt to scan photos of QR codes to tamper with active dining tickets or cancel ongoing food preparation. DineBuddy utilizes session-locked cryptographic tokens combined with ephemeral geofence verification keys (dinebuddy_geofence_verified) to validate that order dispatches originate from verified, active physical sessions inside the restaurant premises.

3.5 AI Waiter Conversational Threading

Our AI Waiter Assistant functions as an intelligent culinary concierge. To provide coherent, context-aware dialogue (such as remembering that a diner mentioned a peanut allergy three messages prior, or calculating total calories across three recommended appetizers), the AI engine maintains an ephemeral conversation thread key (dinebuddy_ai_thread_id) in sessionStorage. This thread context exists only for the active dining duration and is purged upon session conclusion.

3.6 Administrative Workstation Cryptographic Isolation

For restaurant owners, general managers, floor captains, and culinary staff accessing the DineBuddy administrative dashboard (/admin), security protocols are elevated to financial-grade parameters:

• Access tokens are managed strictly in transient memory, while long-lived refresh tokens (dinebuddy_refresh_token) are delivered via encrypted, HttpOnly, Secure, and SameSite=Strict or SameSite=Lax cookies.
• The HttpOnly flag guarantees that client-side JavaScript execution contexts cannot read, access, or exfiltrate the administrative authentication token, effectively neutralizing the entire threat vector of Cross-Site Scripting (XSS) credential theft.
• Cryptographic CSRF anti-tamper cookies prevent cross-origin state alteration attacks, ensuring that malicious external tabs cannot trigger unauthorized billing settlements, menu deletions, or refund payouts.

4. Granular Classification of Deployed Technologies

In compliance with European Union ePrivacy rules and global data protection guidelines, we segment our technical cookies and web storage tokens into four distinct functional tiers:

5. QR-Based Dining: Guest Lifecycles & Automated Purging

A core innovation of the DineBuddy Platform is our dynamic, merchant-controlled session duration management architecture. Because tables in restaurants naturally turn over across diverse dining formats, static indefinite cookies pose operational security risks. We implement automated session lifecycle controls as follows:

5.1 Venue-Specific Session Presets

Each Restaurant Partner configures their automated session duration through the DineBuddy Security Settings console (/admin/settings?tab=security) according to their venue dining concept:

• Café / Quick Service (QSR): Standard duration of 2 Hours, tailored for rapid meal turnover and short beverage visits.
• Casual Dining (Default): Standard duration of 4 Hours, engineered for standard sit-down restaurant services.
• Fine Dining & Lounges: Extended duration of 6 Hours, accommodated for leisurely multi-course wine pairings and banquet services.
• Hotel Restaurant & Room Dining: Extended duration of 24 Hours, allowing hotel guests to charge culinary orders to room folios throughout an overnight stay.
• Custom Administrative Duration: Configurable via custom slider from 1 hour to 48 hours for specialized resort and convention venues.

5.2 Automated Expiration Mechanics

When a customer scans a table QR code, the client-side session cookie is stamped with an absolute expiration time reflecting the venue preset. Once this threshold expires:

• The client browser immediately invalidates the table token, severing WebSocket transmission rights to the kitchen queue.
• Any uncommitted draft carts are purged from browser memory.
• New subsequent scans by incoming diners at that physical table initialize a brand-new cryptographic session ID, ensuring that incoming parties never inherit the billing tickets or conversation histories of prior guests.

5.3 Bill Settlement Immediate Purge

In addition to automated timer expiry, when a table order is marked as settled and closed by the restaurant POS or when a guest completes a digital payment, our servers dispatch a WebSocket termination packet. This command triggers an immediate client-side clearing routine, purging all table session tokens, cart states, and temporary dietary markers without requiring manual user intervention.

6. Authorized Third-Party Integrations & Infrastructure Partners

DineBuddy operates a high-availability cloud architecture. To deliver PCI-DSS compliant financial settlements, enterprise security mitigation, and geofencing capabilities, select verified third-party entities deploy technical cookies or tokens through our Platform:

7. Statutory Legal Grounds for Processing (DPDPA, GDPR, CCPA)

DineBuddy's deployment of client-side tracking and storage mechanisms is anchored firmly upon established statutory exceptions and legal bases under prevailing international jurisprudence:

8. User Rights, Autonomous Cookie Management & Browser Controls

You possess absolute autonomy over your browser storage. You can inspect, modify, restrict, block, or delete cookies and web storage data at any time through your client browser settings.

8.1 Step-by-Step Browser Configuration Instructions

To control or purge cookies on popular web browsers, follow the authoritative technical pathways provided below:

8.2 Global Privacy Control (GPC) & Do Not Track (DNT) Protocols

DineBuddy natively supports and honors the Global Privacy Control (GPC) standard. If your browser transmits a valid GPC signal (Sec-GPC: 1), our marketing servers automatically recognize this opt-out signal and suppress all non-essential marketing and third-party analytics scripts. Furthermore, while the historical Do Not Track (DNT) protocol lacks universal legal consensus, DineBuddy treats incoming DNT signals as a request to minimize telemetry data collection.

9. Cryptographic Security Standards & Transmission Integrity

DineBuddy enforces strict cryptographic and system-level security standards in accordance with ISO/IEC 27001 guidelines and Section 43A of the Information Technology Act, 2000:

• Transport Layer Security (TLS 1.3): All cookies, headers, and API payloads exchanged between client browsers and DineBuddy infrastructure are encrypted in transit using advanced cipher suites over TLS 1.2 or TLS 1.3, ensuring protection against packet sniffing and man-in-the-middle (MITM) attacks.
• Secure & SameSite Flag Enforcements: All sensitive cookies are deployed with the Secure attribute, preventing transmission over unencrypted HTTP channels, and the SameSite=Strict or SameSite=Lax attribute, insulating user sessions against unauthorized cross-origin requests.
• HttpOnly Shielding: Core authentication tokens are shielded behind the HttpOnly flag, strictly blocking all DOM and JavaScript access to eradicate token theft risks.
• Zero In-Memory Credential Caching: Diner credit card details, CVVs, and banking passwords are never processed through or stored within DineBuddy cookies or browser storage.

10. Data Retention, Purging, and Archival Policies

In strict adherence to the data storage limitation principle enshrined in the Digital Personal Data Protection Act, 2023, and Article 5(1)(e) of the GDPR, DineBuddy retains cookie and storage data only for the precise duration required to fulfill operational purposes:

• Table Ordering Sessions: Purged immediately upon bill payment, order closure, or expiration of the configured venue session window (2 hours to 24 hours).
• Admin Refresh Cookies: Maintained for a maximum rolling window of 30 days of continuous inactivity, after which re-authentication via multi-factor authentication (MFA) is strictly enforced.
• UI Layout Preferences: Maintained for up to 1 year on your client browser, allowing operators to preserve customized workspace views.
• Aggregated Telemetry: Anonymized performance logs are stripped of IP addresses and aggregated into statistical formats retained for system capacity planning.

11. International Data Transfers & Server Geography

DineBuddy operates primary cloud infrastructure located within secure data centers in India, with edge distribution nodes situated globally. If you access the Services from outside the Republic of India (such as from the European Union, United Kingdom, United States, or Middle East), technical cookies and session tokens may be processed on servers located outside your home country. In all such cross-border transfers, DineBuddy executes Standard Contractual Clauses (SCCs) and enforces robust technical safeguards to ensure that your data is afforded a level of protection equivalent to that mandated under applicable data protection laws.

12. Protection of Minors and Children's Information

DineBuddy does not design its platforms for or knowingly direct digital tracking technologies toward children under the age of 18 (or under 13 in relevant foreign jurisdictions) without parental supervision. We do not construct commercial marketing profiles or deploy behavioral tracking mechanisms targeting minors. If a parent, legal guardian, or restaurant manager discovers that a minor has submitted personal information or initiated an unsupervised digital ordering session through our platform, please alert our Grievance Officer at privacy@dinebuddy.in, and we will take immediate steps to purge all associated session tokens from our servers.

13. Periodic Audits, Revisions, and Notification of Material Amendments

We review this Cookie Policy periodically to reflect technological upgrades, restaurant workflow additions, and evolving statutory requirements under Indian and international law. Whenever modifications are enacted:

• We will update the "Last Updated" date displayed prominently at the top of this Policy.
• Where material changes expand the categories of tracking technologies deployed or alter how dining data is processed, we will provide prominent advance notice through banner disclosures on our digital menus, announcements in the administrative dashboard, or direct electronic mail notifications to registered restaurant partners.
• Your continued access or use of the Services following the posting of an updated Policy constitutes your affirmative acknowledgment and acceptance of the revised terms.

14. Statutory Grievance Redressal, Compliance Officer & Contact Details

In strict compliance with the Information Technology Act, 2000, Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, DineBuddy has designated a dedicated Grievance Officer and Data Protection Compliance Desk to address all inquiries, complaints, and rights requests concerning cookies and electronic data practices: