Privacy Policy
Last Updated: 8 September 2026
This Privacy Policy explains how Abhijith Shaju, Shashank Singh and Visvatharasan Saravanan, carrying on business together under the trade name "nextBooq" ("nextBooq", "we", "us"), having a place of business at Lovely Professional University, Jalandhar-Delhi G.T. Road (NH-1), Phagwara, Punjab 144411, collects, uses, shares, and protects your personal data when you use the nextBooq website, dashboard, and booking widgets (the "Platform").
We process personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and rules made thereunder. This Policy is incorporated by reference into our Terms and Conditions.
1. Who is responsible for your data
nextBooq is the Data Fiduciary for the account you hold with us and for the operation of the Platform.
Each café you book with ("Café Partner") is a separate Data Fiduciary for the reservation information it receives about you and for anything it records about you in its own dashboard. When you book a table, your reservation details are shared with that Café Partner so it can honour the booking. Questions about how a particular café uses your information should be directed to that café; we will help you reach them.
2. Personal data we collect
2.1 Data you give us
| Data | When | Why |
|---|---|---|
| Name | Registration, or during a booking | To identify you to the café at your table |
| Email address | Registration | Account identity, email verification, password reset, booking confirmations |
| Phone number | Registration | So the café can contact you about your booking |
| Password | Registration | Stored only as a bcrypt hash — never in readable form, and never recoverable by us or by any café |
| Café business details (Café Partners only) | Onboarding | Café name, address, GSTIN, contact details, operating hours |
2.2 Data generated by your use of the Platform
| Data | Notes |
|---|---|
| Reservation records | Date, time, party size, table assigned, status history, and the timestamps of each status change |
| Deposit payment references | Razorpay order and payment identifiers, amount, and currency. We never receive or store your card, UPI, or bank credentials — see §4 |
| Visit and no-show counts | Each Café Partner accumulates a count of your completed visits and no-shows at that café. Staff at that café can see these counts when they open your booking |
| Email verification and password-reset codes | Stored only as hashes, time-limited, and single-use |
| Security and audit logs | Including your IP address, the action taken, and timestamps — for failed logins, rate-limit blocks, and changes to café settings |
2.3 Data we do not collect
We do not collect payment instrument details, we do not use advertising or cross-site tracking cookies, and we do not build advertising profiles. The only cookie nextBooq sets is a session cookie (nb_session), which is HttpOnly and exists solely to keep you signed in. Our hosting provider may set its own strictly-functional cookies to route and secure requests.
3. Why we process your data, and on what basis
Under the DPDP Act we process personal data on the basis of your consent, given when you create an account and confirm a booking, and for certain legitimate uses permitted by the Act (such as responding to your own requests and complying with law).
| Purpose | Data used |
|---|---|
| Creating and securing your account | Name, email, phone, password hash |
| Verifying your email address | Email, verification code hash |
| Creating and honouring reservations | Name, phone, reservation details — shared with the relevant Café Partner |
| Collecting and refunding the reservation deposit | Payment references, shared with Razorpay and the Café Partner |
| Showing you your booking history | Reservation records |
| Letting a café recognise repeat guests and manage no-shows | Visit and no-show counts |
| Protecting the Platform from abuse | IP address, audit logs, rate-limit records |
| Responding to your queries and grievances | Whatever you send us |
We do not sell your personal data, and we do not share it for anyone else's marketing.
4. Who we share your data with
| Recipient | What they receive | Why |
|---|---|---|
| The Café Partner you book with | Your name, phone, email, and reservation details | To honour your booking |
| Razorpay Software Private Limited | Payment details you enter directly with them, plus the order reference | To process the deposit. Razorpay is an RBI-regulated payment aggregator and is a separate Data Fiduciary for the payment data you give it. Your card/UPI details go to Razorpay, never to us |
| Resend | Your email address and the message content | To send verification, password-reset, and booking emails |
| Amazon Web Services and MongoDB Atlas | Data at rest and in transit | To host our API and database, both in the Mumbai region (ap-south-1) |
| Vercel | Requests for the website and dashboard | To serve the frontend from a global content delivery network |
| Law enforcement or regulators | As legally required | Only where compelled by valid legal process |
Important: each Café Partner collects deposits into its own Razorpay account. Money for a booking goes to that café directly, not to nextBooq.
5. Where your data is stored, and cross-border transfers
Your personal data is stored and processed in India. Our application database (MongoDB Atlas) and our API servers (Amazon Web Services) are both located in the Mumbai region (ap-south-1).
We do not transfer your personal data outside India for storage. The DPDP Act permits such transfers except to countries the Central Government restricts by notification; if we ever begin storing or processing personal data outside India, we will update this policy before doing so.
Our website is served from a global content delivery network, so static page assets — and the routing check that decides whether you are signed in — may be handled at edge locations outside India. That check reads only whether your session cookie is present and unexpired; it does not read your profile, your bookings, or any other personal data, and it stores nothing.
All storage, and all processing of your account and reservation data, happens in India.
6. How long we keep your data
| Data | Retention |
|---|---|
| Account data | While your account is open, and for 12 months after you ask us to delete it or after prolonged inactivity |
| Reservation and deposit records | 8 years, to meet tax and accounting obligations |
| Security and audit logs | 12 months |
| Verification and reset codes | Minutes — cleared as soon as used or expired |
These are the retention periods we operate to. They are applied on request and on review rather than by an automated deletion job, so if you want your data erased sooner, ask us (see §7) and we will action it. Under the DPDP Act we must erase personal data once the purpose is served and retention is no longer required by law.
7. Your rights as a Data Principal
Under the DPDP Act you have the right to:
- Access — obtain a summary of the personal data we hold about you and how it is processed, including the identities of those we have shared it with. This includes the visit and no-show counts a Café Partner holds about you.
- Correction and completion — have inaccurate or incomplete data corrected. You can change your own name, email address and phone number from your profile at any time; anything else, ask us.
- Erasure — have your data deleted once the purpose is served, subject to retention we are legally required to observe (see §6).
- Nomination — nominate another individual to exercise your rights if you die or become incapacitated.
- Grievance redressal — complain to us first (see §9), and escalate to the Data Protection Board of India if unsatisfied.
- Withdraw consent — at any time, and as easily as you gave it. Withdrawal does not undo processing already carried out, and may mean we cannot honour existing reservations.
How to exercise these rights. Access, erasure and nomination are handled by our Grievance Officer rather than through a self-service screen: email shashanksingh9048@gmail.com from the address registered on your account and we will respond within 30 days. Correcting your own name, email or phone does not need a request — do it from your profile.
You are responsible under the DPDP Act for providing accurate information and for not filing false or frivolous complaints.
8. How we protect your data
- Passwords are hashed with bcrypt and are never stored or transmitted in readable form.
- Sessions use an
HttpOnlycookie, so page scripts cannot read your session token. - Each Café Partner's payment credentials are encrypted at rest with AES-256-GCM.
- Access to café data is restricted by role, and staff can only see data for cafés they belong to.
- All traffic is served over HTTPS.
- Failed logins, rate-limit blocks, and settings changes are recorded in an audit log.
No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.
9. Grievance Officer
- Grievance Officer: Shashank Singh
- Designation: Grievance Officer & Managing Partner
- Email: shashanksingh9048@gmail.com
- Phone: +91 96300 23003
- Address: Lovely Professional University, Jalandhar-Delhi G.T. Road (NH-1), Phagwara, Punjab 144411
We acknowledge complaints within 24 hours and resolve them within 15 days, in line with the IT Rules 2021. If you are not satisfied, you may complain to the Data Protection Board of India.
10. Children
The Platform is not intended for anyone under 18. We do not knowingly process the personal data of children. Under the DPDP Act, processing a child's data requires verifiable parental consent and prohibits tracking and targeted advertising directed at children. If you believe a child has registered, contact the Grievance Officer and we will delete the account.
11. Changes to this Policy
We may update this Policy. Material changes will be notified by email or in-Platform notice at least 15 days in advance. The "Last Updated" date above always reflects the current version.
12. Contact
nextbooq@gmail.com · +91 96300 23003 · Lovely Professional University, Jalandhar-Delhi G.T. Road (NH-1), Phagwara, Punjab 144411
This document is a compliance scaffold prepared for nextBooq and is not legal advice. Have it reviewed by a licensed Indian advocate before publication.