Skip to main content
Mikky
Early access
Compliance & Legal

Privacy Policy

Last updated: October 5, 2026

Summary in plain English

Mikky processes data under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

For restaurant diners whose data is synced from a POS, the restaurant is the Data Fiduciary and we act solely as the Data Processor on their instructions.

We never sell personal data, never share guest profiles across competing restaurants, and do not use your customer data to train public AI foundation models.

All marketing campaigns sent over WhatsApp require explicit human manager approval and strict opt-in compliance.

1. Who we are and scope

This Privacy Policy governs the collection, processing, and protection of personal data by Mikky Technologies Private Limited (“we”, “us”, or “our”), operating the brand Mikky. Our registered office is located at [TO BE FILLED — Registered Office Address].

This policy applies to all visitors of our website, early-access applicants, and users of the Mikky software platform, dashboard, and WhatsApp integrations.

2. Our legal roles under the DPDP Act, 2023

Under the Digital Personal Data Protection Act, 2023 (India), data responsibilities are divided into two distinct capacities:

  • Where we act as Data Fiduciary: We determine the purpose and means of processing for our website visitors, restaurant partners, account administrators, and early-access applicants.
  • Where we act as Data Processor: For restaurant guest data (such as diner names, phone numbers, visit timestamps, and bill totals) uploaded or synced by a restaurant partner from their Point of Sale (POS) system, the restaurant is the Data Fiduciary. We process that data solely on the documented instructions of the restaurant.

3. Personal data we collect

A. Information you provide directly: When you submit our early-access or contact form, we collect your full name, restaurant or cafe brand name, operating city, direct mobile/WhatsApp number, work email address, and your consent record.

B. Restaurant guest data processed on behalf of clients: When a restaurant connects its billing system, we receive diner phone numbers, visit dates and frequencies, itemized order values, party sizes, and derived behavioral metrics (such as average spend, churn probability, and visit cadence tags).

C. Messaging and delivery metadata: WhatsApp message template IDs, delivery timestamps, read receipts, and incoming keyword responses (e.g., reservation confirmations or STOP opt-out requests).

D. Technical log data: Browser type, operating system, IP address, and system session logs collected for operational security and fraud prevention.

4. Purposes of processing

We process personal data strictly for specified, lawful business purposes:

  • Evaluating and onboarding restaurant operators into our early-access program.
  • Computing customer analytics, churn risk scores, and visit cadence intervals for partner outlets.
  • Generating candidate campaign drafts and routing them to restaurant managers for explicit approval.
  • Transmitting authorized campaign messages and automated reservation confirmations via the WhatsApp Business Platform.
  • Complying with statutory accounting, tax, and regulatory requirements under Indian law.
We never sell, rent, trade, or monetize personal data to data brokers or third parties.

5. Meta and the WhatsApp Business Platform

Outbound messages and 2-way reservation replies are transmitted through the official WhatsApp Business Platform provided by Meta Platforms, Inc. Message content, delivery telemetry, and recipient phone numbers are processed by Meta in accordance with the WhatsApp Business Data Processing Terms and Meta's Privacy Policy.

Restaurants using our platform warrant that they have collected valid consent from their guests before dispatching promotional templates.

6. AI processing and human oversight

Mikky uses statistical algorithms and language models to analyze visit timelines and compose recommended campaign drafts.

  • No autonomous dispatch: The AI cannot send messages on its own. Every campaign draft, recipient list, and promotional offer requires a human manager to review and click approve.
  • No model training on customer data: Restaurant guest data, phone numbers, and order history are never used to train or fine-tune public foundation models.

7. Sub-processors and infrastructure

We engage vetted enterprise sub-processors to maintain secure cloud infrastructure:

  • Cloud hosting & serverless compute (AWS / Vercel, with servers located in India).
  • Managed database infrastructure (Supabase / AWS RDS with encryption at rest).
  • Messaging infrastructure (Meta Platforms Ireland / WhatsApp Business API).
  • Transactional email delivery (Resend / AWS SES).

8. Data retention and security

We retain personal data only for as long as necessary to fulfill the operational purpose or comply with applicable statutory retention requirements. When a restaurant terminates its contract, customer CRM records are permanently expunged or anonymized within 30 days.

Security controls include AES-256 encryption at rest, TLS 1.3 transit encryption, role-based access boundaries, and periodic vulnerability assessments.

9. Your rights under the DPDP Act, 2023

Indian data principals possess enforceable statutory rights:

  • Right to access an itemized summary of personal data held.
  • Right to correction and updating of inaccurate records.
  • Right to erasure of personal data that is no longer necessary.
  • Right to grievance redressal and nomination of representatives.

To exercise rights regarding restaurant CRM records, diners should first contact the restaurant where they dined. For direct inquiries, write to privacy@mikky.in.

10. Grievance Officer and contact details

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, our designated Grievance Officer is:

Name: [TO BE FILLED — Grievance Officer Name]

Designation: Grievance Officer, Data Protection & Legal

Company: Mikky Technologies Private Limited

Address: [TO BE FILLED — Registered Office Address]

Email: grievance@mikky.in

Governing Law: Indian Law. Exclusive jurisdiction: Courts at Bengaluru, India.

Reference: Digital Personal Data Protection Act, 2023 (DPDP Act) & Information Technology Act, 2000.