Privacy

Nivala is billing software for one café in India. We collect what we need to set up your café, run the app for you and, if you ask, call you back. We do not sell lists of cafés or anyone’s details.

What we collect

• When you create your café: your name, café name, city, email, a password and an optional phone number. We keep only a scrambled (hashed) form of the password, never the password itself, and we email you a link to confirm your address.
• Optional callback request on this website: your name, café name, city, email and phone. If sending it fails, this browser keeps what you typed so you can try again without retyping. It is deleted when the request is sent, and after 7 days if it is never sent.
• Your account: your name, email, an optional phone number, menu, tables, staff names and PINs, orders, bills, payments as recorded by staff, expenses, and the GST details you enter.
• Your subscription: plan, payment dates and amounts. Your card or UPI details are handled by Razorpay; we never see your full card number.
• Optional analytics cookies on this website. Tap Decline on the cookie bar to stop them, or change your answer later with Cookie choice below.

What we do not collect when you create your café

You do not enter any payment details to create your café. Your guests’ UPI payments stay on your own QR or UPI speaker. We are not an e-invoice portal.

Your guests’ details

The app also holds details about your café’s own guests if your staff enter them: a guest’s name or phone number, their orders and bills, and the payments your staff record. Your café decides what to collect and is responsible for it. We keep and use it only to run Nivala for your café, never for our own marketing.

India’s Digital Personal Data Protection Act, 2023 gives people the right to see, correct and delete their personal data. Under that law your café decides why guest data is collected, and we handle it on your café’s behalf. A guest who wants to see or delete their details should ask the café first. The café, or the guest, can also email hello@thenivala.com; we will help the café answer within 30 days.

Where your data is stored

Your café’s data, including your guests’ and staff’s names and phone numbers if you enter them, is stored in Singapore, on Render. Encrypted backups are kept in the USA, with Backblaze. The data belongs to your café; we only look after it for you. We do not store it in India today. If India’s rules for sending data abroad change, we will tell you.

The app and its database run on Render in Singapore. Each night an encrypted copy of the database is stored with Backblaze in the USA, so we can recover your records if something goes wrong.

If something goes wrong with your data

If we find that someone who should not have it got hold of personal data we keep, we tell the café owner’s email address without undue delay, say what happened and what we are doing about it, and help you tell your guests and the authorities if the law needs that.

Cafés we write to first

We also email some cafés we find in public business listings, such as Google Maps, to tell them about Nivala. We use only what the listing shows: the café’s name, address, phone, website and business email. Every such email has an unsubscribe link; if you use it or ask us to stop, we write to you no more and keep only a note not to contact you again. Tell us at hello@thenivala.com and we delete what we hold about your café.

Who handles it

• Render (Singapore): runs the app and stores the database.
• Backblaze (USA): stores the encrypted nightly copy.
• Razorpay (India): takes your monthly payment for Nivala.
• Resend (USA): sends our emails, such as email confirmation and password emails.
• Google Gemini: reads a menu photo only if you choose to add your menu from a photo during set-up. We send these photos to our reading service (Google Gemini) to extract dish names and prices. We do not keep the photos. We keep only the number and size of the photos read, to apply fair-use limits.
• Vercel: hosts this website.
• Google Analytics: loads on this website only if you tap Accept. It never loads inside the app.

Each of these only gets what it needs to do its job.

How long we keep it

• Your account and café records: for as long as you use Nivala.
• Bills, payments, refund bills and tax records: at least 8 years from the end of the financial year they belong to, as Indian tax law requires. This applies even after you stop using Nivala.
• Other account details after you leave: deleted when you ask, except what the law says we must keep.
• A callback request from the website that does not lead to an account: deleted 12 months after we last spoke.
• A café account whose email was never confirmed, that never paid and was not signed into for 30 days: we remove the name, email and phone and close it.
• Nightly encrypted copies: deleted after 30 days.
• Records of sign-in attempts: deleted after 30 days. Server logs: deleted within 90 days.

Your choices

Email hello@thenivala.com to see, correct or delete the details we hold about you, or to download your café’s records. You can use the same email for any request under India’s Digital Personal Data Protection Act, 2023. We reply within 30 days. We never ask for your password or staff PINs to do this.

Complaints and data requests go to hello@thenivala.com.

Cookie choice

Tap Decline on the cookie bar and we do not load analytics. To change your answer later, tap Cookie choice here or at the bottom of any page and pick Accept or Decline. If you decline, measurement stops at once on the page you are on and is not loaded again in this browser.