Privacy policy

1. Who we are

Boorista is operated by [Company legal name], a company registered in India with its registered office at [Registered office address] ("Boorista", "we", "us").

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described in this policy: we decide why and how it is processed. You are the Data Principal.

For anything about your data, write to [email protected]. Our Grievance Officer's details are in section 17.

2. The laws we follow

• The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025. Most obligations under the Rules apply from 13 May 2027; we follow them now.
• The Information Technology Act, 2000, including section 43A, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), for as long as they remain in force.
• The CERT-In directions of 28 April 2022 on reporting cyber security incidents and keeping logs.

3. What we collect

We collect only what Boorista needs to work. Most of it you give us directly; some is created as you use the app.

Sensitive information. Allergies, dietary needs and caffeine limits can relate to your health, which the SPDI Rules treat as sensitive personal data. We collect them only if you choose to add them, with your explicit consent, and use them only to keep unsuitable ingredients and drinks out of your suggestions.

What we don't collect. Precise location, your contacts, Aadhaar or other government ID numbers, payment card or bank details, or advertising identifiers.

4. Why we use it

We use your personal data only for these purposes:

• To run your account: sign-in, verifying your email, resetting your password, and keeping you signed in.
• To make your coffee: choosing drinks for you, adjusting each recipe's amounts to your taste and kit, and walking you through brewing it.
• To keep you safe: leaving out ingredients you've told us to avoid and keeping drinks within your caffeine limit.
• To personalise Boorista: using your ratings and notes to fit each suggestion and recipe to you. Our own models are also trained on ratings from all users, with names and emails removed, to make suggestions better for everyone.
• To send you messages you asked for: service emails, and push notifications if you allow them.
• To keep Boorista secure: preventing fraud, abuse and unauthorised access, and fixing faults.
• To improve Boorista: using counts and statistics that do not identify you.
• To meet our legal duties: responding to lawful requests and keeping the records the law requires.

We do not use your data for advertising, we do not sell or rent it, and we do not share it with data brokers.

5. Your consent

We process your personal data on the basis of the consent you give when you create your account, and the separate consent you give when you add sensitive information such as allergies or diet. Your consent covers only the purposes listed in section 4.

A few things we may do without your consent where the DPDP Act allows it ("legitimate uses"), such as meeting a legal obligation or responding to a medical emergency.

Withdrawing consent. You can withdraw consent at any time, as easily as you gave it, by writing to [email protected] from your account's email address. Once you do, we stop processing the data concerned and erase it, unless the law requires us to keep it. Withdrawing consent does not affect processing that happened before, and Boorista may not be able to work for you without the data it needs.

When registered Consent Managers become available under the DPDP Act, you may also give, manage and withdraw consent through one of them.

6. Automated suggestions and AI

Boorista's suggestions are made automatically by software, including models trained on ratings. They decide which coffee you see and how it's made. They do not make decisions with legal or similarly significant effects on you.

When you type a tasting note or a list of what's in your kitchen, the text may be sent to an AI language-model provider so Boorista can understand it. We send only the text you typed, not your name or email address. If you would rather your words never leave Boorista, rate with beans instead of typing.

7. Who we share it with

We share personal data only with the service providers below, who process it for us under contract and only on our instructions (as "Data Processors"), and in the other cases listed after the table.

We may also disclose personal data:

• to government agencies, courts or law enforcement when Indian law requires it;
• to protect the rights, safety or property of our users, the public or Boorista, as the law permits;
• to a buyer or successor if Boorista is merged, acquired or restructured, under the same protections as this policy; and
• to anyone else, if you ask us to or give us your consent.

If we change providers, we'll update this list.

8. Data stored or processed outside India

Some providers in section 7 process data outside India. Section 16 of the DPDP Act allows this, except to countries the Central Government restricts by notification. We will not transfer personal data to any restricted country, and we require every provider to protect your data to the standard this policy describes.

9. How long we keep it

• While your account is open: we keep your account and taste data for as long as you use Boorista.
• When you delete your account: we erase your account, taste profile, ratings and notes from our live systems. Backups are overwritten within 14 days.
• Inactive accounts: if you don't use Boorista for three years, we'll erase your account. We'll email you at least 48 hours before, and signing in keeps it.
• Security and access logs: kept for at least 180 days and up to one year, as Indian law requires, then deleted.
• Records of your requests: we keep a minimal record of data requests and account deletions (your email address, the request and the date) for up to one year, to show we handled them.
• Sign-in sessions: expire after 30 days. Password reset codes expire shortly after they're sent.

We may keep data longer only when a law requires it, and only for as long as it does.

10. How we protect it

We use reasonable security practices as required by section 43A of the IT Act and the SPDI Rules, and the safeguards in the DPDP Rules, including:

• encryption of all data sent between the app and our servers (HTTPS);
• passwords stored only as salted, scrambled hashes that cannot be turned back into your password;
• on the web, sign-in held in a secure cookie that scripts on the page cannot read;
• access to personal data limited to the people who need it, with access logged and monitored;
• regular backups, and contracts that require our providers to protect data as we do.

No system is perfectly secure. Keep your password private and tell us straight away if you think your account has been misused.

11. If something goes wrong

If a personal data breach happens, we will inform the Data Protection Board of India and every affected user without delay, and within the times the law sets. We'll tell you what happened, what data was involved, the likely consequences, what we're doing about it, what you can do to protect yourself, and how to contact us. We will also report cyber security incidents to CERT-In as required.

12. Your rights

Under the DPDP Act, you have the right to:

• Access: a summary of the personal data we hold about you, what we do with it, and who we've shared it with (section 11).
• Correct, complete and update your personal data (section 12). You can change most of it yourself in the app's Account tab.
• Delete everything yourself, any time: Account → Delete my account. It is erased immediately, and you can download a copy first with Account → Export my data. Instructions are on the delete your account page.
• Erase your personal data when it's no longer needed or you withdraw consent (section 12).
• Withdraw consent at any time (section 6).
• Have your grievances resolved by us (section 13), and then complain to the Data Protection Board of India.
• Nominate someone to exercise these rights for you if you die or become unable to (section 14).

Deleting your account: see how to delete your Boorista account.

How to use them. Email [email protected] from your account's email address, saying what you'd like. We may ask you to confirm your identity first, so we never hand your data to someone else. We'll reply within 30 days.

13. Your duties

Section 15 of the DPDP Act asks you to give accurate information, not to impersonate anyone, not to hide material information when giving your details, and not to file false or frivolous complaints.

14. Children

Boorista is meant for adults aged 18 and over. Under the DPDP Act, a person under 18 is a child, and we may process a child's personal data only with the verifiable consent of a parent or lawful guardian. We do not knowingly let anyone under 18 use Boorista without that consent.

We never track, profile or target advertising at children. If we find we've collected a child's data without a parent's verifiable consent, we will delete it. If you believe this has happened, write to [email protected].

15. Cookies and this website

boorista.in sets no cookies and uses no analytics, advertising or tracking tools. Its fonts and images are served from our own site, so visiting it sends nothing to third parties.

The Boorista web app uses one essential cookie to keep you signed in. It lasts up to 30 days, can't be read by scripts on the page, and isn't used for tracking. Without it you can't stay signed in, so it can't be switched off.

16. Notifications and emails

We send push notifications only if you allow them, and you can turn them off at any time in your phone's settings. We send service emails, such as verification and password reset, because the app needs them. We will not send you marketing emails unless you've agreed to receive them, and every marketing email will have a way to unsubscribe.

17. Grievance Officer and complaints

As required by the DPDP Act and rule 5(9) of the SPDI Rules, our Grievance Officer is:

We'll acknowledge your complaint within 2 working days and resolve it within 30 days.

If you're not satisfied with our response, you can complain to the Data Protection Board of India through its online platform, as the DPDP Act provides.

18. Changes to this policy

We may update this policy as Boorista or the law changes. If we make a significant change, we'll tell you in the app or by email before it takes effect, and ask for fresh consent where the law requires it. The date at the top shows when it last changed.

This policy is in English. You can ask for it in any of the languages listed in the Eighth Schedule to the Constitution of India by writing to [email protected].

19. Governing law

This policy is governed by the laws of India. Subject to your rights to approach the Data Protection Board of India, the courts at [City] have jurisdiction over any dispute about it.