How AnnapurnaOps handles your data.

Who we are

AnnapurnaOps is a kitchen operations platform operated by SandCo Tech Services ("SandCo", "we", "us", or "our"). SandCo is the data controller for personal information processed through AnnapurnaOps. This Privacy Policy explains what we collect, how we use and share it, how long we keep it, and the choices you have. It applies to the AnnapurnaOps web application and marketing site.

Information we collect

We collect the following categories of information:

• Account and contact details — name, email, business and branch details, role, and login identifiers.
• Operational data you enter — daily kitchen close-out entries, ingredient and inventory records, sales summaries, forecasts, staffing and task records, and guest reviews.
• Connected-service data — information we access on your behalf from services you link, such as Google Business Profile (see "Google user data" below).
• Usage and device data — log data, device and browser information, and actions taken in the app, used to keep the Service secure and reliable.
• Support communications — messages, onboarding notes, and feedback you send us.

Google user data

If you choose to connect your Google Business Profile account, AnnapurnaOps requests access through Google’s OAuth consent screen. With your authorisation, we access your business locations, read the guest reviews on those locations, and — only when you explicitly approve a reply — publish that reply back to Google on your behalf.

We use this Google data solely to provide those features inside AnnapurnaOps: showing your reviews, helping you draft replies (including suggested reply text produced with automated tooling), and publishing replies you have approved. A human on your team always approves a reply before anything is posted. We do not use Google user data for advertising, we do not sell it, and we do not share it with third parties except as needed to provide these features to you or as required by law.

OAuth tokens for your Google connection are encrypted at rest using AES-256-GCM and are accessible only to the components that operate the integration. You can revoke our access at any time by disconnecting Google Business Profile in your AnnapurnaOps settings, or from your Google Account permissions page.

AnnapurnaOps’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

We use the information we collect to:

• operate, maintain, and secure the Service, and provide the features you use;
• generate forecasts, alerts, and recommendations, and improve their quality over time;
• provide onboarding and customer support, and respond to your requests;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• comply with legal obligations and enforce our Terms of Service.

How we share information

We do not sell your personal information or your operational data. We share information only with service providers who process it on our behalf to run the Service, under contracts that require confidentiality and appropriate safeguards.

These providers include cloud hosting and database infrastructure, notification delivery, and automated processing services used to generate forecasts and draft suggested review replies. We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a business transfer.

Data retention

We retain your information for as long as your account is active or as needed to provide the Service. When you close your account or request deletion, we delete or anonymise your data within a reasonable period, except where we are required to retain it for legal, tax, or security reasons. Task proof photos and voice memos are kept for 90 days by default, and each branch can set its own retention window (minimum 30 days); Google OAuth tokens are deleted when you disconnect the integration.

Your choices and rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and you may export your operational data. You can disconnect linked services at any time and manage notification preferences within the app. To exercise these rights, contact us at hello@annapurnaops.com; we will respond within the timeframes required by applicable law.

Security

We protect information using encryption in transit and at rest, role-based access controls, branch-level data isolation, and least-privilege access to sensitive credentials. No method of transmission or storage is completely secure, but we work to protect your data and to promptly address any issues we identify.

International processing

We are based in India and process data there and through cloud infrastructure providers that may operate in other countries. Where information is transferred across borders, we take steps to ensure it remains protected in line with this Policy and applicable law.

Children

The Service is intended for restaurant businesses and their staff, and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

Changes and contact

We may update this Privacy Policy from time to time. When we do, we will revise the "last updated" date above and, where the change is material, notify you through the Service. For any privacy question or request, contact SandCo Tech Services at hello@annapurnaops.com.