Sizzle Privacy Policy

Sizzle is a technology platform for cafés, restaurants and other hospitality businesses.

Depending on the restaurant and features enabled, Sizzle may provide:

• QR-based ordering
• Table and order management
• Memberships
• Loyalty and CoinZ rewards
• Coupons and vouchers
• Reservations
• Customer engagement
• Restaurant analytics
• Staff and kitchen operations
• Customer communications

Sizzle provides the technology platform. The restaurant remains responsible for the food and hospitality services it provides, including its menu, pricing, preparation, quality, fulfilment, cancellations and refunds.

Sizzle does not currently sell the food itself or hold funds belonging to restaurants for food transactions.

The information we collect depends on how you use Sizzle.

Account information

We may collect:

• Name
• Mobile number
• Account identifiers
• Authentication and session information
• Restaurant and order information

When you interact with a restaurant through Sizzle, we may process:

• Restaurant you visit
• Table and session information
• Orders and order history
• Items ordered
• Reservations
• Membership information
• Loyalty points and CoinZ
• Rewards
• Coupons and vouchers
• Customer-service interactions

Your information is generally associated with the restaurant with which you interact.

Optional profile information

Depending on the features you choose to use, we may collect:

• Birthday month and day
• Reviews and ratings
• Event participation
• Information you voluntarily provide to us or a restaurant through Sizzle

We do not require your birth year where it is unnecessary for the relevant feature.

Student verification

If you request a student-specific discount or benefit, we may collect information necessary to verify your eligibility, including:

• Student identification information
• Student identification number
• Student identification document or photograph
• Verification status
• Verification date
• Validity or expiry date

Student information is used to verify eligibility and prevent misuse of student benefits.

Technical and security information

We may process:

• IP/network information
• Browser and device information
• Authentication and session information
• Error and diagnostic information
• Security and fraud-prevention information
• Technical logs required to operate and secure Sizzle

We use personal information for purposes including:

• Providing Sizzle
• Creating and maintaining accounts
• Authenticating users
• Processing orders
• Managing tables and sessions
• Managing reservations
• Providing memberships
• Maintaining loyalty balances and CoinZ
• Applying rewards, coupons and vouchers
• Restaurant operations
• Helping restaurants fulfil orders
• Providing restaurant staff with information required to operate their restaurant
• Maintaining order and reservation records
• Providing restaurant analytics
• Supporting customer service
• Student benefits
• Verifying student eligibility
• Determining the validity period of student benefits
• Preventing fraudulent or improper use of student benefits
• Rewards and engagement
• Providing birthday rewards where enabled
• Calculating loyalty benefits
• Delivering rewards and offers
• Measuring engagement with participating restaurants
• Communications

We may send:

• Order confirmations
• Reservation notifications
• Membership updates
• Security notifications
• Important service announcements
• Customer-support communications
• Marketing

Where permitted and where the required consent or other lawful basis exists, we may use information to:

• Send promotional WhatsApp messages
• Send promotional communications through future supported channels
• Provide restaurant-specific offers and campaigns

Marketing communications are separate from essential service communications.

Security

We may use information to:

• Prevent fraud
• Detect abuse
• Protect accounts
• Protect restaurants and customers
• Investigate security incidents
• Maintain platform integrity
• Product development and analytics

We may use appropriate operational, aggregated or de-identified information to:

• Understand how Sizzle is used
• Improve existing features
• Develop new features
• Improve reliability and performance
• Conduct analytics
• Develop benchmarks and insights
• Understand general restaurant and customer behaviour at an aggregated level

We do not use aggregated or de-identified information to identify individual customers.

Sizzle is a multi-restaurant platform.

Your customer relationship with a restaurant is generally scoped to that restaurant.

A participating restaurant should not receive access through Sizzle to your customer history with another restaurant.

Restaurants may receive information necessary to:

• Fulfil your order
• Manage your reservation
• Provide membership benefits
• Manage rewards
• Provide customer service
• Operate their Sizzle account
• Understand their own restaurant's customer and business activity

We do not intentionally provide one restaurant with another restaurant's identifiable customer database.

Restaurants may import customer information they already maintain into Sizzle.

They may do this to:

• Establish their customer database
• Provide memberships
• Provide loyalty benefits
• Send permitted communications
• Maintain customer relationships
• Provide restaurant analytics

The restaurant is responsible for ensuring that it has the appropriate authority and lawful basis to provide such information to Sizzle.

Sizzle may process this information as necessary to provide the contracted restaurant services and related functionality.

Sizzle and participating restaurants may use supported communication channels to send marketing messages.

Sizzle currently supports promotional communications through WhatsApp where enabled. SMS and email marketing may be introduced in the future.

Marketing communications are separate from essential communications such as:

• Order confirmations
• Reservation updates
• Account and security notifications
• Membership and service notifications
• Important operational messages

Where consent is required for marketing, it will be requested separately.

You may withdraw marketing consent or opt out of promotional communications using the available unsubscribe or preference mechanisms.

Sizzle uses third-party providers to operate and improve the platform.

These may provide:

• Cloud hosting
• Database infrastructure
• Authentication
• Error monitoring
• Security
• Communications
• WhatsApp messaging
• Analytics
• Customer support
• AI-assisted functionality
• Payment processing when introduced

These providers may process information on our behalf where necessary to provide their services.

We seek to limit information shared with providers to what is reasonably necessary for the relevant purpose and use appropriate contractual and technical safeguards.

Sizzle may use third-party artificial intelligence or automated technology to provide certain features, analytics, support or product functionality.

Where practical, we minimise or remove unnecessary identifying information before information is processed by an AI provider.

We may use aggregated or de-identified information for analytics, product improvement and development.

We do not intentionally provide AI providers with unnecessary personal information merely because it is available to us.

Sizzle may create aggregated, statistical or de-identified information from platform activity.

We may use such information for:

• Product development
• Research
• Analytics
• Restaurant benchmarking
• Industry insights
• Platform performance
• Business intelligence
• Improving Sizzle's services

For example, Sizzle may identify general trends in restaurant ordering or loyalty engagement.

Such information is intended to be used in a form that does not identify individual customers or expose another restaurant's identifiable customer information.

If Flowyn or Sizzle is involved in a:

• Merger
• Acquisition
• Financing
• Restructuring
• Sale of assets
• Sale or transfer of Sizzle
• Corporate reorganisation

personal information and business records may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

We may access, use, preserve or disclose information where reasonably necessary to:

• Comply with applicable law
• Respond to lawful governmental requests
• Enforce our agreements
• Investigate fraud
• Prevent abuse
• Protect users
• Protect restaurants
• Protect Sizzle and Flowyn
• Investigate security incidents
• Establish or defend legal claims

Student information is collected when you request a student-specific benefit.

Sizzle may retain:

• Verification status
• Verification date
• Validity or expiry date

for as long as reasonably necessary to administer student benefits and prevent misuse.

Student identification documents or photographs will be retained according to our applicable retention procedures and legal requirements.

Where you choose to provide birthday information, Sizzle may use your birthday month and day to provide birthday-related rewards or benefits.

We do not require birth year for this purpose where it is unnecessary.

Sizzle's ordinary restaurant services may be used by people of different ages, including minors.

A minor may use Sizzle for ordinary activities such as:

• Browsing a restaurant menu
• Scanning a restaurant QR
• Placing a food order
• Receiving information about an order

We do not require users to be adults merely to use ordinary restaurant-ordering functionality.

We do not intentionally target children with advertising or use children's personal information for behavioural advertising.

Where a particular type of processing involving children's personal information is subject to additional requirements under applicable law, Sizzle will apply the safeguards required for that processing.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including:

• Providing Sizzle
• Maintaining accounts
• Providing restaurant services
• Maintaining order and transaction records
• Maintaining memberships and rewards
• Preventing fraud and security abuse
• Resolving disputes
• Enforcing agreements
• Meeting legal, tax or accounting requirements
• Protecting our legal rights

When information is no longer required, it may be deleted, anonymised or securely isolated in accordance with our retention procedures.

Different categories of information may have different retention periods.

Restaurants may retain their own legitimate business records, including customer and transaction records, where they have an independent business or legal reason to do so.

Subject to applicable law, you may have rights concerning your personal information, including the ability to:

• Request information about your personal information
• Request access to your personal information
• Request correction of inaccurate information
• Request deletion where applicable
• Request withdrawal of consent
• Opt out of marketing communications
• Raise a privacy grievance

Sizzle provides mechanisms for customers to submit privacy requests.

We may need to verify your identity before processing a request.

You may submit a privacy request through the available Sizzle privacy controls or contact:

privacy@sizzle.business

Where a restaurant independently controls or retains information about you, some requests may need to be addressed with that restaurant as well.

If a restaurant stops using Sizzle, the restaurant may request an export of its applicable business and customer data during the applicable data-export period.

Following that period, Sizzle may delete or anonymise information it no longer needs to retain, subject to:

• Applicable law
• Legal obligations
• Security requirements
• Dispute resolution
• Fraud prevention
• Legitimate retention requirements

We use reasonable technical and organisational safeguards designed to protect personal information against:

• Unauthorised access
• Unauthorised disclosure
• Loss
• Misuse
• Alteration
• Destruction

These safeguards may include:

• Authentication controls
• Role-based access
• Restaurant-level tenant isolation
• Database access controls
• Row-level security
• Security monitoring
• Error monitoring
• Access logging
• Security testing

No internet-based system can guarantee absolute security.

Some technology providers used by Sizzle may process information from locations outside India.

Where applicable, such processing will be subject to applicable Indian law and any applicable requirements or safeguards concerning international transfers.

We will maintain appropriate information regarding relevant service providers and processing arrangements as our vendor ecosystem develops.

We may update this Privacy Policy when:

• Our services change
• Our data practices change
• New features are introduced
• Our service providers change
• Applicable laws or regulations change

Where changes are material and notice is required, we will provide appropriate notice.

The latest version will be made available through Sizzle.

For questions about this Privacy Policy, personal-data processing, privacy requests or grievances:

• Privacy: privacy@sizzle.business
• General: flowyn.info@gmail.com
• Location: Hyderabad, Telangana, India