Privacy Policy — Benaam Kitchen

Who we are

Benaam Kitchen is a cloud kitchen operating from 51/43 P, Ramganj Road, Naughara, General Ganj, Kanpur, Uttar Pradesh 208001. We are the data controller for the information described here. For anything on this page, contact us on +91 93502 91675.

What we collect

We collect only what an order needs, and we tell you which is which.

Your account: Mobile number, name, and an email address if you give us one. Your mobile number is your account — we verify it with a one-time code and never store a password.
Your birthday, if you give it: The day and month, and the year only if you add it. We use it for one thing: your birthday treat and a birthday wish. The wish comes by push or WhatsApp only if you have switched those messages on. You can set or change it once in 12 months, and remove it at any time. We keep a record of each change, and it goes when your account does.
Delivery addresses: The addresses you save, along with the map coordinates you pin, so we can work out whether you are in range and what delivery costs. If you add them, your delivery instructions (such as "leave with the guard") and a photo of your door or building, which your rider sees. We remove the location your phone stores inside the photo before we keep it.
Orders: What you ordered, what it cost, which coupon or loyalty points you used, the delivery address at the time, and the order's progress through our kitchen. We keep the address as a snapshot on the order, so editing a saved address never rewrites your past receipts.
Payments: Whether a payment succeeded, when, and by which method. Card and UPI details are handled entirely by Razorpay, our payment processor, and never reach our servers.
Reviews: Any rating or comment you leave, shown with your first name only.
Chat with your rider: Messages between you and your rider while your order is on its way. Neither of you sees the other's phone number.
Ratings from riders: After a delivery, the rider may rate it — for example whether you were reachable and the address was right. Only our staff see it. It is never shown to other customers, and it never blocks you from ordering on its own.
How the site is used: Which dishes were shown to you and which you opened, so we know what to cook more of. This is tied to a key derived from your network address and browser that we hash with the date — it changes every day and cannot be turned back into an address.
Notifications: If you allow them, a device token so we can tell you when your order is on its way.

Why we keep it

To cook and deliver what you ordered, and to let you track it.
To take payment and to issue a refund if something goes wrong.
To show you your order history and let you reorder in one tap.
To run the loyalty scheme, which needs a record of points earned and spent.
To decide whether we can deliver to an address, and what to charge for it.
To understand which dishes work, in aggregate, so the menu gets better.
To meet our tax and accounting obligations.

We do not sell your data, and we do not use it to build advertising profiles.

Who else sees it

Only the parties an order genuinely passes through:

Our kitchen and delivery staff — your name, phone number and address, for the order they are working on.
Razorpay — to take payment. They handle the card or UPI details directly.
The messaging service that sends your one-time code and order updates — today that is WhatsApp, operated by Meta. If we move to SMS we will name the provider here before we do.
Google Firebase — to deliver push notifications, if you have allowed them.

We share nothing else with anyone, and we never sell or rent your details.

How long we keep it

Each kind of information has its own limit, and a job runs every night to remove whatever has passed it.

Orders and payments — seven years, for our accounts. After that, or sooner if you delete your account, they stay but no longer carry your name, phone number or address.
Your account and saved addresses — while you use us. If you have not ordered or signed in for three years, we tell you, and delete the account a week later unless you sign in.
Messages we sent you — the wording is removed after 90 days.
Complaints and their photos — three years.
Records of what you agreed to — seven years, because they are our proof that we were allowed to hold your data. Your latest choice is kept for as long as it applies.
How the site is used (pages and dishes viewed) — 24 months.
Offers and reminders we sent you, and which group of customers you were in when we sent them — 24 months. The group you are in now is kept while it applies.
Enquiries about large orders — your name, number and what you asked for are removed after three years.
Delivery-partner location logs — 30 days.
Chat with your rider — 30 days, or with the complaint if you raise one about that order.
One-time sign-in codes — expire within minutes, and the record that one was sent is deleted within seven days.
Our own error logs — 30 days.
A download of your data — 24 hours.

Encrypted backups of all of this are kept for up to twelve months, so that we can recover from a failure. A backup is never used to bring back something you asked us to delete.

Your rights

You can act on all of these yourself from your account page.

Get a copy: Download everything we hold about you — your profile, saved addresses, orders, saved dishes, reviews, points, and each time you agreed to this policy.
Correct it: Change your name and saved addresses at any time. To correct anything else, call us.
Have it erased: Request deletion and we schedule it. It happens 7 days later, and you can change your mind and cancel at any time before then. We cannot start while you have an order in progress or a refund still pending, and we have to keep the minimum accounting record the law requires.
Choose what we send you: Messages about new dishes are off unless you switch them on, one switch each for app notifications, WhatsApp, text messages and email. Turning one off is the same single tap as turning it on, takes effect from the next message, and needs no reason. Order updates are not among them: they are how you hear that your food is on its way.
Withdraw consent: Switch any of those off on your account page, or close your account entirely. We record the date, the version of this policy and what you chose, each time, and your account page lists each one.

Cookies and storage

We set three cookies, all our own. None is shared with anyone else.

bk_session keeps you signed in.
bk_sid is a random number for one visit. It lets us see, in total, which dishes people look at and which they order, so the menu gets better. It holds no name, phone number or address, and we do not record your internet address. A new one starts after 30 minutes away or at midnight.
bk_src is set only if you scanned one of our printed cards. It holds the card's code, so we know whether the cards work. It lasts 30 days.

Your basket, your favourites and your sign-in token are stored in your own browser and never leave your device except when you place an order.

How we protect it

Everything you send us travels over an encrypted connection. We never see or store your card or UPI details — those go straight to Razorpay. Your one-time sign-in code is stored only as a one-way hash and expires within minutes, so the code itself exists nowhere on our systems. Staff accounts are limited by role, so nobody sees more than their job needs, and every change made from the admin console is logged against the person who made it.

If your personal data is ever exposed, we will tell you without delay, and report it to the Data Protection Board of India within 72 hours of finding out, as the law requires. The owner of Benaam Kitchen is responsible for both.

Where your data is held

Our servers and our payment processor are in India. Push notifications are delivered through Google Firebase and messages through WhatsApp, both of which process data on infrastructure outside India. We do not transfer your data to any country the Government of India has restricted.

We keep an encrypted copy of our records with a separate storage provider, so that a failure of our server does not lose your orders. We will name that provider here before we use one. The copy is locked with a key that provider does not have.

Children

Benaam Kitchen is not intended for anyone under 18, and we do not knowingly collect information from children.

Changes

If this policy changes materially we will raise the version number and ask you to accept it the next time you sign in. Your account records which version you agreed to and when. "Materially" means a new use of your data or a new kind of company it goes to — not a clarification.

29 September 2026 — version 1.2. One material change: riders may now rate a delivery, and that rating is kept about you (a new use). You will be asked to accept this version the next time you sign in. It also lists, together, everything added since 1.1 below.
28 September 2026 — added your birthday, which you can choose to give us for a birthday treat. Not a material change: nothing is collected unless you enter it, and nothing you gave us before is used for anything new.
29 September 2026 — added delivery instructions and door photos, chat with your rider, and riders' ratings of deliveries.
26 September 2026 — added the separate switches for messages about new dishes, the full list of how long we keep each thing, and what we do if data is exposed. Not a material change: messages about new dishes need you to switch them on here, so nothing you agreed to before is used for anything new.
25 September 2026 — version 1.1.

Questions

Call or message us on +91 93502 91675, or write to us at the kitchen address above. We will reply to a question about your personal data within 30 days. A problem with an order is quicker — see our contact and complaints page.

If we get it wrong

Our grievance officer is , reachable on +91 93502 91675 or by email at . Raise anything with them first and they will answer within 30 days. If you are not satisfied with how we have handled it, you may complain to the Data Protection Board of India.