Privacy, kept simple.

This notice explains how Food PhD (“we”) handles personal data under India’s Digital Personal Data Protection Act, 2023. Food PhD, Near Ariana Residency, Khodiyar Nagar, Sadguru Nagar, Devipada, Borivali East, Mumbai, Maharashtra 400066. FSSAI Lic. No. 21525012000838.

What we collect from customers

• Sign-in details held by Firebase Authentication: your email address, Google account name or phone number.
• Your PhD Club profile: name, date of birth, gender option (you can choose “Prefer not to say”), mobile number, and optional favourite food and dietary preference.
• Loyalty records: Shawarma and Momos stamp balances, visit and scan history, which staff QR you scanned, qualifying bill references and reward history.
• Your choices: whether you opted in to offers, and when you agreed to this notice.

We don’t collect payment card details. The camera is used only to read a QR on your own phone; no camera footage is uploaded or stored.

Why we use it

• To run your loyalty cards: confirm paid visits, add stamps and hand over rewards (based on your consent when you join).
• To prevent reward misuse, such as duplicate stamps.
• To send offers or birthday treats only if you opt in. That choice is separate and starts unticked. You can change it in your profile anytime.
• To keep sales and business records required by law.

We never sell your personal data or share it for other companies’ advertising.

Who can see it

Access is limited by role. Counter staff see the name on a stamp request and reward handovers. Managers can look up customers to correct stamps. Only the restaurant’s owners can see full customer profiles, delete accounts or export sales records. Every sensitive action is logged.

Where it is stored

Firebase (Google Cloud) provides sign-in and our database. Vercel hosts the website and its secure server functions. Supabase stores menu photos, private staff files and our encrypted daily backups. Google Maps provides the reviews we display. Google Fonts supplies the website’s fonts. These providers process data on our behalf and may store it outside India, subject to their security commitments.

Google reviews

Reviews are written on Google, not on this website. When you tap “Write a Google review”, Google’s own terms apply. The reviews we show are selected from our public Google listing, with the reviewer’s public Google name and photo. Reviews are always optional. Stamps and rewards never depend on a review or rating.

How long we keep it

• Customer accounts: while you use the PhD Club. Accounts inactive for 24 months are reviewed and anonymised at least once a year. You can ask us to delete yours sooner.
• Sales and expense records: as long as tax and accounting law requires. They are not linked to your identity once your account is deleted.
• Encrypted backups: daily copies for 30 days and monthly copies for 12 months, then deleted. Deleted data may remain in a backup until that backup expires.
• Older website reviews collected before this notice are archived privately, not shown, and are deleted on request.

Staff and team members

For employment records we store a team member’s name, login ID, role, photo and, with their agreement, birthdate, gender, phone, address, emergency contact and identity documents. Aadhaar is stored only as its last four digits or a masked copy. Only owners can open these private files, through links that expire after 60 seconds, and every view is logged. Documents are deleted 6 months after someone leaves, unless the law requires longer. Staff phones that turn on notifications store a notification token so we can alert them to new scans.

Your rights

You can ask to see the personal data we hold about you, correct or update it, have it erased, withdraw consent (this ends your loyalty membership), or nominate someone to act for you. If you’re under 18, please join with a parent’s or guardian’s consent.

Grievance contact

For any privacy question or complaint, contact the restaurant owners, +91 8655066023 (call or WhatsApp). We aim to respond within 7 days. If you’re not satisfied, you may complain to the Data Protection Board of India.

Other services

Swiggy handles orders and payments placed on its platform under its own policies. Google Maps, Instagram, Magicpin and WhatsApp open as external services with their own privacy terms. This website does not accept online payments.

Version 2026-10-30 · Updated 30 October 2026. When this notice changes materially, members are asked to review it again.