Cafe Desk

Privacy Policy

Effective 9 October 2026

Cafe Desk (“we”, “us”) is a service operated by CAFE DESK that lets gaming cafes take bookings and advance payments on WhatsApp and manage them on a web dashboard. This policy explains what personal data we process, why, and the choices you have. It follows India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

Who is responsible for your data

  • Cafe customers (people who book at a cafe on WhatsApp): the cafe decides why and how your booking data is used, and we process it on the cafe’s behalf. For most requests, contact the cafe; you can also contact us and we will help.
  • Cafe owners and staff (people with a dashboard account): we decide how your account data is used, as described here.

What we collect

  • Cafe customers: your WhatsApp name and number, your preferred language, the messages you send to the cafe’s WhatsApp number and the cafe’s replies, your bookings (date, time, station, players, price), payment status and amounts, refund requests and support tickets. We do not collect card, UPI or bank details: payments are made on Razorpay’s pages.
  • Owners and staff: name, mobile number, the cafe you work at and your role, sign-in records, push-notification subscriptions you allow on your devices, and the actions you take in the dashboard (kept in an audit log).
  • Cafes: business name, address, WhatsApp Business and Razorpay connection details (access tokens are stored encrypted), prices, opening hours and policies.
  • This website sets no cookies and runs no trackers or analytics scripts.

Why we use it

  • To show free slots, create and confirm bookings, take advance payments and send booking messages such as confirmations, reminders and changes.
  • To let the cafe’s owner and staff see and manage bookings, payments, refunds and support requests.
  • To sign owners and staff in with a one-time code sent on WhatsApp.
  • To keep the service secure, prevent abuse, fix errors and meet legal and accounting obligations.

Cafe customers see a short privacy notice the first time they message a cafe. We do not sell personal data and do not send marketing messages.

Automated understanding of messages

When a customer types a booking request in their own words (for example “PS5 tomorrow 8pm”), our software first tries fixed rules. If those cannot understand it, the message text may be sent to an AI language-model provider only to extract the date, time and device. The provider returns structured details; it does not decide or confirm bookings, and we do not keep the message text in our AI logs.

Who we share it with

Only with the service providers needed to run Cafe Desk, under their own security and privacy terms:

  • Meta Platforms (WhatsApp Business Platform), to send and receive WhatsApp messages.
  • Razorpay, to take payments and refunds into the cafe’s own Razorpay account.
  • Supabase (database, sign-in and server functions) and Cloudflare (website and dashboard hosting).
  • An AI language-model provider, only as described above, and an error-monitoring service that receives technical error reports.
  • Authorities, when the law requires it.

Your data is stored in Mumbai, India. Some providers may process data outside India; we use only providers that protect it with appropriate safeguards.

How long we keep it

  • WhatsApp message text: 180 days, unless the cafe sets a shorter period.
  • Booking, payment and refund records: as long as accounting and tax law requires. If you ask us to delete your data, these records are kept without your name and number.
  • Audit logs: at least one year. Encrypted backups: up to 30 days.
  • Owner and staff accounts: until the account is removed, then as required by law.

How we protect it

Data is encrypted in transit (HTTPS) and stored with access controls that keep each cafe’s data separate. Cafe tokens and keys are encrypted at rest. Staff accounts never see earnings or payment details. Access by our team is limited, time-boxed and logged.

Your rights

You can ask to access, correct or delete your personal data, ask how it has been used, withdraw consent for future processing, nominate someone to act for you, and raise a grievance. Cafe customers can reply STOP to a cafe’s WhatsApp number to stop non-essential messages. See Data Deletion for how to request deletion. We reply within 30 days.

Children

The dashboard is for adults who own or work at a cafe. Cafes set their own age rules; a customer under 18 should book with a parent’s or guardian’s permission.

Grievance officer and contact

For privacy questions, requests or complaints, contact our grievance officer:

CAFE DESK
Email: cafedesk.support@gmail.com

If you are not satisfied with our reply, you may complain to the Data Protection Board of India.

Changes

We will post any change on this page with a new effective date, and tell cafes about important changes on WhatsApp or email.