Privacy Policy

This Privacy Policy explains what information Nocturnal Malt Houze (“we”, “us”) handles through this website, the table QR menu and the staff systems used inside the restaurant, why we handle it, and how you can contact us about it. We aim to handle personal data in line with applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. Who we are

Nocturnal Malt Houze is a restaurant and lounge in Kolkata, West Bengal, India. For any question about this policy or your information, write to us at hello@nocturnalmalthouze.com.

2. Information we handle

Guests browsing the website or the table menu. You do not need an account, and the website has no sign-up or contact form.

• When you open a table QR code, the website records which table was scanned so our team knows guests are waiting there. No name, phone number or other personal detail is collected.
• The “tray” you build on the table menu is stored only in your browser for that visit. It is never sent to us, and it is not an order.
• Like any website, our hosting and security providers process technical information such as your IP address, browser type and the pages requested, so the site can be delivered and protected from misuse.
• If we enable website analytics, it runs only after you accept analytics cookies (see section 4).

Our staff and administrators. For the people who use our internal systems we handle:

• name, work email address, role (staff or administrator), staff ID and account status;
• sign-in and session information, invitation, email-verification and password-recovery messages, and security records such as failed sign-in attempts (stored in a non-reversible, coded form) and an audit log of actions taken in the system.

Passwords are handled by our authentication provider and are never stored by us in readable form.

Bills and payments. When our team bills a table, we keep the items, amounts, discounts, the payment method used (UPI, cash or card) and any payment reference entered by staff. We do not ask guests for their name or contact details to issue a bill, and card or UPI payments are not processed through this website.

3. How we use information

• to run, secure and improve the website and the table menu;
• to let authorised staff and administrators sign in, invite new staff, verify email addresses and recover accounts;
• to manage the menu, tables, bills, payments and offers inside the restaurant, and to keep business and tax records;
• to respond to messages you send us;
• to detect and prevent misuse, fraud and unauthorised access.

We do not sell personal information, and we do not use it for advertising.

4. Cookies and similar technologies

• Essential, on your device: your cookie choice and music preference (kept in your browser’s local storage), and the table you scanned plus your tray (kept in session storage, cleared when you close the tab).
• Sign-in cookies: staff and administrators who sign in receive secure session cookies from our authentication provider. Guests do not.
• Analytics (optional): if enabled, Google Analytics cookies are set only after you choose “Accept” in the cookie banner. You can change your choice at any time using “Cookie preferences” in the footer.
• Maps: the “Visit” section shows an embedded Google Map, which loads from Google when you scroll to it. Google may process your IP address and set its own cookies under its own policies.

5. Service providers

We use trusted providers to run our systems. They process information on our behalf and under their own terms:

• Vercel — website hosting and delivery;
• Supabase — database, sign-in, file storage and account emails;
• Google — the embedded map and, only if enabled and accepted, website analytics;
• an email delivery service configured for invitation, verification and password-recovery messages.

Some of these providers may store or process information outside India. We may also disclose information where required by law or to protect our rights, guests or staff.

6. How long we keep information

• Bills and payment records are kept as business and tax records for as long as the law requires.
• Staff and administrator accounts are kept while the person works with us, and for a reasonable period afterwards for security and record-keeping.
• Security records of failed sign-in attempts are deleted automatically, normally within two days.
• Your tray and table context stay on your device and disappear when your browser session ends or you clear them.
• Technical logs are kept by our providers for their standard periods.

7. Security

We use reasonable technical and organisational safeguards: encrypted connections, role-based access so each person sees only what their role requires, server-side limits on sign-in and recovery attempts, and records of changes made in the system. No system can be guaranteed to be completely secure, but we work to protect the information we hold.

8. Your choices and requests

You may ask us for information about the personal data we hold about you, ask us to correct or update it, or ask us to delete it where we are not required to keep it by law. You may also raise a concern or grievance. Write to hello@nocturnalmalthouze.com; we may need to confirm your identity before acting on a request, and we will respond within a reasonable time.

9. Children

This website is intended for general audiences and is not directed at children. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be published on this page with its “last updated” date.

See also our Terms & Conditions.