RasoiOS Mess Privacy Policy

RasoiOS Mess is a management application from RasoiOS ("we", "us", or "our") for owners and staff of messes, tiffin services, hostels, and PGs. It is used to manage members, meal plans, attendance, leave, deliveries, member bills, and reports.

RasoiOS Mess is intended solely for mess owners, managers, and staff aged 18 or over. It is not a consumer food ordering or food delivery application.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use the RasoiOS Mess Android application (package com.rasoios.owner), its member portal, and related web pages (collectively, the "Mess Services").

Data controller: RasoiOS Technologies, operating from Raipur, Chhattisgarh, India. For privacy requests, contact rasoios.team@gmail.com.

When you register a mess, we act as the data controller for your account and profile information.

The information you record about your members (Section 3) belongs to your mess. For that information you are the data controller and RasoiOS acts as a data processor on your instructions. You are responsible for informing your members and obtaining any consent required under applicable law.

• Owner and staff data — name, email address, optional mobile number, role, mess name, city and address, and the business type you choose.
• Sign-in data — one-time sign-in codes, password hashes, session tokens, and security events such as sign-ins and password changes.
• Member data you record — member names, mobile numbers, optional email addresses, room, bed, and hostel details, meal plans, delivery addresses, emergency contacts, dietary notes, attendance and meal records, leave requests, wallet balances, dues, payments you record, UPI IDs where you add them, and complaints or notices.
• Device and diagnostic data — a Firebase Cloud Messaging token and the Android device ID used to deliver notifications to your device, app version, and crash reports.
• Subscription information — your RasoiOS plan, its status, and renewal dates. Plans are purchased on our website, not in the Google Play version of the app. Card numbers, CVV, and UPI PINs are handled by the payment gateway and never stored by us.

• Email code — we email a 6-digit one-time code to sign you in or verify your email address.
• Email and password — passwords are stored only as salted hashes.

The RasoiOS Mess Android app requests the following permissions. You may deny optional permissions, but related features may not work.

• Internet and network state — to sync with our servers and detect when you are offline.
• Camera — to scan member QR codes for attendance. Images are processed on the device and are not uploaded.
• Notifications — for leave requests, payments, low member balances, and account notices.
• NFC and basic phone state — declared by the Razorpay payment library included in the app. The Google Play version of RasoiOS Mess does not take payments in the app and does not use these permissions.

• Provide, operate, secure, and improve the Mess Services;
• Authenticate users and enforce the roles you assign to staff;
• Record attendance, meals, leave, deliveries, member bills, and reports for your mess;
• Sync attendance recorded offline once your device is back online;
• Send notifications to your device and the member messages described in Section 7;
• Manage your subscription and send service and security emails;
• Diagnose crashes and detect fraud, abuse, and security incidents;
• Comply with law and enforce our Terms & Conditions.

You can share a member portal link or QR code with your members. Members use it to see their own meals, wallet, and attendance and to request leave. You can turn the portal off at any time.

Where your plan includes WhatsApp messaging, member mobile numbers are used to send the messages you trigger and leave-decision updates through our messaging provider.

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we process personal data based on your consent, contractual necessity, legitimate uses permitted by law, or other grounds recognized under applicable Indian law. Where the GDPR or similar laws apply, we rely on contract, legitimate interests, consent, and legal obligation as applicable.

• All data is sent over HTTPS/TLS; the app does not allow unencrypted connections;
• Your session is stored encrypted on your device;
• Attendance recorded offline is kept on the device only until it syncs;
• App data is excluded from device and cloud backups;
• Server access is role-based, and each mess can only access its own data.

We use these service providers to operate RasoiOS Mess:

• Railway — cloud hosting and databases;
• Firebase Cloud Messaging (Google) — notifications to your device;
• Firebase Crashlytics (Google) — crash reports;
• Resend — sign-in and password reset emails;
• MSG91 — WhatsApp messages to members where your plan includes them;
• Razorpay — payments for RasoiOS plans purchased on our website;
• Google Play — app distribution.

These providers process data on our instructions and are governed by their own privacy policies. For more information, email rasoios.team@gmail.com.

We do not sell your personal information or use it for advertising. We share information only:

• With the service providers listed in Section 10;
• With your mess's staff according to the roles you assign;
• With your members, limited to their own records in the member portal;
• To comply with law, regulation, court order, or lawful government request;
• To protect the rights, safety, and security of RasoiOS, users, or the public.

You may access, correct, export, or delete your personal data, withdraw consent where processing is based on consent, and raise a grievance. Under the DPDP Act, contact our Grievance Officer at rasoios.team@gmail.com.

Members of a mess should contact their mess first, because the mess controls their information. Members may also contact us at rasoios.team@gmail.com.

• Active accounts: For the duration of your active account and subscription.
• Deleted accounts: see Section 14.
• Backups: Encrypted backup copies may persist up to 90 days before automatic purging.
• Billing and tax records: Billing, invoice, and tax records may be retained for up to 8 years as required under Indian tax and accounting law.
• Security logs: Security and fraud-prevention logs may be retained for up to 12 months.

Delete your account in the app under More → Account → Delete account, request deletion at https://mess-api.rasoios.com/account-deletion/, or email rasoios.team@gmail.com.

Your account is deactivated and signed out immediately. If you are the last owner of the mess, the mess is closed: staff are signed out and the member portal stops working.

After 30 days, names, email addresses, mobile numbers, rooms, notes, complaints, and message recipients are removed or anonymized. Bills, payments, and attendance keep their amounts and dates without personal details, as required for financial and tax records.

RasoiOS Mess is for business users aged 18 or over. We do not knowingly collect personal information from children through the app. If you believe a child has provided us personal data, contact rasoios.team@gmail.com.

RasoiOS is operated from India. Your information may be processed in India and in other countries where our service providers operate, with appropriate safeguards where the law requires them.

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Material changes may be communicated in the app or by email.

For privacy questions, rights requests, or grievances:

• Email: rasoios.team@gmail.com
• Data controller: RasoiOS Technologies, Raipur, Chhattisgarh, India
• Website: https://rasoios.com
• Contact Us