Privacy policy
Last updated: 14 November 2026
This policy explains what the BhuSutra website collects, why, and what your rights are. The short version: your restaurant data stays on your own computer, in your browser's private storage and in backup copies in a folder you choose. This website keeps only what you type into the trial form and the technical records needed to run it. If you add kitchen screens, staff phones or guest QR ordering, their messages pass through our relay on the way to your computer, and the relay does not store them.
1. Who we are
BhuSutra is a restaurant management product in development, run by its founder. For the purposes of data protection law, the founder is the controller of the personal data described below.
To reach us, email bhushanrtandukar@gmail.com or message @bhusutra on TikTok.
2. What we collect
| Data | When | Why |
|---|---|---|
| Name, email, venue name, country, optional note | When you submit the trial form | To review your request and contact you about it |
| Trial key, request status, approval and expiry dates | When a request is approved or rejected | To give you your trial and check it is valid |
| Your trial key, IP address, browser type and the time | Each time you open the app, and each time it checks its key | To hand the app its program code only to a valid trial key, to stop keys being shared or abused, and to protect the service |
| A random restaurant address and a one-way fingerprint (hash) of a secret held by your main computer | When your main computer first connects to the relay | So that only your main computer can act as your restaurant's server. It contains nothing about your business |
| Technical request data (IP address, browser type) | Whenever you load the site or submit a form | Processed by our hosting provider to deliver the site and protect it from abuse |
The legal basis is your request (steps taken at your request before you start a trial) and our legitimate interest in running and protecting the service. By ticking the box on the form you also confirm you have read this policy.
3. What we do not collect
- Your restaurant data. Orders, menus, stock, staff, guests and finances are saved on your own computer, in your browser's private storage and in backup copies in a folder you choose. We never keep a copy, and they are not sent to this website, except as described in section 4 when you use other devices.
- No cookies, no analytics and no advertising trackers on this website. The BhuSutra app saves a few things on your own device so that it can work: see the Cookie notice.
- No payment details. Trials are free.
4. How the trial and the app work
Your restaurant runs in your browser, on your own computer. When you open the app, it downloads its program code from this website using your trial key (we see the key, your IP address and browser details), and it asks this website every few hours whether the key is still valid. Nothing from your restaurant database is sent in these requests.
Other devices and guest ordering. Kitchen screens, staff phones and guests' phones cannot reach your computer directly, so their messages travel to it through a relay that we run on Cloudflare. These messages can include orders, guests' choices and allergy notes, staff names and PIN sign-ins. The relay passes each message on as it arrives and does not write its contents anywhere; it keeps only the live connections and the fingerprint described in section 2. The relay is not end-to-end encrypted: like any hosting provider, our systems and Cloudflare's can technically see traffic while it passes through, and we do not look at it. If your main computer is off, nothing is queued and guests are told that ordering from their phone is paused.
You decide what you collect. If you use BhuSutra in your restaurant, you decide what you collect about guests and staff, and you are responsible for it under the law that applies to you. We handle those messages only in transit, on your behalf.
5. Who handles data for us
- Cloudflare, Inc. hosts the website and the app, stores trial requests in its database service and runs the relay described in section 4. Data may be processed in countries outside your own, under Cloudflare's own safeguards.
- Google Fonts. The pages load typefaces from Google, which receives your IP address and browser details when it does. We plan to host the fonts ourselves.
We do not sell your data and do not share it for marketing.
6. How long we keep it
Trial requests are kept while your request or trial is active and for up to 12 months afterwards, then deleted, unless you become a customer or the law requires us to keep them longer. The restaurant address and fingerprint are kept for the same period. Relay messages are not kept at all. The database and backups on your computer are yours to keep or delete.
7. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or the California CCPA/CPRA), you can ask to see, correct, export or delete your data, object to its use, or complain to your data protection authority. Contact us using the channel above and quote your request reference.
8. Children
The site is for business owners and staff and is not directed at children under 16.
9. Changes
If we change this policy we will update the date above. Material changes will be highlighted on the site.
This policy is written in good faith for a small product in development. It should be reviewed by a qualified lawyer before general launch.