Privacy Policy
Last updated: 8 October 2026
In one line: RailFeasto Order Hub takes orders only for train food delivery, uses your information only to run those orders, and never sells or shares it with anyone.
1. Overview
RailFeasto Order Hub ("RailFeasto", "we", "us") is a restaurant order management platform. It helps restaurants receive, prepare and deliver train food orders. This policy explains what information we collect, how we use it, and the rules we follow.
2. Orders are for train food only
We take and process orders only for train food delivery — food ordered by passengers for delivery to railway stations, coaches and berths. We do not use order information for any other purpose, and we do not pass customer order details to anyone outside the restaurant fulfilling that order.
3. We never sell your data
We do not sell, rent, trade or share your personal data or your customers' order data with any third party, for advertising or for any other reason. Data is used solely to operate the order hub for the restaurant that owns it. We do not use customer data to train any AI model, and we do not build advertising profiles.
4. What we collect
- Account information: restaurant name, owner name, email address and password (hashed) when you create an account.
- Order information: order ID, customer name and phone, food items and amounts, train number, PNR, coach, seat/berth and station — only the fields present in the incoming order.
- Connected email account information: if you connect Gmail, we store your email address and OAuth access/refresh tokens, encrypted at rest. We never ask for or store your Gmail password.
- Processed email metadata: message ID, thread ID, sender, subject and received time of order emails, so the same email never creates duplicate orders.
5. Gmail access — how and why
When you connect your Gmail account, we request read-only access (gmail.readonly) plus your email address, through Google's official OAuth 2.0 flow. You grant this permission on Google's own sign-in page and can revoke it at any time from your Google Account or by disconnecting inside the app.
We use this access only to detect and process food-order emails (for example from IRCTC eCatering, Zoop, RailRestro, YatriRestro, RailRecipe, Pooja Peda and similar platforms) for the connected restaurant. Order emails are analysed to extract order details and shown on your dashboard. Non-order emails (personal mail, bank messages, promotions) are ignored and never stored.
RailFeasto's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. What we never do
- We never ask for or store your Gmail password.
- We never read your whole inbox for human review — only order-related emails are processed automatically.
- We never sell, rent or share your data or your customers' data with third parties.
- We never use order data for advertising or profiling.
- We never expose OAuth client secrets or tokens in the frontend.
7. Data storage and security
All data is stored in an encrypted cloud database with restaurant-level isolation, so one restaurant can never see another restaurant's orders. Email access tokens are encrypted at rest. Connections to the app are served over HTTPS.
8. Data deletion
When you disconnect Gmail, we delete the stored connection tokens. When you close your account, we delete your restaurant data on request. Write to railfeasto.official@gmail.com and we will delete your data.
9. Third-party platforms
Order data received from platforms (IRCTC eCatering, Zoop, RailRestro, YatriRestro, RailRecipe, Pooja Peda, etc.) belongs to the restaurant that received the order. We use it only to run that restaurant's operations. We are not affiliated with these platforms.
10. Contact
Questions about this policy? Email railfeasto.official@gmail.com.