Privacy policy

Mesa · by DataHaat · Last updated 11 July 2026

This Privacy Policy explains how Mesa, operated as part of the DataHaat suite ("Mesa", "we", "us"), collects, uses and protects personal information when you use our point-of-sale platform. It applies to the business owners and staff who use Mesa, and it explains how we handle the guest information a restaurant records through the service.

This is a general template provided with the software. Review and adapt it for your business, and confirm it reflects your actual practices, with a qualified professional.

1. Information we collect

Account information

When you sign up we collect your name, email address, business name and the password you set (stored only as a secure Argon2id hash, never in plain text). If you sign in through a third-party provider, we receive the verified email that provider returns.

Business profile and documents

Your legal and tax details (such as GSTIN, FSSAI number, address and bank details) and any statutory documents you upload to the business documents vault.

Operational data

The data you create in running your business — menus, prices, orders, bills, offers, staff records and reports.

Guest information

Where you record customers, this may include a name and a mobile number. Mobile numbers are encrypted at rest and only their last four digits are displayed in the interface.

Technical information

Basic technical and usage information needed to operate and secure the service, and error diagnostics (which are stored in encrypted form).

2. How we use information

to provide, maintain and secure the service and your workspace;
to process orders, produce bills and reports, and send transactional emails such as the day-end summary or verification codes;
to prevent abuse, enforce our terms and content policy, and comply with law;
to improve the service and support you.

We do not sell your personal information or your guests' information, and we do not use it for third-party advertising.

3. Your guests' data and your responsibilities

When you record your customers in Mesa, you are the party that decides why and how that information is used ("the controller"); we process it on your behalf to run the service. You are responsible for collecting your guests' data lawfully, including giving any notices and obtaining any consents the law requires, and for handling requests your guests make about their data.

4. How we protect information

Encryption in transit over HTTPS;
Encryption at rest for sensitive data — business documents are stored outside the web root and encrypted with AES-256-GCM, and guest mobile numbers are encrypted;
Argon2id password hashing;
Tenant isolation so each business's data is walled off from every other business on the platform;
Sealed error reports that keep technical diagnostics encrypted;
role-based access, point-of-sale PINs and manager approvals for sensitive actions.

No system is perfectly secure, but we take reasonable measures designed to protect your data. See our Security page for more.

5. Sharing

We share information only as needed to run the service — for example with infrastructure and email providers that process data on our instructions, or where a payment or messaging provider is used at your request — and where required by law or to protect the platform and its users. Such providers are expected to protect the data and use it only to provide their service to us.

6. Retention

We keep your data for as long as your account is active and as needed to provide the service, then for any period required to meet legal, tax or accounting obligations, after which it is deleted or anonymised. Encrypted documents remain unreadable without their key.

7. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and you may object to or restrict certain processing. Contact us using the details below; we may need to verify your identity before acting. For guest data held in a restaurant's workspace, please contact that restaurant, which controls it.

8. Cookies

We use a small number of strictly necessary cookies to keep you signed in and to protect forms. See our Cookies page.

9. Children

Mesa is a business tool and is not directed to children. We do not knowingly collect personal information from children.

10. Changes

We may update this policy from time to time; we will change the date above and, where appropriate, notify you of material changes.

11. Contact

Questions about privacy can be sent to info@sanjivanimt.com.