CarryTab Privacy Policy

1. Who We Are

CarryTab operates a digital tab platform for partner venues. For personal data processed through the CarryTab app and admin systems, CarryTab acts as a data fiduciary for its own product operations. Partner venues remain responsible for alcohol sale, service, payment collection, entry policy, and venue-level compliance decisions.

2. Data We Collect

• Account data: mobile number, optional name, city, date of birth.
• Service data: venue history, digital tab records, unit balances, redemption history, payment confirmations.
• Preference data: notification choices for reminders, promotions, and venue offers.
• Operational data: support requests, grievance submissions, audit events, and device or app diagnostics.

3. Why We Collect It

• Create and secure your CarryTab account.
• Verify that the user is not a child for DPDP purposes and support venue age-check workflows.
• Manage bottle balances, redemptions, and venue lookup flows.
• Provide support, resolve disputes, and maintain security logs.
• Send reminder or marketing notifications when you separately opt in.

4. Legal and Consent Basis

CarryTab relies on clear notice and consent for core account processing. Marketing and offer notifications are captured separately from the consent required to deliver the core service. You may withdraw optional notification consent at any time from your profile settings.

5. Data Minimisation

CarryTab is designed to avoid collecting Aadhaar, PAN, driving licence numbers, and home addresses for the standard customer flow. Only data needed for account creation, age verification, tab management, support, and compliance operations is collected.

6. Sharing

CarryTab may share personal data with:

• Partner venues to validate balances, purchases, and redemptions.
• Infrastructure and communications providers such as hosting, OTP, analytics, and error-monitoring vendors.
• Payment or settlement providers when enabled in the product.
• Authorities or advisers where legally required or necessary to protect legal rights.

CarryTab does not sell personal data.

7. Retention and Deletion

CarryTab keeps personal data only while needed for the disclosed purposes or for legal, accounting, fraud-prevention, or dispute-handling requirements. If you delete your account, CarryTab will anonymise or erase non-essential personal data and retain only records that must be preserved for compliance, finance, or legal defence.

8. Security

• HTTPS for API and web traffic.
• JWT-based authentication and password hashing for venue and admin access.
• Access separation between bartender, manager, owner, and admin surfaces.
• Audit logging for consent capture, privacy requests, and venue agreement events.

9. Your Rights

• Access and export your data.
• Correct your profile details and notification preferences.
• Delete your account, subject to lawful retention needs.
• Raise a grievance with CarryTab.

10. Contact

Grievance Officer: support@carrytab.com

Privacy Officer: privacy@carrytab.com