Version 0.1 · published 1 Nov 2026

Eats BMU — Privacy Notice

DRAFT — to be reviewed before public launch.

1. What we collect

  • Your account: name, BMU email address, phone number, default hostel, and whether you are 18 or older.
  • Your orders: what you ordered, from which store, when, how you paid (cash or UPI and the UPI reference), pickup or delivery gate, and any note you add.
  • Sign-in and consent records: when you signed in and accepted these terms, your IP address and browser type.
  • Complaints you send us, including any photo you attach.
  • Notifications: if you turn them on, the technical address your browser gives us to send them.

We do not collect your date of birth, home address, card or bank details, or location.

2. Why we use it

  • To run your orders: so the store knows what to make and who to hand it to.
  • To keep the service safe and fair: sign-in codes, strikes, refunds, complaints and records the law asks us to keep.
  • To estimate waiting times (see section 5).

3. Who sees what

  • The store sees your name and phone number, and your delivery gate and note, only while your order is active.
  • Eats BMU admins (the operator and one helper) can see orders and complaints to resolve problems.
  • We send email through Gmail and Brevo, and notifications through your browser's push service. We do not sell or share your data with anyone else, and we show no ads.

4. Payments

You pay the store directly by cash or UPI. Eats BMU never receives or stores your bank or card details.

5. AI and wait-time estimates

  • We estimate "ready in about N minutes" with a simple rule or a small machine-learning model trained on past orders. That training data contains no names, emails, phone numbers or delivery notes; times are rounded to 15 minutes.
  • Stores may use AI to draft menu descriptions. A person checks every draft before it is shown.

6. How long we keep it

  • After 2 months, your phone number and delivery notes on old orders are hidden from screens.
  • After 12 months, they are deleted. Order records (without your personal details) are kept for accounts.
  • If you don't use Eats BMU for 12 months, your account is anonymised.

7. Your rights

You can see and correct your details in Profile, turn notifications off, withdraw consent and delete your account from Profile → "Delete my account". Deletion happens after 48 hours (so you can change your mind); your name, email and phone are then removed, and past orders stay only as anonymous records.

8. Under 18

If you tell us you are under 18, we never personalise anything for you. Please ask a parent or guardian before using the service.

9. Security

Sign-in uses one-time email codes; admins also use an authenticator app. Data is stored on a server in India, encrypted backups are kept, and access is logged. If a serious security incident affects you, we will tell you.

10. Contact

Questions or requests: the grievance officer named at the bottom of every page.

Fingerprint (SHA-256): 0164cb12022303be2bac4b240f35407e17fdece1866df10b8570b28312392468