Privacy Policy
Last updated: 18 September 2026
This Privacy Policy explains what data Cumin Connect ("we", "us", "our") collects, why, and how we handle it. We collect as little as possible and never sell your data.
1. Two types of users
Business owners sign in with Google and manage a dashboard. Reviewers (the business's customers) scan a QR code or tap an NFC card to rate the business. We treat these groups differently.
2. What we collect from business owners
| Data | Source | Purpose |
|---|---|---|
| Google account email | Google sign-in | Authentication, account identification, email alerts |
| Google account name and avatar | Google sign-in | Display in the dashboard |
| Business name | Entered by you | Shown on the rating page and dashboard |
| Google review link or Place ID | Entered by you | Open your Google review page when a customer chooses to post there |
| Payment information | Cashfree | We receive a confirmation and order ID from Cashfree. We never see or store card numbers. |
3. What we collect from reviewers
We intentionally collect as little as possible from the people who scan a QR code.
| Data | Purpose |
|---|---|
| Star rating (1–5) | Core functionality — the rating screen and analytics |
| Feedback text, themes, contact info | Only if the reviewer voluntarily provides it on the private feedback form |
| Device type (phone/tablet/desktop) | Analytics for the business owner |
| Salted IP hash | Rate limiting only. We store a one-way hash, not the IP address. The hash cannot be reversed to recover the IP. |
Reviewers never create an account, never sign in, and are never tracked across visits. The rating page sets no cookies and uses no fingerprinting or analytics pixels. We do not collect names, email addresses, or phone numbers from reviewers unless they voluntarily type them into the feedback form. The salted IP hash is deleted 24 hours after the visit by a nightly job.
4. What we do NOT do
- We do not sell, rent, or share your data with third parties for advertising.
- We do not use third-party analytics or tracking scripts.
- We do not place cookies on the rating page. Business owners receive a sign-in cookie, and a visitor who opens a referral link receives a 30-day cookie holding only the referral code.
- We do not collect or store raw IP addresses.
5. Where data is stored
All data is stored in a Supabase project (PostgreSQL database hosted on AWS). Authentication is handled by Supabase Auth using Google OAuth. Payments are processed by Cashfree; we receive webhook confirmations but never handle card details. Feedback alert emails are sent via Resend.
6. Data retention
Business data is retained until you ask us to delete it, even after your trial or paid period ends, so that a returning owner finds their history intact. Ninety days after your trial ends, the funnel stops recording new data whenever you are not on a paid plan. Reviewer IP hashes are deleted after 24 hours. You can request full deletion of your account and all associated data at any time and we complete it within 7 days.
7. Your rights
You can:
- Access your data — everything is visible in your dashboard.
- Export your data — email us and we will send you a full export.
- Delete your account and all data — email us and we will do so within 7 days.
- Correct inaccurate data — edit your business name, Google review link, and settings directly in the dashboard.
8. Children
The Service is not directed at anyone under 18. We do not knowingly collect data from children.
9. Changes to this policy
We may update this policy. Material changes will be communicated via the email on your Google account. The "Last updated" date at the top always reflects the current version.
10. Digital Personal Data Protection Act, 2023
Cumin Connect is the data fiduciary for business-owner data and processes it on the basis of your consent given at sign-in. For reviewer data the business you rate is the data fiduciary and Cumin Connect processes it on that business's behalf. You may withdraw consent, request correction or erasure, or raise a grievance by emailing the contact below. We respond within 7 days. If you are not satisfied you may approach the Data Protection Board of India.
11. Contact
Questions about your data? Email us at mreazychamp@gmail.com.