Privacy Policy

This Privacy Policy explains how Hiran Spectrum ("we", "us", "our"), the company behind Candle OS, collects, uses, discloses and protects information when you use our website, our restaurant management software, and related services (together, the "Service"). By using the Service, you agree to the collection and use of information as described in this policy.

1. Information we collect

We collect information in the following ways:

• Account information — name, email address, phone number, restaurant/business name, GSTIN and billing address when you sign up or request a demo.
• Operational data — menu items, orders, sales transactions, inventory records, customer records and staff records you input into Candle OS as part of running your restaurant.
• Payment information — processed securely through our payment partners; we do not store full card numbers on our servers.
• Usage data — pages visited, features used, device and browser type, IP address, and approximate location, collected automatically through cookies and similar technologies.
• Communications — records of support requests, emails, WhatsApp messages and calls you have with our team.

2. How we use your information

• To provide, operate and maintain the Candle OS platform for your restaurant.
• To process billing, generate GST-compliant invoices, and manage your subscription.
• To respond to support requests and communicate service updates.
• To improve our product, troubleshoot issues, and develop new features.
• To send marketing communications, which you can opt out of at any time.
• To comply with legal obligations, including tax and regulatory requirements applicable in India.

3. Data storage and security

Candle OS is hosted on servers located in India (AWS Mumbai region). We use industry-standard technical and organisational measures — including encryption in transit, access controls, and regular backups — to protect your data against unauthorised access, alteration, disclosure or destruction. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

4. Data sharing and disclosure

We do not sell your personal data. We may share information with:

• Service providers — cloud hosting, payment processing, SMS/WhatsApp/email delivery, and analytics providers who help us operate the Service, bound by confidentiality obligations.
• Legal requirements — where required by law, court order, or governmental authority in India.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice provided to affected customers.

5. Data retention

We retain your account and operational data for as long as your subscription is active, and for a reasonable period afterward to comply with tax, accounting and legal record-keeping requirements under Indian law. You may request deletion of your data subject to these legal retention obligations.

6. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to our legal retention obligations.
• Export your business data (menu, customers, sales history) in a standard format.
• Opt out of marketing communications at any time.

7. Cookies

Our website and application use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Service is used. See our Cookie Policy for details on the types of cookies we use and how to manage them.

8. Children's privacy

The Service is intended for business use by restaurant owners and staff who are 18 years of age or older. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date, and, where appropriate, via email.